Supported document type
Detect tampered and deepfake Residence Permit
A residence permit is checked for what it allows rather than for who it names, so the fields that get edited are the ones setting the limits. Validity dates are pushed forward so an expired permit passes a right-to-work check. Categories and remarks are rewritten so restricted employment reads as unrestricted, or a study permit reads as a work permit. The holder's identity is often entirely genuine. TamperCheck reports which of those limits moved.
API slug: residence_permit
Last updated:
What a genuine residence permit contains
A residence permit card records immigration status. It carries the holder's name, date and place of birth, nationality, sex, and portrait, and then the fields an employer actually acts on: the permit type or category, the valid-from and valid-until dates, the permit or card number, the place and date of issue, and a remarks line stating conditions on work, study, or access to public funds. Most cards add a machine-readable zone, a contactless chip, and biometric data stored on it.
Status fields are bounded by each other and by the scheme that issued them. A valid-until date has to fall inside the maximum term the category allows, the category has to agree with the remarks line qualifying it, and the machine-readable zone restates the card number and identity with check digits over each value. A card claiming unrestricted work under a category that never grants it is contradictory before any external record is consulted.
How residence permit forgeries are made
Validity date extension
The valid-until date is moved so an expired permit survives a right-to-work check. It is a two or four character edit on an otherwise genuine card, and it frequently pushes the permit beyond the maximum term its own category allows, which is a contradiction the card carries on its face.
Category and remarks rewriting
The permit type or the conditions line is altered so restricted status reads as unrestricted: a study permit relabelled for work, or a cap on weekly hours removed. The remarks area uses tighter line spacing than the rest of the card, and inserted or deleted text rarely reflows the way the original print does.
Permit number substitution
The card number is replaced, usually to detach the card from a record that has lapsed or been refused. Numbers follow the issuing scheme's format, and the machine-readable zone repeats the number with a check digit over it, so an edit made in one place and not the other fails at once.
Photo substitution on an inherited card
A genuine card that has expired for its original holder is fitted with a new face and passed on. The replacement sits over engraved or laminated print, so the security pattern that should continue across the portrait area stops at the edit, and the new face brings a different capture profile with it.
Cosmetic chips and dead codes
Cards are produced with a chip contact plate, a contactless symbol, or a QR code that is purely decorative: nothing is stored, nothing decodes, or the code decodes to values contradicting the printed card. Because almost no employer reads them, both sides treat these symbols as ornament.
Rendered permit images
Right-to-work checks are increasingly performed on an upload rather than a card in hand, which makes a rendered image sufficient. Every field agrees, having been produced together, so these are separated by print structure and by the absence of any camera or scanner in the image's history.
What TamperCheck checks on a residence permit
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Machine-readable zone validation
Check digits across every MRZ field are recomputed, and the encoded name, number, and dates are compared against the values printed on the face of the document. Forgers routinely update one and forget the other.
Portrait substitution and face-swap analysis
The document is isolated from whatever it was photographed on, then the portrait region is assessed against the card surface around it. A pasted or generated face rarely matches the substrate it was placed onto.
Security print, foil, and hologram analysis
A genuine security overlay or guilloche background behaves differently from a printed picture of one. A reproduction loses the structure that made the feature a security feature in the first place, and that loss is measurable even when the copy looks convincing on screen.
And many more checks
The three above are the layers that carry the most weight on a residence permit. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a residence permit, and why
Employers running right-to-work checks and immigration compliance teams. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a residence permit in 4 steps
Check the fields against each other
Read permit validity dates, holder photo, and permit number together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a residence permit and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do employers verify a residence permit?
Employers use the issuing government's own online checking service where one exists, since that is the only way to confirm the permit is still in force and what it permits. Where no service covers the document, the check falls back to the card: whether the validity window fits the category, whether the remarks agree with the permit type, and whether the image shows editing.
How can you tell if a residence permit is fake?
Read the status fields as a set, because that is where forgeries contradict themselves: a valid-until date beyond the maximum term the category grants, or a remarks line promising rights the permit type does not carry. Then read the machine-readable zone back against the card's printed values, and confirm the portrait area does not interrupt the security print running through it.
What happens if an employer accepts a forged residence permit?
The employer generally carries the liability, which is why right-to-work checks are documented rather than informal. Most compliance regimes offer a defence only where the prescribed check was performed and evidence retained, so an accepted forgery that was never properly examined tends to leave the organisation exposed regardless of whether the deception was convincing.
Can an expired residence permit be spotted if the date was edited?
Yes. Changing a date in a scan or a PDF leaves the altered characters with a different rendering and compression history from the digits beside them, even when the result looks clean on screen. TamperCheck compares each field against its neighbours and returns findings tied to the region that changed, within seconds.
TamperCheck analyses residence permit uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.