Supported document type
Detect tampered and deepfake Utility Bill
A utility bill is the most widely accepted proof of address there is, and the least defended. It is not an identity document, it carries no security features, and the supplier that issued it has no obligation to confirm it to the bank reading it. Editing a name and an address in a PDF takes minutes, and template sites sell ready-made bills for every major supplier. The checks that work are forensic rather than visual, and that is what TamperCheck runs.
API slug: utility_bill
Last updated:
What a genuine utility bill contains
A utility bill is a billing statement with a metered service behind it. The head carries the supplier's branding, the account holder's name, the service address, and the correspondence address where the two differ. Beside them sit the account number, the bill number, the billing period with its from and to dates, the issue date, and the payment due date. The body is a table: previous meter reading, current reading, units consumed, the tariff and standing charge applied, the amount for the period, any balance brought forward, and the total due.
Consumption is what makes this document checkable. Units consumed have to equal the current reading minus the previous one, and the amount charged has to follow from those units at the stated tariff. Readings are cumulative across bills, so this period's opening figure is last period's close, and consecutive billing periods have to abut without gap or overlap. Usage also has a shape, since a household's consumption moves with the season and a meter never runs backwards, so a bill invented in isolation tends to state a figure no meter could have produced.
How utility bill forgeries are made
Account holder and address edits
A genuine bill belonging to someone else is taken and the name and service address are replaced with the applicant's. Everything downstream stays real, the account number and consumption table included. The replaced text is usually set in a close but not identical font and lands off the baseline grid the rest of the header sits on.
Date refreshing
Proof of address is normally required to be under three months old, so the billing period and issue date on an older bill are moved forward. Periods on consecutive bills have to abut, and a refreshed bill generally ends up overlapping or leaving a gap against the readings it still carries.
Reading and amount fabrication
Meter readings, units, and the total are written to whatever figures look ordinary, without the arithmetic beneath them being redone. Units consumed should equal current reading minus previous, and the charge should follow from the tariff, so invented figures produce a bill that contradicts its own table.
Supplier branding reproduction
Logos, colour blocks, and footer regulatory text are copied from a real bill or from the supplier's website and rebuilt into a new document. Copied branding is resampled artwork sitting in a page of vector text, and it carries edge and compression characteristics nothing else on the page shares.
Generator sites
Sites and image models produce complete bills for named suppliers from a name, an address, and a month, sold for the price of a coffee. The output is arithmetically coherent and correct at a glance, so detection rests on generation signatures and on a file with no print or scan history behind it.
Row insertion in the charges table
Lines are added to or removed from the charges table to change the total or to introduce a plausible standing charge. Generated tables hold a uniform row height and a consistent relationship between the rules and the text inside them, and an inserted row breaks that regularity even when the figures add up.
What TamperCheck checks on a utility bill
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Arithmetic reconciliation
Stated totals are recomputed from their components, and running or cumulative figures are checked for continuity across periods. A single edited value breaks the chain even when the page still looks right.
Table structure integrity
Inserted and deleted rows leave structural artifacts behind: inconsistent spacing, misaligned columns, and formatting the visible table no longer accounts for.
Letterhead, logo, and issuer plausibility
Issuer branding is checked for resolution and compression consistency against the body text it sits on. A logo lifted from a website carries the signature of its source, not of the document.
And many more checks
The three above are the layers that carry the most weight on a utility bill. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a utility bill, and why
Banks and regulated businesses accepting utility bills as proof of address. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a utility bill in 4 steps
Check the fields against each other
Read account holder name, service address, and billing period together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a utility bill and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do banks detect fake utility bills?
Banks detect fake utility bills by testing the consumption table rather than the letterhead. Units have to equal the difference between the two meter readings, the charge has to follow from the tariff, and the billing period has to sit against the previous one without a gap. Forensic analysis supplies the rest: resampled branding, text set after the page was produced, and a file with no print or scan history.
How can you tell if a utility bill is fake?
Read the meter readings and the arithmetic first, because that is where fabricated bills fail. Check that units consumed match the difference between the readings, that the total follows from the tariff and standing charge, and that the billing period agrees with the issue date. Then look at the header for text sitting off the baseline of the fields around it, the usual sign that a name or address was replaced.
What software verifies proof of address?
TamperCheck verifies proof of address documents through a single REST endpoint. Send a utility bill as a PDF, scan, or phone photo and it returns a JSON verdict with a risk score from 0 to 100 and findings tied to specific regions of the page, including the account holder block and the charges table. It answers within seconds at $0.50 per document, and files are processed ephemerally rather than stored.
Why are utility bills so easy to fake?
Because nothing about a utility bill is designed to resist forgery. It is printed on plain paper with no security features, it follows a layout published on every supplier's own website, and the supplier will not confirm it to a third party who asks. It became the standard proof of address for reasons of availability rather than integrity, and that is still why it is accepted.
TamperCheck analyses utility bill uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.