Supported document type
Detect tampered and deepfake Form 1099
Form 1099 is the IRS family of information returns reporting income paid outside the W-2 employment relationship: 1099-NEC for contractor pay, 1099-INT for bank interest, 1099-DIV for dividends, 1099-K for platform settlements, and their siblings. Freelancers and investors lean on them as income proof for mortgages, rentals, and visas. Verification leans on structure and arithmetic, because each variant has its own box map and most 1099s show no withholding at all.
API slug: form_1099
What a genuine form 1099 contains
Every 1099 names the payer with a TIN and the recipient with a TIN, and reports amounts in boxes specific to its variant, such as Box 1 for nonemployee compensation on a 1099-NEC or Box 1 for interest income on a 1099-INT. Most variants carry no federal income tax withheld, so an empty withholding box is the norm rather than an omission.
Payer TINs may be EINs in the two-digit, seven-digit pattern, while recipient copies mask or omit SSNs depending on the copy. A bank's 1099-INT should reconcile with the interest actually posted on the same institution's statements, and a 1099-NEC should reconcile with the invoices and deposits behind the compensation, which usually sit in the same application file.
How form 1099 forgeries are made
Variant-aware layout
Each variant has its own title and box map. A 1099-NEC wearing a 1099-MISC layout, or compensation figures on an interest form, was assembled from the wrong template.
No-withholding semantics
Contractor and interest income normally arrives untaxed, so empty withholding boxes are expected. A withholding figure appearing on a variant that rarely carries one is the refund-fraud tell.
TIN structure
Payer EINs follow the two-digit, seven-digit pattern and recipient TINs follow theirs. Malformed identifiers indicate a hand-built form, and a payer TIN that changes across a file is a composite signal.
Cross-document reconciliation
1099 amounts should line up with the deposits, invoices, or statements that generated them. Compensation far above the money that actually moved is the inflation pattern lenders see most often.
Cell-level print forensics
As with the W-2, edited amounts betray themselves through font passes and digit spacing inside table cells, since amounts are usually the only region a forger touches.
What TamperCheck checks on a form 1099
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Table structure integrity
Inserted and deleted rows leave structural artifacts behind: inconsistent spacing, misaligned columns, and formatting the visible table no longer accounts for.
Field-level forensics
Every text region is analysed in its own right rather than as part of one whole-page image. This catches the smoothed and feathered edits that whole-image Error Level Analysis misses entirely.
Producer and creation metadata
Genuine documents carry consistent creation metadata from the system that issued them. PDF producer metadata naming a consumer editor, or a creation date that post-dates the date printed on the document, is a strong signal.
And many more checks
The three above are the layers that carry the most weight on a form 1099. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a form 1099, and why
Mortgage underwriters, CPAs, and gig platforms onboarding contractors. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a form 1099 in 4 steps
Identify the variant
Confirm which 1099 variant the form claims to be, since each carries its own box map and the analysis is variant-specific rather than generic.
Validate the identifiers
Check the payer EIN structure and the recipient TIN, and confirm neither changes across the documents in the file.
Reconcile the amounts
Line the reported amounts up with the bank statements, invoices, or prior-year forms in the file. Unbacked compensation is the inflation pattern to catch.
Run a forensic check on the file
Variant layouts and TIN formats are mechanical, but the edits that matter are in the cells. TamperCheck runs 200+ forensic checks with variant-aware layout validation and cell-level print analysis, returning a risk score from 0 to 100 with findings tied to specific regions of the image.
Frequently asked questions
What is the difference between a 1099-NEC and a 1099-MISC?
The 1099-NEC now carries nonemployee compensation, while the 1099-MISC holds the remaining categories such as rents and prizes. Older files show compensation on the MISC, so the variant matters both for layout expectations and for reading historical documents correctly.
Why is there no tax withheld on a 1099?
Contractors and interest earners generally receive income untaxed, so withholding boxes are legitimately empty on most variants. A withholding figure on a form that rarely carries one deserves scrutiny, because fabricated withholding is the basis of refund fraud.
Which 1099 do freelancers use as income proof?
A 1099-NEC from each client is the standard, backed by invoices and bank deposits. Verifiers should reconcile the total against the deposits that actually arrived, since the form alone does not prove the money moved.
How does TamperCheck handle 1099 forms?
TamperCheck identifies the variant, validates its layout and TIN structures, reconciles amounts where the file provides counterparts, and inspects table cells for figure-level edits. The service runs on a single REST endpoint, returns a risk score from 0 to 100, and ties findings to specific regions.
TamperCheck analyses form 1099 uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API documentation for authentication, async jobs, and webhooks.