Supported document type
Detect tampered and deepfake Resignation Letter
A resignation letter is forged in the direction most people do not expect. Employee-written versions get backdated to rescue a notice period, but the costly forgeries come from the other side: a letter typed in a departing employee's name after a dismissal, so a termination reads as a voluntary exit and severance, notice pay and claim rights fall away with it. The file then becomes evidence in a dispute, where the signature and the acknowledgement stamp are what get argued over.
API slug: resignation_letter
Last updated:
What a genuine resignation letter contains
A resignation letter is one of the few documents in an employment file the employee writes. It carries their own name and employee ID, the date it was written, an addressee (normally the reporting manager or HR), a plain statement of intent to resign, the effective last working day, a reference to the notice period being served or waived, sometimes a reason, and a handwritten or electronic signature. Employers add an acknowledgement block: a received-on date, a countersignature, and a stamp in companies that use one.
Two dates and one signature carry the whole document. The date written plus the contractual notice period should land on the effective date the letter states; where it does not, the letter either waives notice explicitly or it has been backdated. An acknowledgement cannot predate the resignation it acknowledges. And the signature has to match the employee's other specimens in the same file, which is the comparison that decides whether the employee wrote the letter at all.
How resignation letter forgeries are made
Backdating the resignation date
The date written is moved earlier so a notice period appears to have been served, or so the resignation appears to precede a disciplinary process that actually came first. The altered date sits in a line whose remaining characters were rendered in one pass, and the replacement seldom matches them.
Signature transplanted from another employment document
The employee's signature is cropped from an offer letter, an appraisal form or an ID record and placed under text they never wrote. Identical stroke geometry across two documents is the signal: genuine signatures from one hand vary every time, and an exact match does not occur naturally.
A resignation manufactured after a dismissal
An employer facing a wrongful termination claim produces a resignation in the employee's name. Nothing on it is an edit of a real document, so the question becomes authorship: when the file was created, what software and fonts were available to whoever typed it, and whether the signature exists anywhere else.
Acknowledgement block added later
A genuine letter is scanned, then a received stamp and a countersignature are layered over the scan and the result reprinted. The added elements do not pick up the fold lines, the paper texture or the scanner's own distortion that everything beneath them shares.
Notice period rewritten
The clause stating what notice was served is changed so that pay in lieu becomes payable, or is forfeited. It is a short substitution inside a paragraph, and it leaves that line with spacing that no longer matches the justification of the lines above and below it.
What TamperCheck checks on a resignation letter
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Signature forgery analysis
Signature regions are assessed for ink consistency and for how the stroke sits on the page, which distinguishes a genuine pen stroke from a pasted image of one.
Date and validity consistency
Issue, expiry, and period dates are checked against one another and against the file's own creation metadata, which catches backdating and validity extension.
Field-level forensics
Every text region is analysed in its own right rather than as part of one whole-page image. This catches the smoothed and feathered edits that whole-image Error Level Analysis misses entirely.
And many more checks
The three above are the layers that carry the most weight on a resignation letter. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a resignation letter, and why
HR teams finalising departures and resolving wrongful termination disputes. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a resignation letter in 4 steps
Check the fields against each other
Read resignation date, notice period, and employee signature together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a resignation letter and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
Can a resignation letter be forged?
Yes, and in employment disputes it is one of the more consequential forgeries, because a forged resignation converts a dismissal into a voluntary exit and removes the severance, notice pay and claim rights that follow from one. Forgery here means either a backdated date on a real letter, or a letter written entirely by someone other than the employee whose name appears at the bottom.
How do HR teams verify a resignation letter?
HR teams verify a resignation letter by matching it to the trail around it: the email or portal submission that delivered it, the acknowledgement recorded on the same date, the notice period the contract sets, and the employee's signature already on file. Where the letter exists only as a scan with no delivery record behind it, forensic analysis of the file is what is left.
How can I prove a resignation letter is not mine?
Get the original file examined rather than a printout, and compare the signature on it with signatures you did sign. A signature copied from another document matches its source exactly, and that exactness is itself the proof, since no hand repeats a stroke path. A letter typed by someone else also carries creation metadata and layout habits that differ from your own documents.
Does a scanned resignation letter still show signs of editing?
Yes. A scan is a photograph of whatever was done before it, and it lays down a fingerprint of its own: one lighting gradient, one paper texture, one compression pass. Anything added after that scan misses those properties, and anything edited in before the page was printed shows up as text that was never on paper at all. TamperCheck reports the regions that fail.
TamperCheck analyses resignation letter uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.