A fake invoice no longer needs a forger. A chat tool writes a convincing supplier letter in seconds, an image model produces a receipt photo, and a PDF editor changes one bank account number without touching anything else. Accounts payable, claims and onboarding teams are the targets. Here is how to catch it.
Start with the process, not the pixels
Most invoice fraud is caught by a phone call, not software. Any change of bank details should be confirmed on a number you already hold for the supplier — never one printed on the document in front of you. Forensics is the second line: it tells you which documents deserve that call.
Six signs a document was edited or generated
1. Metadata that tells a different story
A PDF records the software that produced it and when. An invoice from an accounting system that was last saved by a consumer PDF editor, or created minutes before it was emailed for a job done months ago, needs a closer look.
2. Fonts and spacing that shift on one line
Edited fields often use a slightly different font weight, kerning or baseline. Zoom to 400% on the amount, date and bank details — the three fields fraudsters change.
3. Compression that doesn't match
On scanned or photographed documents, a pasted-in number compresses differently from the paper around it. An error level analysis heatmap makes that visible as a bright box over the altered area.
4. Receipts that are too clean
AI-generated receipt photos tend to have perfect lighting, even creases and totals that don't add up. Check the arithmetic and the tax rate — generators are bad at both.
5. Generic, over-polished wording
Letters and statements written by chat tools use the same hedged, even-rhythm phrasing. Our AI text detector highlights those sentences.
6. Details you can check elsewhere
Company numbers, VAT IDs and addresses can be looked up in public registers. A real supplier's invoice matches them; a generated one often gets one detail slightly wrong.
Keep the evidence
If a document turns out to be fake, you'll need to show what you received and when. A VerifyAI workspace fingerprints every file on arrival and keeps an append-only history, and each result exports as a certificate with a QR code anyone can check. See also how Content Credentials work.