Supported document type
Detect tampered and deepfake Wire Transfer
A wire transfer confirmation proves less than it appears to. It records that a bank was instructed, not that money arrived, and the gap between those two facts is where the fraud lives. A supplier who releases a container against a forwarded MT103 and a stamped bank letter is trusting a document that can be built in an afternoon. The only safe confirmation is the credit showing in your own account. TamperCheck tells you whether the document itself was edited.
API slug: wire_transfer
Last updated:
What a genuine wire transfer confirmation contains
A payment confirmation is produced by the sending bank and carries that bank's letterhead, the date and time the instruction was accepted, and its own advice or transaction reference. It states the remitter's name and account, the beneficiary's name, account number or IBAN, and the beneficiary bank's BIC, together with the amount, the currency, the value date, and how charges are borne. Where a SWIFT MT103 is supplied instead, the same facts appear as numbered fields: 20 for the reference, 32A for value date, currency and amount, 50K for the ordering customer, and 59 for the beneficiary.
Those fields are not free text. Field 32A packs the value date, the currency code, and the amount into a single string, so an amount edited in the readable body has to be edited there too or the message contradicts itself. A BIC has a fixed eight or eleven character structure whose fifth and sixth characters are the country code, which has to agree with the beneficiary bank's stated country. The value date cannot fall before the instruction date, and the reference is the string the receiving bank quotes back, so it has to exist at the sending bank at all.
How wire transfer confirmation forgeries are made
Amount inflation
The figure is raised so a part payment reads as settlement in full, or a deposit reads as the whole contract value. On a formatted MT103 the amount exists twice, in the body and packed inside field 32A alongside the value date and currency, and an edit that misses the second copy leaves the message disagreeing with itself.
Beneficiary substitution
An authentic confirmation for a real payment is re-addressed so an unrelated party appears to have been paid. The beneficiary name and IBAN are replaced while the remitter, amount, and reference stay genuine, which keeps the document plausible to anyone who only checks that the sum is right.
Date and reference recycling
A confirmation from a payment that did clear is reused with the value date moved forward and the reference altered by a character or two, so one piece of evidence supports a second, imaginary transfer. Recycled documents share the layout and file lineage of the original, production metadata included.
Letterhead and stamp fabrication
A bank logo and a round authorising stamp are placed on a document the bank never produced. The stamp is the tell: a real impression varies in ink coverage and sits unevenly across the text it crosses, while a pasted one is uniform, perfectly circular, and lies above the type rather than through it.
Banking app screenshots
Proof of payment is often just a phone screenshot, which is the easiest artefact of all to alter. Balance, beneficiary, and status text are edited in place at screen resolution. Rendered interface text is mathematically uniform, so a substituted glyph that is slightly off in weight, spacing, or antialiasing separates from the line it sits in.
Fabricated advices
Templates for MT103 messages and bank advices circulate openly, so a complete confirmation can be produced with no underlying payment. Field syntax is usually right and nothing in the content betrays it, so the questions that remain are where the PDF came from and whether the reference and BIC cohere with the bank named on it.
What TamperCheck checks on a wire transfer confirmation
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Arithmetic reconciliation
Stated totals are recomputed from their components, and running or cumulative figures are checked for continuity across periods. A single edited value breaks the chain even when the page still looks right.
Stamp authenticity and placement
Stamps are assessed for whether the ink was impressed onto the page or printed as part of it, and for whether the impression was placed digitally after the fact.
Letterhead, logo, and issuer plausibility
Issuer branding is checked for resolution and compression consistency against the body text it sits on. A logo lifted from a website carries the signature of its source, not of the document.
And many more checks
The three above are the layers that carry the most weight on a wire transfer confirmation. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a wire transfer confirmation, and why
Finance teams and merchants releasing goods against proof of payment. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a wire transfer confirmation in 4 steps
Check the fields against each other
Read transfer amount, beneficiary details, and reference and value date together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a wire transfer confirmation and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do I verify a wire transfer confirmation?
Confirm the credit in your own bank account and treat the document as secondary, because a confirmation records an instruction rather than settled funds. If you must act on the document, check that field 32A's value date, currency, and amount match the readable body, that the BIC's country characters agree with the beneficiary bank, and that the reference is one the sending bank will acknowledge. Then run a forensic check on the file.
How do scammers fake proof of payment?
Scammers fake proof of payment by editing a genuine confirmation or by building one from a circulating template. The usual edits are the amount, the beneficiary, and the value date, dropped into a real bank's letterhead with a pasted authorising stamp. Screenshots from a banking app are altered the same way. None of it requires access to a bank, which is why the document evidences intent at best.
Can a SWIFT MT103 be forged?
Yes. An MT103 is structured text and nothing about its format is secret, so a complete, syntactically valid message can be typed out with no payment behind it. Detection works on internal coherence and on the file: whether the packed fields agree with the readable body, whether the BIC is well formed for the named bank, and whether the PDF carries signs of editing.
Should I release goods against a payment confirmation?
No, not on the document alone. A confirmation is evidence that an instruction was given, not that funds have settled, and the window between the two is exactly what advance fee and goods release fraud exploits. Wait for the credit to appear in your account, or for your own bank to confirm receipt. Where commercial pressure makes that impractical, run the confirmation through a forensic check first.
TamperCheck analyses wire transfer uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.