AI-generated documents are changing visa and KYC fraud. Here is what actually catches them.
A convincing bank statement used to require a skilled forger, the right fonts and a steady hand with an image editor. Today a general-purpose AI model can produce one in the time it takes to describe it. Identity-verification providers report the shift directly: Entrust's 2026 Identity Fraud Report, covering September 2024 to September 2025, found that deepfakes now account for one in five biometric fraud attempts, and that injection attacks on identity checks rose 40% year over year (source).
For consular sections, visa centres, banks and insurers, the question is not whether AI-generated documents will reach their desks. It is which checks still work once they do.
Why "does this look edited?" is no longer enough
Classic document forensics looks for the traces that editing leaves behind:
- Compression inconsistencies. A number pasted into a JPEG has a different compression history from the page around it. Error-level analysis makes that visible.
- Font and layout mismatches. Retyped text rarely matches the issuer's font, kerning and baseline exactly.
- File structure. PDFs record the software that produced them, keep earlier revisions when edited incrementally, and often embed a second copy of a font when text is added in another tool.
These checks still catch a large share of everyday forgery, and you should run them. You can try four of them on your own files in our in-browser demo. But a document that was generated rather than edited has no seam to find. Every pixel was made in one pass. A cleanly regenerated passport page with a stamp removed carries no trace of the missing stamp.
What still works against generated documents
1. Ask the issuer, not the pixels
Many issuers now put verification into the document itself: QR codes that resolve to the issuer, reference numbers that can be checked, qualified electronic signatures on PDFs. A valid issuer signature beats any amount of image analysis. A good triage system checks these first and only falls back to forensics when there is nothing to verify.
2. Check the story, not just the page
Generated documents are internally plausible, but they rarely agree with each other. A payslip shows a net salary that never arrives on the bank statement. An employment contract starts after the visa appointment was booked. A hotel booking exists for dates that don't match the declared travel plan. Reading the documents in a file together catches what reading each one alone does not.
3. Look across cases, not just within one
The most damaging document fraud is organised. Networks sell complete application packs, so the same employer letter template, sponsor, phone number, IBAN, address or even the same generated face appears in dozens of unrelated applications. One officer looking at one file will never see that. A system that extracts these entities and fingerprints from every file and links cases that share them will.
4. Check provenance where it exists
Content Credentials (the C2PA standard) and the IPTC "trained algorithmic media" source type let cameras, editors and some AI generators record how an image was made. Most fraudsters strip metadata, so absence proves nothing. Presence, though, is valuable evidence, and it is cheap to check.
Keep people in charge
In the EU, AI that helps authorities examine visa, asylum and residence applications, including the assessment of the reliability of evidence, is classed as high-risk under the AI Act (Recital 60). That is the right instinct. The output of a fraud-detection system should be evidence and a next step, such as "check the original document" or "invite for interview", never an automatic refusal. It should log what it did, explain every flag, and be tested on confirmed cases before anyone relies on it.
A practical checklist
If you are evaluating document-fraud tooling, ask:
- Does it verify issuer codes and signatures before running pixel forensics?
- Does it compare documents within a file for consistency?
- Does it link cases across the whole caseload?
- Can it run inside your network, without sending applicant data to a third-party AI API?
- Does every flag show the region, the signal and the reason?
- Will the vendor test it on your confirmed fraud cases and report false alarms in writing?
ScopeFlow was built around those six questions. If you want to see the answers on your own documents, request a 30-day pilot.