Document Fraud Detection Software: A Guide for 2026

Key takeaways

• Document fraud in France is no longer a niche crime: the Observatoire Tessi estimates more than €65 billion in annual losses to the French economy, around 2.5% of GDP.
• The people submitting fakes usually get away with it: in a Finovox survey of 8,000 Europeans, 13% of French respondents said they had already falsified a document, 82% of them said it worked, and 65% would do it again.
• Manual review is not a control. iProov's detection study put human accuracy at 0.1% for modern deepfakes, and formatting tells on AI-generated bank statements have largely disappeared.
• Buy on evidence, not on marketing: ask for false-positive rates on your own files, an explainable flag reason, and written answers on where documents are stored.

What does document fraud detection software actually do?

It inspects a submitted file (a payslip, bank statement, invoice, ID, Kbis extract, tax notice) and returns a risk score plus the reasons behind it, before a human approves a loan, a lease, a claim or a payment. Good tools combine four or five independent signals rather than one magic detector.

Typical layers: reading the content (names, dates, employers, balances, totals), checking internal arithmetic (net versus gross pay, year-to-date totals, invoice VAT math), inspecting the PDF structure (fonts, layers, objects, signs of reconstruction), reading metadata (authoring application, timestamps, edit traces) and visual forensics (spacing, alignment, font swaps, image artefacts). One vendor describes metadata explicitly as "one signal, not a verdict", which is the right posture: a PDF edited in LibreOffice is not proof of fraud.

The output matters as much as the detection. A score of 0.73 with no explanation is useless to a credit analyst who has to justify a refusal. Insist on a readable reason per flag.

Why has this become urgent in 2026?

Because producing a convincing fake went from a craft skill to a prompt. Image generation and assisted retouching tools now produce high-quality fake payslips, proofs of address, bank statements and ID documents without any graphic design skill, in minutes and at near-zero cost. Of French respondents who had falsified a document, 34% used image editing software, 32% used a generative AI tool and 30% used a specialised website.

The sector data confirms it. Entrust's 2026 Identity Fraud Report, built on more than a billion identity verifications across 195 countries, found digital forgeries made up 35% of document fraud in 2025, up from a 29% average over 2022 to 2024. In insurance, ALFA detected €903 million of fraud in 2024, up 30% year on year, against an estimated real cost of €2.5 billion. The Assurance Maladie blocked a record €723 million in 2025.

The cost of a credible forgery collapsed from a forger's fee to a few cents of compute, and control systems calibrated for clumsy fakes have not caught up.

Is this about deepfakes or about ordinary edited PDFs?

Mostly ordinary edited PDFs, still. Inscribe's network data found that 1 in 5 flagged documents showed signs of template-based manipulation in 2025, up from 1 in 14 in 2024, and through the first half of 2026 template-based fraud ran 2 to 3 times higher than AI-generated fraud by volume. Templates are cheap: pre-made editable files sold online for as little as $10, letting anyone produce fake bank statements, pay stubs and utility bills with no technical skill.

AI-generated documents are the faster-growing tail. Shufti's Identity Fraud Index projects a 495% surge in deepfake-powered identity fraud in 2026, with document deepfakes the fastest-growing type at nearly +3,900% year on year (an annualised projection from January-May data, so read it as velocity, not a settled total).

Practical consequence for a buyer: do not pay a premium for a deepfake-only detector. You need the boring checks (metadata, structure, arithmetic, cross-document consistency) plus a generative-artefact layer. One without the other leaves a hole. For a sense of how the underlying document-reading technology differs, OCR versus vision models is a useful primer.

Which documents and which teams are most exposed?

The documents most often faked are exactly the ones your processes demand: income statements, payslips, bank statements, ID cards and proofs of address. Those sit at the core of credit decisions, account opening, HR onboarding, KYC (Know Your Customer, the identity checks regulated firms must run) and regulatory compliance.

A worked example. A property manager in Île-de-France processes 60 rental applications a month, each with a payslip, a tax notice and an ID. Industry data suggests around 1 in 5 rental files submitted in Île-de-France contains at least one manipulated document. That is roughly 12 problem files a month. A letting agent cannot spot a regenerated payslip where the net-to-gross ratio has been recalculated correctly; software checking the arithmetic against URSSAF contribution bands can.

Second example: a 40-person accounting firm receiving 300 supplier invoices a month for its clients. The risk is not a fabricated supplier, it is a real invoice with an altered IBAN. French data puts RIB manipulation at 8% of cases but the highest loss per incident, around €47,000 on average. Teams handling that volume should read the accounting firm workflow guide and the AI-generated fake invoice guide.

How should you compare vendors?

Score them on five axes, and make them prove each one on your own documents during a trial, not on their demo set.

Two numbers to keep in mind while reading vendor claims. First, lab accuracy and production accuracy diverge sharply: published figures suggest detection tools claiming up to 96% in lab conditions can lose a large share of that in real-world use. Second, Gartner's own assessment is that detection alone is insufficient because scores are probabilistic, vendor benchmarks are not standardised, and adversaries iterate quickly.

Run the comparison with a structured scorecard: the IDP vendor evaluation checklist and the extraction accuracy checklist cover the test protocol.

What does it cost, and when does it pay for itself?

Pricing in this market is usually per document or per verification, in tiered volume bands, with a platform fee for enterprise deployments. Build the business case on avoided losses plus review time, not on licence cost alone.

Do the arithmetic for a mid-sized French company. Average cost per incident is around €15,800 for an SME, against €156,000 for a large group. If you process 2,000 income files a year and catch three additional fakes, that is roughly €47,000 avoided, which covers most per-document pricing at that volume several times over. Add the time saved: a reviewer who spends four minutes verifying each file and now spends four minutes only on the 6% that get flagged.

Regulators add a second line to the case. The ACPR sanctioned 12 institutions in 2025 for failures in their document controls, for a cumulative €18.4 million in fines. Model your own numbers with the ROI calculator before you talk to any vendor. Sygnet publishes its pricing and its security and GDPR posture openly; ask any shortlisted vendor for the same two pages in writing.

What should you fix before buying anything?

Process, first. The Observatoire Tessi's second report makes the point bluntly: organisations are no longer facing isolated fake documents but complete files mixing genuine pieces, misleading declarations and real or stolen identities, with fraud shifting from the document to the process itself. A tool that scores one PDF at a time will not catch a coherent file built from five authentic documents belonging to someone else.

Three concrete steps that cost nothing. One: add second-channel verification to every IBAN or bank-detail change, by phone to a number you already hold, never a number on the invoice. Two: cross-check documents against each other (does the employer on the payslip match the salary credits on the statement, does the address match the tax notice). Three: verify at source where you can, via open banking for income, or the official registry for a Kbis extract.

Then layer the software on top. As the Tessi experts put it, technology detects and humans decide: keep a trained reviewer in the loop for anything above your loss threshold.

FAQ

Can software reliably tell if a document was generated by AI?

Not with certainty, and anyone promising certainty is overselling. Detectors return a probability based on generation artefacts, metadata and structural signals, and quality is improving fast on the fraud side: Inscribe's analysts report that identifying an AI-generated statement now takes a seasoned fraud investigator and a tool. Treat the score as a trigger for human review on high-value decisions, not as a verdict.

Is document fraud detection compatible with GDPR?

Yes, with conditions. You need a lawful basis (usually legitimate interest for fraud prevention, sometimes a legal obligation for KYC under anti-money-laundering rules), a defined retention period, a sub-processor list, and documentation that no fully automated decision has legal effect without human review under Article 22. Ask vendors where files are stored and for how long. The GDPR checklist for document AI projects sets out the questions.

How many false positives should we expect?

Benchmark it rather than accept a vendor figure. Run 500 known-genuine documents of your own type through a trial and count the flags. Anything above a few percent will swamp a small review team; anything near zero usually means thresholds are set so loose that real fakes slip through. Tune the threshold to the loss you are protecting against: tighter for a €200,000 credit file, looser for a €40 expense receipt.