Document forgery is creating or altering identity documents, paystubs, bank statements, or other records so they pass verification or qualify someone for a product. It is the counterfeit layer under a lot of fraud, because almost every onboarding and lending flow still trusts a document as proof of who or what a person is.
What is document forgery?
Document forgery is the making or doctoring of documents to deceive a verification check. It covers two broad cases: counterfeit documents built from scratch to look like a real ID or statement, and altered documents, where a genuine record is edited to change a name, a number, an address, a balance, or an income figure. Either way, the goal is a document that survives the review it is submitted to.
The targets are whatever a process asks for as proof. Government IDs and passports establish identity. Paystubs, tax forms, and bank statements prove income or funds. Utility bills and letters prove address. Business documents prove that a company is real and eligible. When any of these is forged, the check that relies on it is validating a fiction.
In fraud and AML terms, forgery is an enabling tool rather than a fraud type on its own. It powers identity fraud, synthetic identities, application and loan fraud, account takeover recovery, and mule onboarding. Modern forgery increasingly overlaps with document deepfakes, where images are generated or manipulated by software rather than by hand.
How a forged document gets used
From creation to payoff, a forged document usually moves through these stages:
SourceGet a template The fraudster starts from a stolen real document, a leaked template, or a generator that mimics a genuine layout.
EditChange the key fields Names, numbers, photos, balances, or income are altered, and security features are faked or copied over.
SubmitFeed it to verification The document is uploaded or shown to onboarding, lending, or recovery flows as proof of identity, income, or address.
Cash inUnlock the product If it passes, the account opens, the loan funds, or the takeover completes, and the forged file has done its job.
What it looks like in practice
An applicant uploads a driver's license and two recent paystubs to open an account and request a credit line. The license image looks clean at a glance, but the font on the date of birth is slightly off, the machine-readable zone at the bottom does not match the printed details, and the photo has the flat, over-smooth look of an edited layer.
The paystubs list an employer that cannot be verified, round-number pay to the cent, and a template identical to ones seen on other recent applications. Individually each item might slip through; together the mismatched security features and the reused template mark the whole submission as forged, and the account is held before the line is drawn.
Why it is dangerous for operators
Document forgery attacks the foundation of trust in an onboarding or lending flow. If the document is accepted, everything built on top of it inherits the lie: the identity is wrong, the income is invented, the business is fake. A single convincing forgery can open an account, unlock a loan, or complete an account takeover, and it often seeds the synthetic and mule identities that go on to cause much larger losses.
The threat is also getting cheaper and faster. Editing tools and generative software let one actor produce many high-quality forgeries at scale, tuned to beat known checks. That is why leading teams do not rely on a human glance or a single test, but layer document authentication, data cross-checks, and forgery detection so that the mismatches a forger cannot fix everywhere at once still surface.
What to watch in the data
Security feature mismatches. Fonts, spacing, holograms, and the machine-readable zone that do not match the printed data or the issuing standard are prime forgery tells.
Layer and metadata artifacts. Signs of editing software, cloned pixels, inconsistent compression, or stripped metadata suggest a manipulated image.
Reused templates. The same paystub, bank statement, or ID layout appearing across many applicants points to an organized forgery kit.
Data that does not cross-check. Document details that fail to match bureau, issuer, or bank records, even when the image looks clean, expose an alteration.
Too-perfect figures. Round-number income, balances to the cent, or unverifiable employers on income documents are common on fabricated proof.
Quick questions
What is the difference between a counterfeit and an altered document?
A counterfeit is built from scratch to imitate a genuine document, while an altered document starts as a real record that is edited to change key fields. Both are forgery; altered documents can be harder to catch because the base material is authentic.
How is document forgery different from a document deepfake?
Forgery is the broad category of faking or editing documents by any means. A document deepfake is a specific modern form where generative or AI tools produce or manipulate the image. Deepfakes are a fast-growing subset of forgery, not a separate problem.
Can automated checks reliably catch forgeries?
They catch a lot, especially with document authentication, optical character recognition, and machine-readable zone validation. But sophisticated forgeries defeat single tests, so the strongest approach layers image forensics with data cross-checks against issuer and bureau records.
Why check the machine-readable zone?
The machine-readable zone encodes the document's key data in a standardized, checksum-protected format. Forgers often edit the printed side but forget to match the zone, so a mismatch between the two is a strong and hard-to-fake signal.
What kinds of documents get forged most?
Government IDs and passports for identity, paystubs and bank statements for income and funds, and utility bills for address. In business onboarding, incorporation and ownership documents are common targets.
What should a team do when it detects a forgery?
Hold the application, preserve the document and its metadata, and link it to any reused templates or related accounts. A confirmed forgery usually justifies declining and, depending on context, filing a suspicious activity report and feeding the pattern back into detection.
---
title: ¿Qué es Document forgery?
source_page: https://www.sardine.ai/es/learn/document-forgery
canonical: https://www.sardine.ai/es/learn/document-forgery
format: text/markdown
description: Document forgery is creating or altering identity and financial documents, such as IDs, passports, paystubs, or bank statements, to pass verification or qualify for a product. It ranges from crude edits to high-quality fakes and, increasingly, AI-generated documents.
---
**Quick links:** [Human page](https://www.sardine.ai/es/learn/document-forgery) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/es/customers) · [Blog](https://www.sardine.ai/es/blog) · [Demo](https://www.sardine.ai/es/demo)
---
# ¿Qué es Document forgery?
**Read time:** 4
Document forgery is creating or altering identity and financial documents, such as IDs, passports, paystubs, or bank statements, to pass verification or qualify for a product. It ranges from crude edits to high-quality fakes and, increasingly, AI-generated documents.
Document forgery is creating or altering identity documents, paystubs, bank statements, or other records so they pass verification or qualify someone for a product. It is the counterfeit layer under a lot of fraud, because almost every onboarding and lending flow still trusts a document as proof of who or what a person is.
What is document forgery?
Document forgery is the making or doctoring of documents to deceive a verification check. It covers two broad cases: counterfeit documents built from scratch to look like a real ID or statement, and altered documents, where a genuine record is edited to change a name, a number, an address, a balance, or an income figure. Either way, the goal is a document that survives the review it is submitted to.
The targets are whatever a process asks for as proof. Government IDs and passports establish identity. Paystubs, tax forms, and bank statements prove income or funds. Utility bills and letters prove address. Business documents prove that a company is real and eligible. When any of these is forged, the check that relies on it is validating a fiction.
In fraud and AML terms, forgery is an enabling tool rather than a fraud type on its own. It powers identity fraud, synthetic identities, application and loan fraud, account takeover recovery, and mule onboarding. Modern forgery increasingly overlaps with document deepfakes, where images are generated or manipulated by software rather than by hand.
How a forged document gets used
From creation to payoff, a forged document usually moves through these stages:
Source — Get a template. The fraudster starts from a stolen real document, a leaked template, or a generator that mimics a genuine layout.
Edit — Change the key fields. Names, numbers, photos, balances, or income are altered, and security features are faked or copied over.
Submit — Feed it to verification. The document is uploaded or shown to onboarding, lending, or recovery flows as proof of identity, income, or address.
Cash in — Unlock the product. If it passes, the account opens, the loan funds, or the takeover completes, and the forged file has done its job.
What it looks like in practice
An applicant uploads a driver's license and two recent paystubs to open an account and request a credit line. The license image looks clean at a glance, but the font on the date of birth is slightly off, the machine-readable zone at the bottom does not match the printed details, and the photo has the flat, over-smooth look of an edited layer.
The paystubs list an employer that cannot be verified, round-number pay to the cent, and a template identical to ones seen on other recent applications. Individually each item might slip through; together the mismatched security features and the reused template mark the whole submission as forged, and the account is held before the line is drawn.
Why it is dangerous for operators
Document forgery attacks the foundation of trust in an onboarding or lending flow. If the document is accepted, everything built on top of it inherits the lie: the identity is wrong, the income is invented, the business is fake. A single convincing forgery can open an account, unlock a loan, or complete an account takeover, and it often seeds the synthetic and mule identities that go on to cause much larger losses.
The threat is also getting cheaper and faster. Editing tools and generative software let one actor produce many high-quality forgeries at scale, tuned to beat known checks. That is why leading teams do not rely on a human glance or a single test, but layer document authentication, data cross-checks, and forgery detection so that the mismatches a forger cannot fix everywhere at once still surface.
What to watch in the data
Security feature mismatches. Fonts, spacing, holograms, and the machine-readable zone that do not match the printed data or the issuing standard are prime forgery tells.
Layer and metadata artifacts. Signs of editing software, cloned pixels, inconsistent compression, or stripped metadata suggest a manipulated image.
Reused templates. The same paystub, bank statement, or ID layout appearing across many applicants points to an organized forgery kit.
Data that does not cross-check. Document details that fail to match bureau, issuer, or bank records, even when the image looks clean, expose an alteration.
Too-perfect figures. Round-number income, balances to the cent, or unverifiable employers on income documents are common on fabricated proof.
Quick questions
### What is the difference between a counterfeit and an altered document?
A counterfeit is built from scratch to imitate a genuine document, while an altered document starts as a real record that is edited to change key fields. Both are forgery; altered documents can be harder to catch because the base material is authentic.
### How is document forgery different from a document deepfake?
Forgery is the broad category of faking or editing documents by any means. A document deepfake is a specific modern form where generative or AI tools produce or manipulate the image. Deepfakes are a fast-growing subset of forgery, not a separate problem.
### Can automated checks reliably catch forgeries?
They catch a lot, especially with document authentication, optical character recognition, and machine-readable zone validation. But sophisticated forgeries defeat single tests, so the strongest approach layers image forensics with data cross-checks against issuer and bureau records.
### Why check the machine-readable zone?
The machine-readable zone encodes the document's key data in a standardized, checksum-protected format. Forgers often edit the printed side but forget to match the zone, so a mismatch between the two is a strong and hard-to-fake signal.
### What kinds of documents get forged most?
Government IDs and passports for identity, paystubs and bank statements for income and funds, and utility bills for address. In business onboarding, incorporation and ownership documents are common targets.
### What should a team do when it detects a forgery?
Hold the application, preserve the document and its metadata, and link it to any reused templates or related accounts. A confirmed forgery usually justifies declining and, depending on context, filing a suspicious activity report and feeding the pattern back into detection.
