How document fraud detection actually works — 43 checks, and why 17 of them are not about fraud

Why looking at the document does not work

Editing a payslip used to require skill. It now requires a text editor and a few minutes, and the output has consistent fonts, plausible spacing and clean metadata at a glance. Manual review still catches the careless fakes — a misaligned logo, a font that changes mid-number — and the careful ones go straight through, because there is nothing to see.

The reason is structural rather than a failure of attention. A reviewer checks whether a document LOOKS like the documents they have seen. A forger optimises for exactly that. The two are playing the same game, and the forger gets to move second.

A forensic check plays a different game. It does not ask whether the document looks right; it asks whether the document is internally consistent with itself and with the world outside it. Those are questions with answers, and the answers do not depend on how convincing the layout is.

The three things a check inspects

ARITHMETIC. Gross minus tax minus deductions should equal net pay. Year-to-date figures should be consistent with the period figures. A superannuation contribution should be the statutory percentage of ordinary time earnings. Each of those is a calculation, and a calculation either balances or it does not — there is no judgement to argue with, and no amount of visual polish changes the result.

IDENTIFIERS. Australian company and business numbers carry check digits: an ABN verifies against a weighted modulus-89 sum, an ACN against its own scheme. A number invented to look plausible fails that arithmetic. This is the cheapest check in the set and one of the most decisive, because a forger has to either use a real entity’s identifier — which is traceable — or produce one that verifies, which requires knowing the algorithm.

STRUCTURE. A PDF is not a picture; it is a program describing how to draw a page. That program records things the rendered image does not show: whether text was added in a later incremental update, whether a value is drawn in a different font from its neighbours, whether an annotation is painted over the top of the original figure, whether the file was produced by a word processor or by a payroll system. A screenshot of a payslip destroys all of it, which is itself worth knowing.

The 43 signals

The count matters less than the spread. A check that only reads metadata is defeated by stripping metadata; one that only recomputes arithmetic is defeated by a forger with a calculator. The families below fail independently, which is what makes defeating all of them at once expensive.

Every signal reports its own evidence. "Superannuation contribution deviates from the statutory minimum" arrives with the claimed figure, the expected figure, and the rate it was measured against — not as a score to be taken on trust.

Seventeen checks that never raise a fraud flag

Every check in the set was run against genuine documents as well as forged ones. Some of them turned out to fire on the genuine ones: hidden text spans, which are a normal by-product of rendering a web page to PDF and of OCR text layers. Screenshots, which mean somebody photographed their payslip rather than that they edited it. Missing text layers, which are what a scan legitimately looks like.

A check like that is not a detection capability. It is a false-accusation generator with good intentions, and the usual response — leave it in, weight it down a little, hope the score absorbs it — just spreads the error thinner. So those checks were moved onto a second axis instead. They still run. They still report what they saw. They cannot raise a fraud flag, at any weight, ever.

Ten of the seventeen carry no severity value at all. The remaining seven kept theirs, which looks odd until you see what the axis does: severity describes how notable a finding is, and the axis decides whether it is allowed anywhere near an authenticity verdict. Hidden text is worth telling you about. It is not evidence against anybody.

The practical consequence is that a low-risk result is not automatically a good result. A document can be low risk because nothing suspicious was found, or low risk because very little could be tested — and those are indistinguishable in a single score. Which is why coverage travels with every result rather than sitting in a footnote.

What a demoted check looks like

Year-to-date reconciliation compares period figures against the running totals. It is a legitimate check and it catches a real class of forgery. In the benchmark it caught that family zero times, and the reason is instructive: on genuine payslips it fired often, because YTD figures legitimately diverge — a mid-year start, a corrected prior period, a payroll migration, a document that simply prints the numbers differently.

A check that fires on honest documents more often than dishonest ones is not a detection capability. It is a source of false accusations wearing one. So it was demoted: it still runs, it still reports what it found, and it no longer contributes a fraud flag.

That decision costs measured detection rate, and it is published rather than hidden, because the alternative is a headline number bought with other people’s false accusations. A checker that never demotes anything is a checker that has never looked closely at its own false positives.

What it cannot do

THE CONSISTENT FORGERY PASSES. A forger who adjusts every figure so the arithmetic still balances, uses a real employer’s valid identifier, and produces the file through a genuine tool has defeated the arithmetic, the checksums and the structure at once. The benchmark includes eighteen documents built exactly that way, and none of them were flagged — which is reported as a control rather than buried, because it is the honest boundary of the method.

ABSENCE IS NOT PROOF. A clean result means these checks found nothing in the portion of the document they could read. It is not a statement that the document is genuine, and any workflow that treats it as one has built its confidence on the wrong side of the evidence.

THE FILE IS THE WHOLE WORLD. The check cannot ring the employer, cannot see the bank account the money went into, and cannot know the person exists. That is precisely why a consequential decision should confirm one figure from outside the document — a bank credit, an employer identifier, a direct call. One external confirmation defeats the entire class of internally-consistent forgeries that no file-level check can reach.

STATUTORY RATES CHANGE, AND OLD DOCUMENTS ARE NOT WRONG. The superannuation check holds the legislated schedule back to 2002 and selects the rate in force for the pay period, so a correct 2024–25 payslip showing 11.5% is not flagged for failing to be 12%. A checker that compares every document against today’s rate generates a false positive for every historical document it sees.

How to use a result

Read the signals, not the band. The band is a summary; the signals are the finding. "Net pay does not reconcile: claimed $4,210.00, computed $3,980.00" is something a reviewer can check in thirty seconds and a customer can explain. A risk score is neither.

Read the coverage before the conclusion. If the document was a photograph, the quality axis will say so, and the right response is to ask for the original PDF rather than to act on a thin read.

Confirm one figure externally when the decision matters. Not every figure — one. It is the cheapest defence against the one forgery family the method cannot reach, and it takes a phone call.

And treat a flag as a question, never an accusation. Someone wrongly suspected of forging a payslip has a real grievance, and the asymmetry is deliberate: the cost of a missed forgery is money, and the cost of a false accusation is a person. The result is designed around that difference.