Supported document type
Detect tampered and deepfake Offer Letter
An offer letter proves income that has not started yet, so there is nothing to check it against: no payslip, no bank credit, no tax record. That absence is the whole attraction. A forged offer converts an imaginary job into a tenancy, a loan, or a visa months before anyone could notice the job never began, and the only evidence available is the letter itself, its letterhead, its signatory, its reference number. TamperCheck scores that evidence from 0 to 100.
API slug: offer_letter
Last updated:
What a genuine offer letter contains
An offer letter runs on company letterhead carrying the logo, registered address, registration number, telephone, and website. It is dated, addressed to the candidate by name at their address, and names the position, department, reporting line, and location. Compensation is set out as a structure rather than a single number: base salary, joining bonus, target variable pay, allowances, and equity where offered, with benefits listed separately. The letter states the intended start date, conditions such as background or reference clearance, an acceptance deadline, an offer reference number, and a signature.
The letter's credibility rests mostly on things outside the page. The letterhead's address, registration number, and domain must resolve to the company named. The signatory must exist within it and hold a role that can make offers. The reference number must follow that employer's own format. Internally, the compensation structure has to suit the level implied by the title, and the dates have to sequence properly, issued before the acceptance deadline, which itself falls before the start date. An offer is also a time-limited instrument, so a stale one deserves questions.
How offer letter forgeries are made
Compensation uplift
The base figure or the variable component on a genuine offer is raised so the future income clears a rental or lending threshold. Because nothing has been paid yet, no payslip or bank credit exists to contradict it, which is why this edit survives longer here than on any other income document.
Letterhead cloning from public files
Company letterheads are rebuilt from PDFs the company published itself: press releases, policy documents, careers material. The reconstruction is close, but the logo has usually been resampled, and the header's placement drifts from the spacing the company's own template produces.
Title escalation
The job title is upgraded to a level whose salary makes the stated compensation plausible. The tell is structural: senior offers in most organisations carry equity, longer notice, or variable components that this letter does not mention, because it was written for the junior role it actually describes.
Signatory and contact fabrication
The offer is signed by a name that does not work at the company, with an email on a free or lookalike domain and a phone number that reaches an associate of the applicant. Verification routed through the contact details printed on the letter simply confirms the forgery.
Reference number invention
An offer reference is made up to give the letter an administrative air. Employers that issue reference numbers use a consistent format tied to the requisition, so an invented one tends to be either suspiciously tidy or unlike anything the named employer uses.
Offers manufactured to order
Complete offer letters are produced as a service for visa, tenancy, and loan files, naming real companies that never made an offer. They are assessed on letterhead fidelity, how the file was rendered, and whether the company's published contact details and the signatory can be confirmed independently.
What TamperCheck checks on an offer letter
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Letterhead, logo, and issuer plausibility
Issuer branding is checked for resolution and compression consistency against the body text it sits on. A logo lifted from a website carries the signature of its source, not of the document.
Reference and document number checks
Document, account, and reference numbers are checked for issuer format conformance and against every other place the same value appears on the page.
Field-level forensics
Every text region is analysed in its own right rather than as part of one whole-page image. This catches the smoothed and feathered edits that whole-image Error Level Analysis misses entirely.
And many more checks
The three above are the layers that carry the most weight on an offer letter. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies an offer letter, and why
Lenders, landlords, and immigration officers confirming future income. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify an offer letter in 4 steps
Check the fields against each other
Read compensation, job title, and start date together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on an offer letter and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do banks verify a job offer letter?
Banks contact the employer through a number or address they find independently, never the contact details printed on the letter, and ask HR to confirm the offer, the title, and the compensation. Alongside that, they check the letterhead against the company's published material, confirm the signatory holds a role that can make offers, and run the file through document forensics.
How can you tell if an offer letter is fake?
Look at everything except the salary first. Check that the registered address, registration number, and website on the letterhead match the company's public records, that the signatory appears in the organisation, and that any email domain is the company's own rather than a free or lookalike one. Then confirm the compensation structure fits the seniority of the title being offered.
Why do lenders and landlords accept an offer letter as proof of income?
Because an applicant changing jobs has no other evidence of what they are about to earn. An offer letter is the only document that describes income before it starts, which is exactly why it is forged: nothing can contradict it for months. Most lenders treat it as provisional and ask for a first payslip once the job has actually begun.
Can a fake offer letter be detected from the PDF itself?
Often, yes. A cloned letterhead carries a resampled logo whose compression history differs from the text around it, and an edited compensation figure is rendered differently from the line it sits in. TamperCheck analyses the letter at field level and returns a risk score from 0 to 100, though confirming the signatory still needs a call to the employer.
TamperCheck analyses offer letter uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.