Synthetic & Tampered Documents

Document integrity checks answer: is this document genuine — or was it generated, edited, or assembled?

The newest and fastest-growing fraud class is the fully synthetic document: a bank statement or salary slip generated from scratch by an AI model, with a plausible layout, a real bank's branding, and numbers invented to pass an income check. There is no "original" that was tampered with — the whole artefact is fiction. Classic tamper detection (looking for edit seams) misses it entirely.

9thSense runs both families of signals:

Tamper signals (edited genuine documents)

Signal	What it indicates
Font & kerning anomalies	A pasted-in salary figure rarely matches the original typeface metrics exactly.
Layout deviations	Field positions, spacing, and alignment drift from the known template of that issuer.
Metadata inconsistencies	Creation tooling, timestamps, and modification history that contradict the document's claimed origin.
Compression & resampling artefacts	Regions of an image re-saved at different quality than their surroundings.

Synthesis signals (generated documents)

Signal	What it indicates
Template mismatch	The document doesn't correspond to any real variant the issuer produces.
Arithmetic inconsistency	Balances that don't carry, totals that don't sum, interest that doesn't compound — generators are bad at maths that must hold across a whole statement.
Internal contradictions	IFSC codes that don't match the branch address, transaction dates on non-business days, statement periods that disagree with transaction ranges.
Checksum failures	Synthesized ID numbers rarely satisfy real checksum algorithms — see Goal Rules.

Result shape

{
  "check": "document_integrity",
  "verdict": "flag",
  "risk": 0.72,
  "signals": [
    { "type": "arithmetic_inconsistency", "detail": "closing balance does not carry across pages 2-3" },
    { "type": "metadata_inconsistency", "detail": "creation tool inconsistent with claimed issuer" }
  ]
}

Signals are described at the level a reviewer needs — never as raw model internals — and every flag lands in the case audit trail.

Gating with Goal Rules

{
  "id": "document_integrity",
  "severity": "require",
  "check": "integrity_risk_below",
  "params": {
    "threshold": 0.5,
    "on_fail_message": "We could not verify this document. Please upload the original PDF or a clearer scan."
  },
  "on_deny": {
    "message": "Integrity risk above threshold — route to review.",
    "max_retries": 1,
    "remediate_type": "bank_statement"
  }
}

Integrity flags typically route to review rather than auto-reject: scanned photocopies and bank-app exports produce noisy metadata legitimately. Deterministic failures — a checksum that doesn't validate, arithmetic that doesn't hold — are safe to hard-stop.

Related checks

Goal Rules — deterministic format, checksum, and arithmetic rules per document type.
Cross-Verification — a synthetic document that survives integrity checks usually contradicts the other documents in the case.