Kbis Fraud: Valid Yet Fraudulent Documents Explained

Key takeaways

• A Kbis extract can be 100% genuine and still built on a lie: French greffes issue real Kbis documents based on forged shareholder minutes or fake share transfers, so the registry itself gets corrupted before any KYB tool ever checks it.
• Infogreffe reported that Kbis-related fraud rose by more than 100% in 2024 compared to the two previous years combined, with over 30% of victim companies losing more than €10,000.
• The INPI's API only exposes a defined data set updated daily; it does not replicate every field shown to a human reader, which leaves structural blind spots for automated cross-checks.
• Generative AI has pushed fraud from crude copy-paste jobs to near-perfect forgeries, and INPI/Infogreffe are already adding a new EUID identifier to the Kbis specifically to reinforce authenticity checks.

What does an automated KYB tool actually check on a Kbis?

Most automated KYB tools verify three things on a Kbis: the document's visual/structural integrity, a signature or verification code, and a data match against a public registry. None of these three checks, taken alone or together, proves that the underlying corporate facts are true.

In practice, a tool will run OCR or a vision model over the PDF to extract the SIREN, company name, legal form, share capital and manager's name. It may then query the Infogreffe verification code, a 10-character alphanumeric string printed on every Kbis, or scan the accompanying QR code, which redirects to an Infogreffe page confirming the document's authenticity at the time of issuance. Better tools also call the INPI's RNE API to compare extracted fields against the live registry. This is a solid first filter against sloppy forgeries, PDFs with copy-pasted logos, wrong fonts, or mismatched SIREN numbers. It is far weaker against fraud that never touches the visual layer of the document at all.

Why can a Kbis be "valid" and still be fraudulent?

Because the fraud usually happens upstream, inside the registry itself, not on the PDF a KYB tool scans. Lawyers call this the "vrai faux Kbis" problem: a genuinely issued document built on falsified inputs.

As one French corporate lawyer puts it, this is not a fake document fabricated from scratch: it is a genuine Kbis, delivered by a court registry, based on a fake general meeting minutes or a fake transfer of shares. The SIRET number is exact, the financial statements are real, only the legal content is false. Fraudsters submit forged AGM minutes, fake share cessions, or amended bylaws to the greffe, which then legally updates the manager's name, the registered address, or the shareholding structure. Accounting firms describe the same mechanism: once the changes are registered, a "real fake" Kbis is delivered, with a correct SIRET number but falsified information. Because the registry has already been updated, any KYB tool that cross-checks the Kbis against live INPI or Infogreffe data will find a perfect match. The check passes precisely because the source of truth was poisoned first.

A Kbis can be genuinely issued by a French court registry and still be built entirely on a forged shareholder resolution.

This matters legally too: once a manager's appointment has been regularly published at the RCS, the company generally cannot invoke the irregularity of that appointment against third parties who relied on it. In other words, the registry match is often legally sufficient for the counterparty, even when it is factually wrong.

Does matching against live INPI/RNE data guarantee authenticity?

No. Matching against the registry only proves that a document is consistent with what the registry currently says, not that what the registry says is true, current for your purposes, or complete.

Since 1 January 2023, the INPI has operated the Registre National des Entreprises (RNE), the dematerialized registry created by the loi Pacte that merges the former RCS, the répertoire des métiers and the registre des actifs agricoles. The data is fed automatically by declarants through the guichet unique and made available for free on data.inpi.fr in JSON format, with registry data updated daily. That daily refresh sounds reassuring, but it creates its own gap: a Kbis downloaded this morning can already be stale by the time an onboarding workflow reviews it hours or days later, especially if a fraudulent modification was filed in between.

There is also a coverage gap. The official Annuaire des Entreprises itself warns that its API "does not give access to all the data displayed on the Annuaire des Entreprises," meaning automated systems relying purely on API responses may miss fields visible to a human reading the same company's page, particularly for entities under partial diffusion. A tool can therefore report a "clean" API match while silently skipping data points that would have raised a flag.

How is generative AI changing the threat model?

Generative AI has moved document fraud from clumsy forgery to industrial-grade replication, which breaks the assumption that a visually correct document is a genuine one. This is the single biggest reason visual and OCR-only checks are losing ground.

French fraud-prevention sites now describe scammers who exploit the fact that RNE data is public to generate ultra-personalized fake documents, with AI producing forgeries that are visually flawless. Some of these fake Kbis even carry a QR code, except it points to a payment page instead of Infogreffe. The scale of this shift is measurable outside France too: in the first quarter of 2025, synthetic identity document fraud surged by 311% in North America compared to the same period in 2024. Sumsub's own data shows the trend accelerating fast: fake documents created entirely by AI tools went from 0% in April 2025 to 2% by August 2025. A recent Forrester-Experian survey found that 69% of organizations considered their KYC infrastructure inadequate against AI-generated identity documents. The same logic applies one-to-one to KYB and business registration documents: modern generative models can produce forged incorporation papers, business licenses and tax forms with realistic seals, fonts and signatures that are virtually indistinguishable from genuine ones.

Verification methods compared: what each one actually catches

Each verification layer catches a different failure mode, and none of them, alone, covers the full attack surface described above.

The last row is where most KYB stacks are thin. Checking a Kbis in isolation, even against a perfect live API, cannot detect that the AGM minutes filed six weeks earlier were themselves forged.

What should a KYB workflow add on top of automated checks?

A resilient workflow layers document intelligence on top of registry checks: it cross-references the Kbis against other filed documents (bylaws, AGM minutes, beneficial-owner filings) instead of trusting the Kbis as a standalone source of truth.

Concretely, this means extracting structured data not just from the Kbis but from the full onboarding file, and flagging inconsistencies between documents rather than just inconsistencies with the registry. Regulators are moving the same direction: France is adding an EUID identifier to the Kbis specifically because, until now, authenticity was verified only through SIREN consistency, RCS registration confirmation, or the presence of mandatory legal notices, and the new identifier is meant to reinforce that control and simplify KYC procedures. Since 2024, beneficial ownership data (RBE) is also held by the INPI, adding another registry that should be cross-checked, not just the Kbis.

This is where the OCR-vs-vision-model distinction matters: teams comparing extraction approaches can review OCR vs VLM trade-offs, while broader Intelligent Document Processing pipelines are built to reconcile several document types at once rather than validating one PDF in isolation. Teams designing onboarding flows around this problem can look at dedicated KYC onboarding approaches that combine registry lookups with document-level consistency checks, and use document classification to route each supporting file to the right verification logic before it reaches a human reviewer.

FAQ

Can a fake Kbis pass an Infogreffe verification code check?

Not if the code is genuinely wrong or expired, but the more dangerous case is different: a real Kbis, with a valid code, issued by a real greffe on the basis of a forged shareholder resolution. The verification code confirms the document was issued as shown; it says nothing about whether the filing behind it was legitimate.

Does the INPI API give real-time data on every company?

It gives daily-updated data for companies registered in the RNE, but the API does not expose every field visible on the public Annuaire des Entreprises pages, so automated cross-checks can miss information a human reviewer would see.

How common is Kbis fraud in France right now?

Infogreffe recorded a more than 100% increase in Kbis-related fraud in 2024 versus the two prior years combined, with over 30% of affected companies suffering losses above €10,000 and 15% above €100,000.

What's the single best defense against "vrai faux" Kbis fraud?

Cross-checking the Kbis against other filed documents, AGM minutes, share transfer records, beneficial-owner filings, rather than trusting the Kbis in isolation, since the fraud typically originates in those upstream filings before the registry, and therefore the Kbis, ever reflects it.