# Detecting AI-Generated Fake Receipts: Beyond Pixel Analysis

> AI-generated fake receipts are on the rise. Learn how to detect them by analyzing PDF metadata, structural signals, and layout geometry, moving beyond traditional pixel-based methods.

Published: 2026-09-15

Canonical: https://sygnet.ai/blog/detecting-ai-generated-fake-receipts-beyond-pixel-analysis

---

## Key takeaways

- AI-generated fakes rose from 0% of flagged fraudulent receipts in March 2025 to 70.8% by mid-May 2026 on AppZen's platform, which means image-level artifact hunting no longer catches the majority of forgeries ([Accounting Today](https://www.accountingtoday.com/news/use-of-ai-receipts-in-expense-fraud-soars)).
- The strongest signals now live below the render: producer/creator pairs, XMP versus DocInfo disagreement, xref structure, object numbering and font embedding method.
- Any single signal is spoofable. The Producer field is plain text, so a fraudster who knows your detector can hardcode `Adobe PDF Library 15.0` and pass ([DEV](https://dev.to/iurii_rogulia/detect-ai-generated-pdfs-what-works-and-what-does-not-1efg)).
- Pixel-level synthetic-image detectors are useful but fragile: published accuracy drops sharply under blur, rescaling and screenshotting, so treat their score as a feature, not a verdict.

## Why doesn't OCR see anything wrong anymore?

Because there is nothing to see. OCR and classic tamper detectors were designed to catch *edits*: a digit painted over, a font substituted, a logo resampled at the wrong DPI. A fully generated document was never a real document, so it carries no edit history at the pixel level. As PYMNTS put it, a forged receipt has artifacts (inconsistent fonts, mismatched logos, pixelation around edited figures) while an AI-generated receipt has none of those, because it was never a real document to begin with.

The volume shift is documented. AppZen counted 1,471 AI-generated fake receipts from 745 employees at 174 companies, claiming $148,143; just over a year earlier, template-based fakes accounted for 95% to 100% of the receipts caught by its fake-receipt rule. And the claim sizes are engineered for your controls: median claim value of $32, consistent with staying below auto-approval thresholds.

> If your only fraud check is whether the document looks right, you have already lost the arms race.

That is why detection moved from the rendered page to the file container, the geometry of the layout, and the transaction behind it.

## Which metadata signals actually matter in a PDF?

Start with pairs, not fields. Single fields are trivially editable; contradictions between two metadata systems are much harder to keep consistent. Modern PDFs carry two coexisting metadata systems: the DocInfo dictionary (PDF 1.0), holding CreationDate, ModDate, Creator and Producer as plain text key-value pairs in the trailer, and XMP (PDF 1.4), which is XML-based. Editing one and forgetting the other is the most common forger mistake.

The pairs worth scoring:

- **Creator vs Producer.** The creator is the authoring application, the producer is the library that wrote the bytes; on institutionally generated documents these tell a coherent story, and when a file has passed through an editor the producer often names that editor while the creator still claims something else.
- **CreationDate vs ModDate.** On a file generated in one shot these are effectively the same instant; divergence, or a ModDate earlier than CreationDate, means the file was touched after birth.
- **xmpMM:InstanceID.** Sophisticated actors align both metadata layers, but this UUID is regenerated on every save and its format can betray which software was used.

Practical baseline: `exiftool` in your ingestion pipeline. It reads /Info, XMP and EXIF simultaneously and flags cross-layer inconsistencies. Store the raw dump, not just the verdict, in your [audit trail](https://sygnet.ai/glossary/audit-trail); six months later you will want to re-score old files against a new rule.

## How do you build a producer fingerprint baseline per issuer?

By learning what each issuer's software actually emits, then alerting on improbable pairs. This is the approach described in granted patents on automated fraudulent document detection: a metadata-anomaly detector looks for low-probability metadata pairs, so when a document class whose legitimate source always emits a specific producer string shows a different producer, the detector raises a high anomaly score indicating outside software.

Two calibration details matter in production. First, benign false positives: print-to-PDF from a browser produces producers such as Quartz or Skia (Safari) and PDFium (Chrome), and these should score lower than an unexplained third-party producer. Second, weighting. The same patent family notes that content-based detectors, which scan for artifacts of tampering, generally carry more weight than metadata alerts in the overall anomaly score. Metadata is cheap, high-recall, low-precision. Treat it as a router into review, not a rejection rule. If you already run issuer-specific [template-based extraction](https://sygnet.ai/glossary/template-based-extraction), you likely have the per-issuer corpus needed to build these baselines for free.

## What structural and layout signals survive metadata scrubbing?

The cross-reference table and object graph, because they are byproducts of how the writer library works rather than declared strings. The xref table is the structural element that cannot simply be cleared, and these signals combine into an overall authenticity verdict. Structural forensics reframes the question: was this file generated by a real institutional system, or by a headless browser, a PDF library or a consumer tool, judged from producer metadata, xref patterns, font embedding and object numbering.

Layout geometry adds an orthogonal axis. An issuer's real template is deterministic: field bounding boxes land within a pixel or two across thousands of documents, column x-offsets repeat, the tax block sits in the same place. A regenerated look-alike usually reproduces the *appearance* of that template while missing its numerics. You can score this with the same [bounding box](https://sygnet.ai/glossary/bounding-box) coordinates your extractor already returns: per-issuer distributions of field positions, glyph baseline spacing, line-height quantization, and whether the text layer is real vector text or a single flattened raster.

Keep the distinction clean, though: a document can contain AI-written text and still come from a real corporate system, and it can contain entirely human-written text and still have been rendered by Puppeteer an hour ago.

## Signal comparison: cost, evasion resistance, what it proves

| Signal | Cost to compute | Evasion resistance | What it actually proves |
|---|---|---|---|
| DocInfo Producer/Creator | Milliseconds | Low (plain text string) | Which library claimed authorship |
| XMP vs DocInfo consistency | Milliseconds | Medium | Whether metadata was edited by hand |
| CreationDate/ModDate delta | Milliseconds | Low-medium | Post-generation modification |
| xref pattern, object numbering, font embedding | Tens of ms | High | Generator family, regardless of strings |
| Layout geometry vs issuer baseline | Needs per-issuer corpus | High | Document does not match issuer template |
| Pixel/frequency synthetic detectors | GPU inference | Medium, degrades with post-processing | Image is likely diffusion-generated |
| C2PA signed manifest | Verification only | Very high when present | Signed provenance chain |
| Transaction cross-check | Integration work | Very high | Whether the purchase happened |

## Do pixel-level AI-image detectors work on scanned documents?

They work, with real caveats, and only on the raster path. Detectors exploit statistics generative models do not optimize: noise residuals, pixel-wise fluctuations decoupled from the base signal, are often overlooked during optimization of generative models and leave detectable artifacts, and SRM-based residual work shows real images keep fairly consistent noise amplitude across regions while generated images tend to correlate noise strength with texture complexity.

Robustness is the weak point. One reconstruction-based method reports 83–87% AUROC under JPEG/WebP compression, falling to 70–77% under blur, geometric distortion or screenshotting, and a published benchmark table shows leading detectors on GenImage in the 70–85% accuracy band once JPEG quality drops to 70 ([Kang et al.](https://arxiv.org/pdf/2508.09487)). A document photographed with a phone, rescaled, then re-encoded by your intake pipeline sits squarely in the degraded regime. Consequence: never auto-reject on a pixel score. Feed it into a risk score alongside structural checks and route to [human-in-the-loop](https://sygnet.ai/glossary/human-in-the-loop) review above threshold.

> Metadata gives you recall, structure gives you precision, and only the transaction gives you truth.

## What about C2PA and signed provenance?

C2PA solves the inverse problem: proving a document is genuine rather than proving it is fake. Content Credentials are cryptographically signed manifests providing a verifiable record of provenance and modification history, and the container list explicitly includes PDF alongside JPEG, PNG and MP4. Verification needs no network call to the signer because all required certificates travel inside the manifest, which matters wherever connectivity or the original platform is unavailable.

Two limits for anyone planning on it. First, coverage: platforms strip metadata, and while C2PA v2.2 (May 2025) achieved hardware adoption and government endorsement, social media platforms routinely strip metadata on upload. Second, semantics: a fabricated or misleading asset can carry a valid credential that confirms its origin while validating deceptive content as technically authentic. Regulation is pushing adoption anyway, since EU AI Act Article 50 and California SB 942 both require machine-readable disclosure of AI-generated content. Plan for a decade of mixed-provenance intake, not a clean cutover.

## Where should the final decision live?

On the transaction, not the document. Matching a submitted receipt against card transaction data, merchant category codes and payment timestamps confirms whether a purchase actually occurred, regardless of how realistic the receipt looks. Structural and metadata signals are your cheap first filter; [cross-document validation](https://sygnet.ai/glossary/cross-document-validation) against bank feeds, PO lines and vendor masters is what closes the case. Sygnet builds document extraction pipelines that expose these layout and provenance features alongside extracted fields, which is what makes the cross-check automatable.

One operational rule from the structural-forensics literature is worth adopting verbatim: an inconclusive structural verdict is itself the signal. Producer fingerprints and headless-browser traces matter, and an INCONCLUSIVE result is the fraud signal to act on. Route it, don't clear it.

## FAQ

### Can you detect an AI-generated PDF from metadata alone?

No, not reliably. The Producer field is a plain string and can be set to anything, so countering producer spoofing requires checking multiple structural signals together (object numbering patterns, font embedding methods, XMP metadata consistency) rather than the producer string alone. Metadata is best used as a high-recall triage layer that pushes suspicious files into deeper structural and transactional checks, with precision coming from per-issuer baselines rather than from any universal rule.

### What if the fraudster writes AI text into Word and exports to PDF?

Structural forensics will call it a consumer-origin document, which is weak evidence either way. A file authored in Word and exported to PDF looks like any Word export, so the origin reads as consumer, which is inconclusive but not alarming for documents you expect to come from Word. For document classes that should always come from an ERP or billing system, the same verdict is a strong anomaly. Context per document class drives the scoring.

### Does structured e-invoicing remove the problem?

It shrinks the attack surface without eliminating it. Structured formats like [Factur-X](https://sygnet.ai/glossary/factur-x) carry machine-readable XML whose fields can be validated against schema and tax rules instead of read off a picture, and platform-mediated exchange adds an authenticated sender. The remaining risk moves upstream: a fully fabricated but schema-valid invoice from a fake supplier. Identity checks and vendor-master validation, not pixel forensics, are the control that catches that.