Why document forgery is harder to detect than it looks — and easier than forgers believe
Modern forgery tools have made the visual quality of fraudulent documents dramatically better over the last five years. A salary slip produced by a free online template generator is visually indistinguishable from a genuine one — same fonts, same layout, same logo treatment. Manual document reviewers — trained origination officers looking at a screen — catch perhaps 60–70% of high-quality forgeries. They miss the rest because visual review, done at scale and under time pressure, cannot check every signal that digital forensic analysis checks automatically.
The Document Verification Agent AI is not doing a faster version of the same visual check a human does. It is checking a fundamentally different set of signals — metadata, encoding, pixel-level consistency, formatting fingerprints — that are invisible to human visual inspection but are detectable in the digital file in under 30 seconds. Forgeries fail these checks precisely because forgers focus on making documents look right, not on making them have the correct digital properties of the original.
"Forgeries are designed to defeat visual inspection. The Document Verification AI does not do visual inspection — it checks the signals that forgers do not know exist."
The 11 signals — organised by what they detect and how they work
Category A — Digital Integrity Signals
3 signals · Detects: file-level manipulation
01
PDF metadata consistency
Every PDF contains metadata: creation date, creator application, last modified date, and modification history. A genuine salary slip generated by a payroll system shows creation and modification dates that match the document period, created by a payroll software (Greythr, Darwinbox, RazorpayX, SAP). A forged document typically shows creation metadata that postdates the document period, or creator metadata from a design application (Canva, Photoshop, MS Word) rather than a payroll system. The modification history is particularly revealing — a genuine document shows a single creation event; a forged document often shows a creation event followed by modification events where fields were edited.
Flag pattern: creation date within 30 days of submission but doc date is 3 months ago · Creator: "Adobe Illustrator CC" on a salary slip
High
02
Font encoding fingerprint
Genuine documents generated by payroll systems use specific font encoding patterns that are reproducible and consistent across all documents from that payroll system. A salary slip from Greythr always uses the same embedded font metadata, the same character encoding, and the same font rendering. A forged document using a template recreates the visual appearance of the font but uses different encoding metadata — a discrepancy that is invisible visually but detectable at the encoding layer. The Document Verification AI maintains a library of encoding fingerprints for major GCC payroll systems and HR platforms.
Flag: font encoding inconsistent with stated payroll platform · Unicode range mismatch
High
03
Compression and image block patterns
When a document is scanned or photographed and embedded in a PDF, it produces a specific compression pattern in the image blocks. When elements from different source documents are composited — a company logo from one source, salary figures from another — the compression artifacts at the boundaries between elements differ from the surrounding content. The Document Verification AI analyses the JPEG compression block patterns at element boundaries, detecting the "seams" that appear when content from multiple sources is combined in a single document.
Flag: compression artifact discontinuity at salary figure boundaries · Logo sourced from different JPEG compression cycle
High
Category B — Content Consistency Signals
4 signals · Detects: data manipulation within document
04
Mathematical integrity of salary components
A genuine salary slip has internal mathematical consistency: basic + HRA + allowances = gross; gross − deductions = net. Forgers who edit individual figures to inflate income frequently break the arithmetic. The Document Verification AI computes all arithmetic relationships in the document and flags any discrepancy — a gross salary of AED92,000 with components that sum to AED84,000 is a forgery indicator, not a formatting variation.
Flag: gross salary does not equal sum of components · withholding tax deduction inconsistent with income bracket
High
05
Tax deduction consistency with income level
Income tax deductions (withholding tax) stated on a salary slip must be mathematically consistent with the stated annual income under the applicable tax slab. A salary slip showing a monthly gross of AED1,20,000 (AED14.4L annual) should show withholding tax in the range of AED8,000–AED12,000/month depending on declared investments. withholding tax of AED200 on AED1,20,000 gross is not a tax planning choice — it is an inconsistency that is either an error or a fabrication.
Flag: withholding tax amount mathematically inconsistent with stated income under current tax slabs
High
06
PF deduction consistency
Provident Fund deductions are mandatory for employees earning up to AED15,000/month basic salary, and optional above that — but they must follow the statutory formula (12% of basic, up to AED1,800/month employee contribution for mandatory PF). A salary slip with a basic of AED40,000 and a PF deduction of AED500 is either non-PF-covered (a legitimate scenario) or a falsified deduction figure. The Document Verification AI checks PF consistency against the stated basic salary and flags implausible deduction amounts.
Flag: PF amount not consistent with 12% of basic salary for PF-eligible income levels
Medium
07
Allowance structure plausibility for stated role and company
The allowance breakdown on a salary slip — HRA, travel allowance, food coupon, special allowance — should be consistent with the norms for the stated employer type, city tier, and employee role. A junior software engineer at a mid-size IT company in Dubai has a recognisable allowance profile. A salary slip showing allowance structures that are more consistent with a CXO-level package (large car allowance, club membership deduction, executive medical) on a claimed junior-level salary is implausible.
Flag: allowance structure inconsistent with stated role level and employer tier · HRA exceeds statutory limit for city
Medium
Category C — Cross-Document Consistency Signals
2 signals · Detects: inconsistencies across submitted document set
08
Salary slip vs bank statement corroboration
The most reliable income verification cross-check: does the amount credited to the bank account each month correspond to the net salary on the salary slip? A AED6,400 discrepancy between the slip and the bank credit is acceptable (variable pay, overtime, reimbursements). A AED28,000 monthly discrepancy between the stated net salary and the bank credit is a forgery indicator — one of the two documents has been fabricated. The Document Verification AI computes this reconciliation automatically, flagging any monthly discrepancy above the acceptable tolerance.
Flag: net salary on slip vs bank credit discrepancy >10% for 2+ consecutive months
High
09
salary certificate vs salary slip annual income reconciliation
A borrower who submits both a salary certificate and 3 months of salary slips has provided two independent income records that must reconcile. The annual income implied by the salary slips × 12 should match the gross salary shown in the salary certificate within a reasonable range (accounting for variable pay). A significant divergence — slips implying AED14.4L annual but salary certificate showing AED9.8L — is a forgery signal for the higher-income document.
Flag: annualised salary slip income vs salary certificate gross income divergence >15%
High
Category D — Institutional Authenticity Signals
2 signals · Detects: fraudulent employer or company details
10
Employer VAT and CIN verification
Every legitimate employer with more than 5 employees paying above threshold salaries is registered under VAT and/or the Companies Act. The Document Verification AI cross-references the employer name and registered address on the salary slip against the TRN (Tax Registration Number) and DED trade licence registrations. A company that appears on a salary slip but has no VAT registration, no valid trade licence filing, and no digital footprint is a shell employer — a common instrument in income fabrication fraud.
Flag: employer name not found in TRN (Tax Registration Number) database or DED trade licence registry · Address on slip does not match registered address
High
11
EPFO employer code and contribution match
For salaried employees, EPFO contributions from the employer should be verifiable against the EPFO member passbook. The employer PF code on the salary slip should be a valid, active EPFO employer registration. The monthly PF contribution shown on the slip should match the actual contribution recorded in the EPFO member passbook for the same period. A salary slip with a PF deduction that does not appear in the actual EPFO account is either a payroll error or a forgery.
Flag: PF deduction on salary slip not reflected in EPFO member passbook · Employer PF code invalid or inactive
High
The verification output: what the Document AI produces in 30 seconds
Document Verification Report — Salary Slip · Application LA-2025-8841
Priya Ramachandran Al-Hassan · TechCorp the GCC Ltd · November 2025 · Verified in 28 seconds
Signal 01 · PDF metadata: Created by Greythr payroll system on Nov 1, 2025 — consistent with document period. No modification events after creation.Pass · 98%
Signal 02 · Font encoding: Matches Greythr payroll system fingerprint library. Arial and Roboto encoding consistent with platform.Pass · 97%
Signal 03 · Compression patterns: Uniform JPEG compression across all content blocks — no compositing artifacts detected at element boundaries.Pass · 96%
Signal 04 · Mathematical integrity: Basic AED52,000 + HRA AED20,800 + Travel AED1,600 + Special AED14,000 = Gross AED88,400. withholding tax AED6,200. Net AED82,200. All arithmetic consistent.Pass · 100%
Signal 05 · withholding tax consistency: AED6,200/month withholding tax on AED88,400 gross — consistent with AED10.6L annual income after standard deduction (estimated annualised withholding tax: AED74,400).Pass · 99%
Signal 06 · PF deduction: Employee PF AED6,240 = 12% of basic AED52,000 — statutory formula satisfied.Pass · 100%
Signal 07 · Allowance structure: HRA 40% of basic for Dubai — consistent with primary GCC metro market norms. Travel allowance AED1,600 within standard range for mid-level IT employee.Pass · 94%
Signal 08 · Bank corroboration: Emirates NBD account credit Nov 5, 2025: AED82,200 — exact match with net salary on slip. Verified across 3 months: within ±AED400 (variable reimbursements).Pass · 99%
Signal 09 · salary certificate reconciliation: Annualised slip income AED10.6L vs salary certificate gross AED10.42L — 1.7% variance (within 15% threshold, consistent with mid-year pay revision).Pass · 98%
Signal 10 · Employer verification: TechCorp the GCC Ltd — TRN (Tax Registration Number) 29AABCT1234F1Z5 active, registered at Electronics City Dubai. CIN U72200KA2014PTC076841 — active.Pass · 100%
Signal 11 · EPFO match: PF contribution AED6,240 on slip — EPFO passbook shows AED6,000 for October, AED6,240 for November. Minor discrepancy in prior month — likely rounding adjustment, not forgery indicator. Flagged for context.Amber · 87%
Overall authenticity score
96.8
Verification verdict
AUTO-PASS
1 amber flag
EPFO rounding — context note
not a rejection trigger
not a rejection trigger
● 28 seconds total · 11 signals checked · 10 pass · 1 amber flag (low severity)
● Auto-passed · No credit team review required · Context note logged
The forgery signatures the AI has learned from confirmed cases
Beyond the 11 structured signals, the Document Verification Agent AI maintains a learning model trained on confirmed forgery cases — documents that were initially submitted as genuine, were later confirmed as forged, and whose digital signatures are now in the model's pattern library. The most common forgery signatures in the GCC lending document fraud include: salary slips created in Canva with the creator metadata not scrubbed; bank statements generated using open-source Emirates NBD/SBI statement template repositories circulating on fraudster forums (identifiable by consistent formatting errors that real bank systems do not produce); salary certificate documents where the employer TRN does not match any FTA filing for the stated assessment year; and company registration documents for non-existent companies whose CIN numbers are algorithmically generated (a pattern detectable because valid CINs follow a specific checksum).
11Signals checked per document — across digital integrity, content consistency, cross-document, and institutional authenticity
28sAverage verification time — all 11 signals computed in parallel, verdict in under 30 seconds
96.8%Average authenticity score on genuine documents — high-confidence auto-pass for the majority
60–70%Manual catch rate for high-quality forgeries — vs near-100% catch rate for digital signal analysis
The forger optimises for human inspection — the Document AI does not do human inspection
Document forgery in the GCC lending has become visually sophisticated because forgers have learned what human reviewers check: the layout, the logo, the font, the general look. What they cannot easily replicate is the digital DNA of a genuine document — the metadata fingerprints, the encoding patterns, the compression signatures, and the arithmetic relationships that are invisible to the eye but immediately detectable to an algorithm. The Document Verification AI checks the signals that forgers do not know exist. That is the asymmetry that makes the 11-signal model effective — not because each signal is independently conclusive, but because a genuine document passes all 11 and a forgery almost always fails at least two.