The diploma looked official. The employer even contacted the verification service, and the qualification checked out. Small problem: the diploma mill ran the verification service too. The FTC has warned employers about exactly this trick.[ref]
People have forged papers for as long as there have been papers. These days it is simply cheaper, quicker and far more convincing. With editing software, ready-made templates, stolen originals, and generative AI, a criminal can produce in minutes what once took a skilled forger days.
Entrust's Onfido service saw digital forgeries make up 57% of detected document fraud in its 2024 reporting period, 244% more than the year before.[ref] That is one vendor's network rather than the whole world, but the trend is hard to miss.
Where fake documents do their damage:
💰 Loans and credit - False payslips, tax forms, and bank statements make an applicant's income and job look better than they really are. In one U.S. case, fake bank and earnings statements backed more than $140,000 in loan applications.[ref]
🏠 Renting a home - Doctored pay records and statements help applicants pass affordability checks. Snappt found fraudulent material in 6.4% of rental applications in its 2024 analysis of almost five million documents, including over 80,000 manipulated files.[ref]
🧾 Receipts and claims - A made-up receipt props up a false expense, refund, warranty, or insurance claim. Give an invented purchase a tidy layout, and it suddenly looks like proof.
📑 Invoices and suppliers - Forged invoices redirect payments or bill for things nobody bought. Fake registration, insurance, and tax papers create ghost vendors or impersonate real ones.
🪪 Whole identity packages - Counterfeit ID, altered proof of address, an employment letter, and matching bank statements. Each document vouches for the others, even when the person behind them does not exist.
🎓 Degrees with a backstory - Diploma mills sell the degree, the transcript, an invented accreditation body, and a verification line that confirms it all. Forging the paper was not enough, so they built the school as well.[ref]
Looking carefully at a document still matters. It just never proves the document is real. The logo, stamp, signature, QR code, phone number, and verification link are all part of the same claim until you verify them elsewhere.
What to do:
For organizations:
- Check the facts with whoever issued the document, or with an approved independent data source. Find their contact details yourself instead of using the ones printed on the paper.
- Where lawful and proportionate, compare submitted documents directly with payroll, tax, bank, registry, licensing, or credential data.
- Treat document forensics as a risk signal: metadata, editing traces, fonts, compression, calculations that do not add up, reused templates, and links to known devices or accounts.
- Validate secure digital signatures and issuer records where available. A QR code printed on a page is decoration, not cryptography.
- Look at the whole application. A clean document does not cancel out odd identity, device, behavior, or transaction signals.
For individuals:
- Received an unexpected invoice, guarantee, or certificate? Confirm it with the organization that supposedly issued it.
- Look up their website or phone number yourself. Never let a document choose the channel meant to prove it is genuine.
- Share ID and financial documents only when you have to, and only through channels you trust. Even genuine copies end up as raw material for the next fraud.
This topic came from a reader's question after the Deepfakes post - thank you, and keep them coming!