How Fake Documents Are Detected During AML Checks

Anti-money laundering (AML) checks depend heavily on the quality of the documents provided by customers. Bank statements, payslips and utility bills are routinely requested to evidence income, source of funds and proof of address. Unfortunately, these same documents are also commonly forged.

This guide outlines how fake documents are typically identified rather than how they are created. The focus is on the perspective of banks, law firms and compliance teams who need to distinguish authentic evidence from simulated or altered files.

The Role of Documents in AML and KYC

In most onboarding and enhanced due diligence processes, documentation helps firms answer basic questions:

• Does this person live where they say they do?
• Does their income or wealth match the profile and risk level?
• Can we reasonably verify the source of funds for a transaction?

Typical documents used include:

• Bank statements from regulated financial institutions
• Payslips and employment income records
• Utility bills and council tax statements as proof of address
• Mortgage statements or investment account summaries

Because these items are so important, AML teams increasingly receive training using simulated or novelty documents that help them practise identifying red flags in a safe environment.

Common Categories of Fake or Problematic Documents

From an AML perspective, suspicious documents tend to fall into a few broad categories:

• Completely fabricated documents that do not originate from any real institution.
• Altered genuine documents where amounts, names or dates have been changed.
• Reused documents from other individuals, edited to match a different identity.
• Misleading but technically genuine documents, such as short snapshots that hide important history.

Training materials may include simplified examples of each category so staff can see how different risks present in practice without exposing real customer information.

Technical Checks Used to Spot Fake Documents

Many organisations now use automated tools to assist human reviewers in spotting forged or tampered files. Although each product is different, technical checks may include:

• File metadata analysis – reviewing PDF properties, creation tools, modification dates and embedded fonts for inconsistencies.
• Template comparison – comparing layout, logos, fonts and alignment against a library of known genuine templates.
• Optical character recognition (OCR) – converting images to text to run consistency checks on balances, dates and reference numbers.
• Resolution and compression checks – examining whether certain parts of a document appear at different resolutions, suggesting local edits.
• Digital signature and security settings – checking for expected cryptographic signatures on documents from certain institutions.

These tools do not replace human judgment, but they help flag files that deserve a closer look.

Non-Technical Red Flags That Trigger Deeper Review

Alongside technical analysis, reviewers look at the content and context of the document. Examples of non-technical red flags include:

• Inconsistent balances where transactions do not reconcile with the running total.
• Unusual transaction behaviour, such as large unexplained cash deposits or rapid movement between accounts.
• Contradictions between the document and information given elsewhere in the application.
• Documents that do not match the customer’s story about employment, residence or wealth.
• Low-quality scans or obviously cropped screenshots of mobile apps where key details are missing.

Effective AML training uses role-play and case studies to show how these issues appear in real files, and how to escalate concerns appropriately.

Combining Manual Review with Automated Screening

Modern AML programmes use a combination of technology and experienced reviewers. A typical workflow might include:

• Automatic screening of new uploads for basic template and metadata anomalies.
• Routing high-risk or complex cases to experienced analysts.
• Documenting review steps in an audit trail, including reasons for accepting or rejecting a document.
• Escalating serious concerns to specialist financial crime teams.
• Filing suspicious activity reports (SARs) where required by law.

Training materials, including novelty-style bank statements and mock utility bills, may be used to simulate this workflow without involving real customer data.

Using Simulated Documents Ethically in AML Training

For firms that use simulated or novelty documents in training:

• The materials should be clearly labelled as training aids, not genuine evidence.
• No trainee should be encouraged to use such documents in real-world applications.
• Content should be designed by or reviewed with the firm’s compliance or legal teams.
• Scenarios should reflect realistic risks but keep all personally identifiable information fictional.

The goal is awareness and skill-building, not emulating wrongdoing. A clear separation between training scenarios and actual customer files is essential.