Detect tampered and deepfake Travel Itinerary

What a genuine travel itinerary contains

An itinerary receipt lists the passenger exactly as the passport spells the name, the booking reference or PNR, and each flight segment: carrier code and flight number, departure and arrival airports as three-letter IATA codes, local times and dates, cabin, and often aircraft type and baggage allowance. A ticketed itinerary also carries a 13-digit ticket number opening with the airline's three-digit accounting code, the fare broken into base, taxes and surcharges, the form of payment, and the issuing agent or agency IATA number at the foot.

What the document is really being read for is the difference between a reservation and a ticket. A held reservation has a PNR and no ticket number, costs nothing, and expires. A purchased ticket has both, and money has moved. Within the page the segments have to connect: arrival at a transit airport before departure from it, carrier codes matching their flight numbers, and base fare plus taxes equalling the total. The dates then have to agree with the accommodation booking and the insurance period filed beside them.

How travel itinerary forgeries are made

• Dummy reservations presented as tickets

  A reservation is held without payment, the confirmation is submitted, and the hold is released once the appointment has passed. Nothing in the PDF is edited, which makes this the hardest variant to see in the file alone. What identifies it is the absent ticket number and a fare block that was never charged.

• Date shifts on a genuine confirmation

  Travel dates are moved on a real itinerary, usually to align a lapsed booking with a new appointment or to shorten a stay that exceeds the visa allowance. Day and month are replaced in the PDF text layer while the PNR, which still resolves to the original dates, is left untouched.

• Passenger name replacement

  Another traveller's confirmation is reissued under a new name. The replacement is longer or shorter than the name it displaces, so spacing and alignment drift, and the name at the top of the page stops matching the one repeated in the fare and ticket blocks further down.

• Template itineraries with airline branding

  A generic booking template is dressed with a logo pulled from the web. The logo arrives at a different resolution from the rest of the page, the layout follows no carrier's real confirmation, and fields such as fare basis or endorsement boxes are missing or filled with text no airline produces.

• Fabricated email wrappers

  The confirmation is presented as a printed email, with sender, subject and timestamp visible above it. Those headers are typed rather than generated, so the sending domain, the timestamp and the booking date regularly disagree with each other and with the segments printed below.

• Fare arithmetic that was never calculated

  Base fare, taxes, carrier charges and total are entered by hand and do not sum. A small tell and a reliable one, because a real receipt is produced by a system that could not print a total disagreeing with its own components.

What TamperCheck checks on a travel itinerary

TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.

• Arithmetic reconciliation

  Stated totals are recomputed from their components, and running or cumulative figures are checked for continuity across periods. A single edited value breaks the chain even when the page still looks right.

• Letterhead, logo, and issuer plausibility

  Issuer branding is checked for resolution and compression consistency against the body text it sits on. A logo lifted from a website carries the signature of its source, not of the document.

• Field-level forensics

  Every text region is analysed in its own right rather than as part of one whole-page image. This catches the smoothed and feathered edits that whole-image Error Level Analysis misses entirely.

• And many more checks

  The three above are the layers that carry the most weight on a travel itinerary. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.

Who verifies a travel itinerary, and why

Consulates and airlines confirming travel plans and return intent. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.

How to verify a travel itinerary in 4 steps

1. 1

   Retrieve the booking reference with the carrier

   Enter the PNR and the passenger surname in the airline's own manage-booking page. A genuine confirmation returns the same passenger, route and dates. A fabricated reference returns nothing, and a released dummy booking also returns nothing once the hold has lapsed.

2. 2

   Separate the reservation from the ticket

   Look for a 13-digit ticket number beginning with the airline's three-digit accounting code, printed alongside the booking reference. A reservation carrying no ticket number was never paid for, whatever the fare box above it says.

3. 3

   Check the segments against each other

   Confirm each carrier code matches its flight number, that connection times are physically possible, that the airport codes are the IATA codes for the cities named, and that base fare plus taxes and surcharges equals the total printed at the bottom.

4. 4

   Run a forensic check on the file

   A held reservation is a policy question; an edited PDF is a forgery. TamperCheck runs 200+ forensic checks over the itinerary and returns a risk score from 0 to 100 within seconds, naming the field that was altered, at $0.50 per document.

Frequently asked questions