Guide · underwriting

Bank statement fraud detection: how to tell an altered statement from a real one

You are the last person between a PDF and someone else's money, and the borrower chose the PDF. This is the review an underwriter or ISO runs before a file goes to a funder: what arithmetic can prove, what only the layout can show, and what neither can settle without the bank.

Updated October 2026 · 8 min read

A borrower sends a PDF of their bank statement. Every number in it may be exactly as the bank printed it, or one deposit may have been typed over, or the whole page may never have come from a bank. The file looks the same in all three cases. What separates them is arithmetic, layout and a second source — in that order, because the first two are free and the third takes a phone call.

This is written for the person who has to sign off on the file: a broker or ISO preparing a submission, an underwriter at a funder, or a bookkeeper rebuilding a client's books from statements the client supplied. The test is simple. If the file is challenged six months later, can you say which number you checked, against what, and where it came from?

Three different problems people call fraud

An altered document. A real statement with a figure changed — a deposit raised, a negative day removed, a chargeback deleted. The paper exists; the file does not match it.

A fabricated document. A statement that no bank ever issued, built from a template or generated. Correct arithmetic is easy to produce when you make the whole page yourself.

A genuine statement read optimistically. Nothing is forged, but transfers between the owner's accounts are counted as revenue, a one-time loan advance is treated as sales, and a deposit that leaves again within days is treated as income. This is the most common of the three and the least discussed, because no one has to lie to produce it.

The first two are document questions. The third is a classification question. A review that only looks for forgery will miss the third, which is where most of the money actually goes.

The balance chain is the cheapest test you have

Every transaction line carries a running balance, and that balance is the bank's own arithmetic. Recompute it row by row: previous balance, plus credits, minus debits, equals the balance printed on the same line. On a clean statement all of them hold to the cent. On an edited one, a single row fails while the rows above and below it stay correct, because whoever changed the amount did not go back and rebuild the column underneath.

The size of the failure is a clue. If one row breaks by 3,000.00 and the deposit on that row was raised by 3,000.00, the arithmetic has found the edit for you. It has not told you which of the two figures is wrong — that is the next question, and it needs the bank.

A worked example

Here is one month, laid out the way a statement prints it. The Balance row and the Amount column disagree on 22 July, and nowhere else:

Date    Description                     Amount      Balance
07/01   Beginning balance                            12,400.00
07/03   ACH DEPOSIT NORTHSIDE LLC       6,150.00     18,550.00
07/08   POS PURCHASE SUPPLIES          -1,240.00     17,310.00
07/12   ACH DEPOSIT NORTHSIDE LLC       5,980.00     23,290.00
07/19   POS PURCHASE FUEL                -312.55     22,977.45
07/22   ACH DEPOSIT NORTHSIDE LLC      12,400.00     32,377.45   <-- breaks here
07/26   POS PURCHASE FUEL                -198.20     32,179.25
07/31   Ending balance                               32,179.25

On 22 July, 22,977.45 + 12,400.00 is 35,377.45, not 32,377.45. Every other row holds. Now try the other direction: if the deposit really were 9,400.00, that row would balance, and the whole statement would close correctly from 12,400.00 to 32,179.25. So either the deposit is overstated by 3,000.00, or the opening balance and every downstream row are understated by 3,000.00. Both are possible, and no amount of re-reading the page will separate them. What you have is a defensible question for the borrower and a reason to ask the bank.

This is also why a summary page is not evidence. A statement can show a total deposits figure that was edited without touching the detail lines, or a detail line that was edited without touching the totals. Sum the detail yourself and compare: the two must agree.

What the layout can show that the arithmetic cannot

A consistent forgery defeats the balance chain by construction. What it usually cannot hide is how the page was assembled. Text pasted into a PDF carries the font it was typed in, the baseline it was placed on, and the file metadata of the program that saved it.

Document-level signals, what they suggest, and how to confirm each one
What you seeWhat it suggestsHow to confirm
One row's digits sit a pixel off the baseline, or the spacing inside a number is unevenA pasted lineZoom to 300% on that row and compare letter spacing with the row above
The digits in a column are not the same font, weight or widthAn inserted figure set in a substitute fontSelect text over the row and watch whether the font changes
Text can be selected over a figure that looks scannedAn image under a live text layer, or the reverseSelect across the row; if only part of the line is selectable, it was assembled
File created by an editor, or a modification date after the statement periodThe file was saved from a tool, not downloaded from the bankOpen the document properties and read producer, creation and modification dates
Footer says page 3 of 6 and the file has five pagesA page removed, often a negative monthCount pages and check the numbering on each
Account number, statement period or address differs between pagesPages from different statements or accountsCompare the header on every page, not just the first
A statement period that starts before the previous one endedA statement reissued or a period rewrittenAsk for the bank's copy of both months
A scanned page with no bank logo, or a logo that is a different resolution from the restA rebuilt pageCompare against a statement from the same bank the borrower sent earlier

None of these is proof. A bank genuinely reissues statements, some banks produce ugly PDFs, and a phone screenshot of a portal page looks nothing like a printed statement. Treat each signal as a reason to ask, not a reason to decline.

Copyable review checklist

Paste this into a spreadsheet as tab-separated columns and fill in the last one. One row per file, and the file is not reviewed until every row is answered — including the rows you answer with "not run".

Check	Pass condition	Result
1  Statement period and account number	Same on every page
2  Page count	Footer count equals pages in file
3  Running balance, per row	Prev + credit - debit = printed balance, all rows
4  Opening + credits - debits = closing	Matches to the cent
5  Sum of detail equals printed totals	Deposits and withdrawals both
6  Month to month link	Closing N equals opening N+1, same account
7  Date sequence	No gaps, no overlapping days
8  Font consistency in amount column	One font, one weight, even spacing
9  Balance column alignment	Decimal points line up on every row
10 File metadata	Producer, creation and modification dates consistent with the period
11 Duplicate transactions	No line appears twice
12 Deposits from one payer	Named, traceable, consistent with the business
13 Deposits leaving within 48 hours	Explained, or excluded from revenue
14 Transfers between own accounts	Identified and excluded from revenue
15 Round-number deposits	Explained by a real counterparty
16 Existing advance debits	Identified, counted, priced
17 Bank-sourced copy requested	Yes, not a forwarded file
18 Reviewer, date, source	Named; second source recorded

Questions that only a person can answer

The arithmetic gives you a list of exceptions. What it does not give you is a decision. When a row does not balance, write down the exact question — "the 22 July deposit would need to be 9,400.00 for this page to close; can you send the bank's copy of July?" — and keep it neutral. Most legitimate explanations are mundane: the wrong month was scanned, the bank restated a balance, a transaction reversed the next day, or two accounts have similar numbers.

Then get one document the applicant does not control. A bank letter confirming average balance, a direct verification through the borrower's bank, or statements obtained through a verification channel. Everything else in the file is the applicant talking about themselves.

When not to use us

Be clear about the boundary, because it is the difference between a careful review and a false sense of safety.

  • You need a forensic opinion. If the file may end up in litigation or a criminal referral, you need a qualified examiner who can testify to method and custody. A conversion tool is not that, and its output should not be described as one.
  • The forgery is physical. If a printed statement was altered on paper and then photographed, the page that reaches you is an image of a fake. There is no text layer to compare and no metadata to read; the only route is the bank.
  • You need an authenticity verdict. We show signals and exceptions. We do not tell you a statement is genuine, and no tool honestly can from the file alone.
  • You need a few numbers, once. For two balances and a total, read the page. A conversion is for a file you will actually work through.
  • The file is a photo of a screen, or a portal screenshot. Layout checks and metadata checks both have nothing to work with.
  • You want the decision made for you. Whether an unexplained deposit is disqualifying is a credit judgement about a business you know and we do not.

Where SheetParser fits

Upload the statements and the review is done on the extracted rows rather than on your reading of the page. The running balance is recomputed line by line and every row that does not close is flagged with the amount it is out by; the month-to-month link is checked across the batch, so a missing statement shows as a gap rather than as a mistake; and the file's own metadata is read and reported alongside the figures. Every flagged cell sits next to the page and line it came from, so when a funder asks where a number came from you open the file and point at it.

Two limits worth stating plainly. A metadata check that could not run is reported as not run, not as a clean result — a blank is not a pass. And none of this certifies a statement; it produces the exception list you take to the bank, which is the part that actually settles the question. For the revenue side of the same review, see the MCA statement analysis workflow and the continuity check.

Common questions

How can I tell if a bank statement has been altered?+

Start with arithmetic. Recompute every running balance: previous balance plus credits minus debits must equal the printed balance on each row. An edited amount that was not carried through the rest of the column leaves one row that breaks while its neighbours hold, and the size of the break usually equals the edit. Then compare the layout: fonts within a column, balance alignment, page numbering and the account number on each page.

Does a statement that ties out prove it is authentic?+

No. A careful forgery can be internally consistent, and a real statement can fail a check because a digit was misread. Arithmetic proves consistency, not origin. Only a source the applicant does not control — a bank letter, a direct bank verification, or statements ordered through a verification service — settles authenticity.

What is the difference between a fake statement and an overstated one?+

A fake or altered statement is a document that was not issued that way. An overstated one is genuine but read optimistically: transfers between the owner's own accounts counted as revenue, one-off loan proceeds treated as sales, or deposits that leave again the next week. The second is far more common and is caught by classification, not by forensics.

Can software detect a forged PDF?+

It can surface signals: a file created or modified by a PDF editor, creation dates that do not match the statement period, inconsistent fonts, a broken balance chain, or a page count that does not match the footer. Those are leads, not verdicts. No extraction tool should tell you a statement is authentic; it should show you what it found and let you and the bank decide.

What should I ask the borrower when a statement looks wrong?+

Ask for the statement directly from the bank rather than a forwarded copy, and for the account to be verified through a channel they do not control. Keep the question neutral: state which row does not recompute and which figure would make it tie. Most legitimate errors are a scan of the wrong page, a reissued statement, or a transaction the bank later reversed.

How many months should be checked?+

Enough consecutive months to see a full cycle, usually three to six for a merchant cash advance and six to twelve for a term loan. Consecutive matters more than numerous: twelve months with two gaps is weaker evidence than six months that chain link by link.

Sources

Check it on your own document

A free account converts 100 pages in all, across up to 5 files. You get the same extraction, the same flags and the same exports as a paid plan — not a preview.

Files shredded after conversion · never used for training

Keep reading