Supported document type
Detect tampered and deepfake Invoice
Most fake invoices are not fake documents. They are real invoices from a real supplier with the bank account block swapped, intercepted in an email thread and forwarded on so the payment lands somewhere else. The letterhead is genuine, the line items are genuine, the amount is the amount that was agreed. Detection means looking at the file rather than the layout, and asking whether the payment details were rendered at the same moment as everything around them. TamperCheck does that per field.
API slug: invoice
Last updated:
What a genuine invoice contains
An invoice names two parties and one obligation. It carries the supplier's legal name, address, and tax registration number, an invoice number drawn from that supplier's own sequence, an issue date and payment terms, and the customer's name and billing address. The body is a table: description, quantity, unit price, and line total for each item, then a subtotal, tax at a stated rate, and the amount due. Remittance details sit at the foot, usually an account name, a sort code or routing number, an IBAN or account number, and a payment reference.
Those numbers are not independent of one another. Each line total is quantity multiplied by unit price, the subtotal is the sum of the line totals, tax is a fixed percentage of the subtotal, and the total is subtotal plus tax. Raise one line and three other figures have to move with it. The invoice number belongs to a sequence and a date, so a number sitting outside the range the supplier was issuing that month is its own contradiction. The bank block is the exception: nothing else on the page constrains it, which is exactly why it is the field that gets changed.
How invoice forgeries are made
Bank detail substitution
A genuine invoice is intercepted, the remittance block is replaced with an account the fraudster controls, and the file is forwarded from a lookalike address. Nothing else changes, so every reconciliation check passes. The replaced text rarely carries the same rendering history as the paragraph it sits inside.
Amount and line item inflation
A quantity or a unit price is raised and the totals below it are rewritten to match. Done carefully the arithmetic still resolves and survives an automated sum check. Done quickly it does not, and subtotal plus tax stops equalling the stated total.
Duplicate invoice submission
The same invoice is put through twice under a new number and a shifted date so it clears accounts payable as a separate liability. The two documents share layout, line items, and often the pixel-level noise of a single original scan, which is what links them.
Supplier letterhead cloning
Logo, address block, and VAT registration number are lifted from a real invoice onto a fabricated one for goods never supplied. The cloned branding is usually a screenshot resampled to fit, so it carries a different compression profile from the text set around it.
Row insertion in the item table
A line is added to or removed from the item table and the surrounding rows are nudged to close the gap. Row heights and baseline spacing stop being uniform down the column, and the rules the original generator drew no longer enclose the text they were drawn for.
Wholly generated invoices
Produced from a prompt or a template engine rather than edited, so the arithmetic ties out and the invoice number looks plausible. These are identified by how the file was made instead: producer metadata, the absence of any print or scan history, and generation signatures in the rendered page.
What TamperCheck checks on an invoice
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Arithmetic reconciliation
Stated totals are recomputed from their components, and running or cumulative figures are checked for continuity across periods. A single edited value breaks the chain even when the page still looks right.
Table structure integrity
Inserted and deleted rows leave structural artifacts behind: inconsistent spacing, misaligned columns, and formatting the visible table no longer accounts for.
Letterhead, logo, and issuer plausibility
Issuer branding is checked for resolution and compression consistency against the body text it sits on. A logo lifted from a website carries the signature of its source, not of the document.
And many more checks
The three above are the layers that carry the most weight on an invoice. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies an invoice, and why
Accounts payable and procurement teams preventing payment fraud. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify an invoice in 4 steps
Check the fields against each other
Read invoice total, bank account details, and line items together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on an invoice and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do companies detect fake invoices?
Companies detect fake invoices by testing the document against itself rather than reading it. The arithmetic has to resolve, the invoice number has to fit the supplier's sequence, and the branding has to have been laid down in the same pass as the text beside it. Forensic analysis adds what the eye cannot see: compression history, font rendering, and edit traces tied to specific regions of the page.
What software catches invoice fraud?
TamperCheck analyses invoices through a single REST endpoint and returns a risk score from 0 to 100 with findings tied to specific regions of the file. It runs 200+ forensic checks per document, including table integrity and per-field edit traces, and delivers a verdict within seconds. Pricing is $0.50 per document, with no subscription or minimum.
How do I know if an invoice has been altered?
An altered invoice gives itself away through disagreement between fields rather than through appearance. Confirm that subtotal plus tax equals the total and that each line total is quantity times unit price, then check the bank details against the account you have paid before, using a phone number you already hold rather than one printed on the invoice. A forensic check covers what remains.
Can a changed bank account number on an invoice be detected?
Yes. Replacing the bank block on a genuine invoice leaves that text with a different rendering and compression history from the surrounding paragraph, even when the font matches exactly. Per-field analysis compares each region against its neighbours and names the one that does not belong, which is what makes this edit catchable when a visual review of the same page finds nothing.
TamperCheck analyses invoice uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.