Supported document type
Detect tampered and deepfake Lab Result
A lab report is faked by changing a number, and the number sits in a table, which is what exposes it. An edited cell carries a different baseline and pixel alignment from the column it belongs to, and the new value frequently stops agreeing with the flag beside it or the reference range printed on the same row. Collection dates and patient identifiers are edited for the same reason: a clean panel belonging to one person is worth reusing for another.
API slug: lab_result
Last updated:
What a genuine lab result contains
A laboratory report identifies who was tested, what was tested, and against what standard. The header carries the laboratory's name, address and accreditation number, the patient's name, identifier, age and sex, the referring clinician, the specimen type, the accession or barcode number, and the collection, receipt and reporting times. The body is a table with one row per analyte: test name, result, unit, reference range, and an abnormality flag, often with the method noted. The footer carries the reporting pathologist's name, registration number, signature, and an end-of-report marker.
The table is a set of dependencies, not a list. Age and sex select which reference range applies, and the flag in the last column is derived from the result and that range, so changing a value without changing its flag leaves a row that disagrees with itself. Times run forward from collection to receipt to reporting. The accession number ties the specimen to the patient named in the header, and units are fixed per analyte, so a value that only looks normal after a unit change is a value that was changed.
How lab result forgeries are made
Single-cell value edits
One result is overwritten in the table, which is the entire forgery in most cases. Typed-over digits rarely land on the column's text baseline, and the patch region carries different compression and sharpness from the cells above and below it, so table structure analysis isolates the row.
Reference range widening
Rather than change the result, the forger moves the reference range so an out-of-range value reads as normal. It is the subtler edit, because the headline number stays untouched, and it is found by checking the printed range against the standard range for that analyte, age, and sex.
Collection and reporting date changes
An old panel is re-dated so it satisfies a current requirement, such as a screening window for employment or travel. The edited dates often break their own sequence, with a reported time that no longer follows collection and receipt, or a date that contradicts the accession number's own series.
Patient identifier swaps
The name, identifier, age, or sex in the header is replaced so another person's clean results are presented as the subject's own. Changing age or sex without changing the reference ranges below leaves the entire table calibrated for a different patient.
Accreditation mark and signature reproduction
The laboratory's accreditation logo and the pathologist's signature are copied across from a genuine report. Both arrive as resampled raster elements with edges and colour profiles that do not match the crisp, single-pass rendering of the text and rules around them.
Reports generated from a laboratory template
A complete report is built from a laboratory's layout with values chosen to suit, so every row is internally consistent and no cell shows an edit. These are separated by generation signatures and by substrate analysis rather than by field comparison.
What TamperCheck checks on a lab result
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Table structure integrity
Inserted and deleted rows leave structural artifacts behind: inconsistent spacing, misaligned columns, and formatting the visible table no longer accounts for.
Reference and document number checks
Document, account, and reference numbers are checked for issuer format conformance and against every other place the same value appears on the page.
Field-level forensics
Every text region is analysed in its own right rather than as part of one whole-page image. This catches the smoothed and feathered edits that whole-image Error Level Analysis misses entirely.
And many more checks
The three above are the layers that carry the most weight on a lab result. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a lab result, and why
Insurers, employers, and clinicians acting on diagnostic data. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a lab result in 4 steps
Check the fields against each other
Read test values, collection date, and patient identifiers together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a lab result and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How can you tell if a lab report is fake?
Read each row against itself: the result, the unit, the reference range and the abnormality flag have to agree, and a normal-looking value carrying a high flag, or the reverse, is a row that was edited. Then check that collection, receipt and report times run in order, that the age and sex in the header match the ranges applied, and that the accreditation number belongs to a real laboratory.
How do employers verify medical test results?
Employers verify results by requesting them from the laboratory directly rather than from the candidate, using contact details they look up independently of the report. Where the report has to be accepted as submitted, it is screened forensically, which compares each cell against the structure of the table it sits in and flags the values whose print characteristics differ from their column.
Can an edited number in a lab report be detected?
Yes. Replacing a digit in a PDF or on a scan leaves that region with its own font rendering, baseline offset and compression history, none of which match the cells around it. Table structure analysis makes this easier rather than harder, because a results table gives every cell a set of neighbours with known alignment to be measured against.
What software detects forged pathology reports?
TamperCheck analyses laboratory and pathology reports through one REST endpoint, running 200+ forensic checks including table structure analysis on the results grid. A PDF, scan, or phone photo comes back with a risk score from 0 to 100 and each finding attached to the cell or header field it was raised against.
TamperCheck analyses lab result uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.