11 detection methods powered by AI forensics, math validation, and deep document analysis. From PDF tampering to AI-generated fakes — nothing gets past DocEnsure.
DocEnsure analyzes the internal structure of every PDF to detect post-creation modifications. We inspect content streams, cross-reference tables, incremental saves, and object modifications to find evidence of tampering that's invisible to the naked eye.
{
"check": "pdf_tampering",
"status": "FLAGGED",
"eof_count": 3,
"editor_detected": "iTextSharp 5.5.13",
"white_rectangles": 2,
"incremental_saves": true,
"modified_objects": ["salary_amount", "net_pay"],
"risk_score": 0.92,
"details": "Document was created by SAP HR, then modified using iTextSharp. Two white rectangles detected overlaying original amount fields."
}
Fraudsters edit salary amounts but forget to fix the math. DocEnsure extracts every number from the salary slip using OCR and validates all arithmetic relationships. If Basic + HRA + DA does not equal Gross, or Gross minus Deductions does not equal Net Pay, we flag it instantly.
{
"check": "salary_math",
"status": "FLAGGED",
"extracted": {
"basic": 45000,
"hra": 18000,
"da": 4500,
"gross": 85000,
"pf": 5400,
"net": 79600
},
"errors": [
"Gross mismatch: 45000+18000+4500 = 67500, not 85000",
"PF 5400 is 12% of 45000 = 5400 (OK)",
"Net mismatch: 85000-5400 = 79600 (matches inflated gross)"
],
"risk_score": 0.95,
"verdict": "Gross salary inflated by 17500"
}
With ChatGPT, Midjourney, and DALL-E, anyone can create realistic-looking documents from scratch. DocEnsure's 6-signal neural forensic engine analyzes image properties that AI generators cannot perfectly replicate, catching synthetic documents that fool the human eye.
{
"check": "ai_generated",
"status": "FLAGGED",
"ai_probability": 0.94,
"signals": {
"frequency_spectrum": 0.91,
"noise_residual": 0.88,
"color_correlation": 0.96,
"texture_lbp": 0.93,
"jpeg_artifacts": 0.87,
"metadata_check": "FAIL"
},
"suspected_tool": "Midjourney v5",
"details": "Image exhibits uniform noise distribution and lacks natural sensor patterns. Frequency analysis confirms synthetic origin."
}
When someone edits a PDF, the replacement text almost never uses the exact same font as the original. DocEnsure extracts and analyzes every font used in the document, comparing font families, weights, sizes, and rendering characteristics to detect inconsistencies that reveal editing.
| Signal | Threshold | Action |
|---|---|---|
| Font count | > 4 fonts | Flag for review |
| Font mismatch | Different family on amounts | High risk |
| Size variance | > 0.5pt difference | Flag for review |
| Editor font detected | Helvetica/Times in non-standard position | Suspicious |
{
"check": "font_forensics",
"status": "FLAGGED",
"fonts_found": [
{ "name": "Calibri", "usage": "body text", "count": 847 },
{ "name": "Calibri-Bold", "usage": "headers", "count": 23 },
{ "name": "Helvetica", "usage": "salary_amount, net_pay", "count": 4 }
],
"anomaly": "Helvetica used only on 2 amount fields — rest of document uses Calibri",
"risk_score": 0.88,
"verdict": "Font substitution detected on financial fields"
}
For scanned documents and image-based PDFs, DocEnsure performs pixel-level forensic analysis to detect image manipulation. Our engine uses four complementary techniques that together catch even sophisticated Photoshop edits.
{
"check": "image_forensics",
"status": "FLAGGED",
"techniques": {
"ela": {
"score": 0.87,
"regions_flagged": 2,
"details": "High error levels around salary amount region"
},
"copy_move": {
"score": 0.12,
"duplicates_found": 0
},
"noise_analysis": {
"score": 0.79,
"inconsistent_regions": 1,
"details": "Noise pattern differs in bottom-right quadrant"
},
"splicing": {
"score": 0.34,
"boundaries_found": 0
}
},
"composite_score": 0.82,
"verdict": "Image manipulation detected via ELA and noise analysis"
}
When multiple documents are uploaded for the same candidate, DocEnsure automatically extracts identity fields and links them across documents. If the Aadhaar says "Rahul Sharma" but the salary slip says "Rahul S", our fuzzy matching engine catches it and flags the discrepancy.
{
"check": "identity_linking",
"status": "LINKED",
"candidate": "Rahul Sharma",
"documents_linked": 4,
"matches": [
{ "doc": "aadhaar.pdf", "name": "Rahul Sharma", "match": "exact" },
{ "doc": "pan_card.pdf", "name": "Rahul Sharma", "pan": "ABCPS1234R", "match": "exact" },
{ "doc": "salary_slip.pdf", "name": "Rahul S", "match": "fuzzy (87%)" },
{ "doc": "offer_letter.pdf", "name": "R Sharma", "emp_id": "EMP-4521", "match": "fuzzy (79%)" }
],
"discrepancies": [
"Name variation: 'Rahul S' vs 'Rahul Sharma' on salary slip",
"Father name missing on salary slip (present on Aadhaar)"
],
"confidence": 0.91
}
Every document receives a composite risk score from 0 to 1 based on all checks performed. The score maps to one of four actionable verdict levels, each with specific recommended actions for your team.
Document is authentic. No tampering indicators found across all checks. Safe to accept with no further action required.
Minor concerns detected — slight font variations, low-confidence metadata flags, or minor math rounding differences. Manual review advised before accepting.
Significant tampering indicators found. Multiple checks flagged issues including editor signatures, math mismatches, or image anomalies. Do not accept without thorough investigation.
Strong evidence of forgery. Multiple critical checks failed — confirmed PDF editing, math fraud, AI generation, or identity mismatches. Reject immediately and escalate.
DocEnsure performs 18 visual and layout checks on every document, analyzing alignment, spacing, color consistency, and structural integrity. These checks catch visual anomalies that indicate physical or digital manipulation.
{
"check": "visual_layout",
"total_checks": 18,
"passed": 15,
"flagged": 3,
"flags": [
{
"check": "background_uniformity",
"region": "salary_amount_field",
"issue": "White rectangle overlay detected (255,255,255)"
},
{
"check": "color_consistency",
"issue": "Text color #000000 vs #1a1a1a in amount field"
},
{
"check": "dpi_consistency",
"issue": "Amount region at 150 DPI vs document body at 300 DPI"
}
],
"risk_score": 0.67
}
Every PDF carries hidden metadata that reveals its creation history. DocEnsure extracts and analyzes 18 metadata properties to detect documents that have been modified, recreated, or generated using unexpected tools.
{
"check": "metadata_forensics",
"total_checks": 18,
"passed": 14,
"flagged": 4,
"metadata": {
"creator": "Adobe Acrobat Pro DC 2023",
"producer": "Adobe PDF Library 15.0",
"created": "2024-01-15T10:30:00+05:30",
"modified": "2024-03-22T23:45:00+05:30"
},
"flags": [
"Creator is Adobe Acrobat (expected: SAP/HR payroll system)",
"Modified 2 months after creation date",
"Modification at 23:45 IST (unusual business hours)",
"PDF version upgraded from 1.4 to 1.7 (indicates re-save)"
],
"risk_score": 0.74
}
Government-issued and official documents contain security features like QR codes, watermarks, holograms, and official stamps. DocEnsure validates these security elements across 14 specialized checks to confirm document authenticity.
{
"check": "security_features",
"total_checks": 14,
"passed": 11,
"flagged": 3,
"results": {
"qr_code": {
"present": true,
"valid_signature": true,
"data_matches_document": false,
"issue": "QR name 'Rahul Kumar' differs from printed 'Rahul Sharma'"
},
"watermark": {
"present": true,
"integrity": "intact"
},
"stamp": {
"present": true,
"positioning": "anomalous",
"issue": "Company stamp overlaps signature boundary (likely pasted)"
},
"hologram": {
"expected": true,
"detected": false,
"issue": "Hologram region not found on Aadhaar card"
}
},
"risk_score": 0.61
}
DocEnsure generates a complete, tamper-proof audit trail for every document verified. From SHA-256 hashing to chain of custody tracking, our compliance module ensures your verification process meets regulatory requirements.
{
"check": "audit_compliance",
"total_checks": 10,
"passed": 10,
"document_hash": "sha256:a7f3b2c...e9d1f4",
"integrity": "VERIFIED",
"chain_of_custody": [
{
"action": "uploaded",
"by": "hr@company.com",
"at": "2024-03-15T10:30:00Z",
"ip": "203.0.113.42"
},
{
"action": "verified",
"checks_run": 142,
"verdict": "SUSPICIOUS",
"at": "2024-03-15T10:31:47Z"
},
{
"action": "escalated",
"by": "hr@company.com",
"to": "compliance@company.com",
"at": "2024-03-15T10:45:00Z"
}
],
"report_id": "RPT-2024-03-15-0042",
"retention_expires": "2027-03-15T00:00:00Z"
}
Get in touch to see how DocEnsure's 11 detection methods can protect your organization from forged, edited, and AI-generated documents.
Get in Touch