# How to Detect Fake Bank Statements Before You Rely on Them

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-16
- Category: Fraud and forensic review
- Canonical: https://precisebankflow.com/blog/how-to-detect-fake-bank-statements

> How to detect fake bank statements: arithmetic and running-balance tests, PDF edits and fonts, real-world consistency checks, and verifying with the bank.
To detect fake bank statements, run three kinds of test: arithmetic tests on the balances, file tests on the PDF itself, and content tests against facts you can check elsewhere. Then confirm anything that matters with the bank directly. No single test proves a statement genuine, but a fake rarely survives all of them.

## Arithmetic tests that expose fake bank statements

Arithmetic tests check whether the numbers on a statement agree with each other. A forger who changes one amount by hand usually forgets that the same figure feeds a running balance, a subtotal and a closing balance. Each of those is a place where the edit fails to add up.

Start with footing, which means adding the statement yourself. Opening balance, plus every credit, minus every debit, must equal the printed closing balance. The full method is in [footing each bank statement from opening to closing balance](/blog/bank-statement-audit-footing-continuity#footing-each-bank-statement-opening-plus-activity-equals-closing), so this post only covers what the result means for fraud.

### Running balances line by line

Many statements print a balance after every line. Recompute each one. A forger who inflates a deposit or deletes a withdrawal has to rewrite every balance below it, and a careless edit leaves a single line where the printed balance does not follow from the one above.

Here is an example of an edit caught this way. The figures are made up.

| Line | Amount | Printed balance | Recomputed balance |
| --- | --- | --- | --- |
| Opening | | 14,200.00 | 14,200.00 |
| Deposit, customer payment | +6,500.00 | 20,700.00 | 20,700.00 |
| Rent | -2,400.00 | 18,300.00 | 18,300.00 |
| Deposit, wire in | +25,000.00 | 43,300.00 | 43,300.00 |
| Payroll | -7,850.00 | 35,450.00 | 35,450.00 |
| Closing | | 36,450.00 | 35,450.00 |

Every running balance agrees except the last, which is 1,000.00 higher than the lines support. Someone changed the closing figure, or changed a line above and fixed the balances but not the total. Either way the statement fails.

### Summary boxes and page totals

Most statements print a summary box on page one: total deposits, total withdrawals, number of items. Add up the detail lines and compare each total with the box. Forgers who edit the detail often leave the box alone, because it sits on a different page and nobody checks it.

Count the items too. A box that says 41 withdrawals above 39 withdrawal lines means two lines were removed.

### Rounding and digit patterns

Genuine statements carry odd cents. Fake ones built by hand tend to carry round figures, because the forger invents the amounts. A page of deposits that all end in .00 is a prompt to ask questions, though some businesses do bill in round sums. The same applies to a balance that never moves by more than a few hundred dollars while the account supposedly handles large payments.

## PDF metadata, fonts and edits in altered bank statements

The PDF file records how it was made. Altered bank statements often show the edit in that record, even when the page looks perfect on screen. These tests need only a PDF viewer, and they work best on the file the person gave you, not on a printout or a screenshot.

### Metadata: producer, dates and edit history

Open the document properties in your PDF viewer. Look at the creator or producer field, the creation date and the modification date. Banks generate statements with their own systems, so the producer is usually a server-side library, not a consumer editor. A producer field that names an image editor, a word processor or an online PDF editor is a warning sign.

Compare the dates. A statement for a period ending March 31 cannot have been created on March 12. A modification date hours or days after the creation date shows the file was saved again after it was first made, which is worth asking about.

Metadata can be wiped or forged, so a clean record proves little. A suspicious record, though, is useful evidence. Keep a copy of the file exactly as received before you open it in anything that might resave it.

### Fonts and text rendering

A bank prints every number on a statement in one or two fonts, in a consistent size. Edited numbers often come from a different font, or the same font at a slightly different weight, spacing or baseline. Zoom to 300 percent and compare the edited-looking digits with the same digits elsewhere on the page. Check that a 1, a 7 and a 4 look the same each time they appear.

Two further checks help:

- Select the text with your cursor. On many genuine statements, a line of text selects as one run. On an edited one, an amount may select separately from the line around it, because it was pasted in as its own object.
- Search the PDF for a number you have seen on screen. If the visible text does not come up in search, the page may be an image, which hides edits and is a reason to ask for the bank's original download.

### Layers, alignment and compression

Digits that sit a pixel or two off the column, or a white patch around an amount that does not match the paper texture of a scan, point to overlay editing. Amounts that are right-aligned on every line except one are a classic tell. On scanned statements, look for a difference in sharpness: a pasted number is often cleaner or blurrier than the text around it.

## Do the fake statement's transactions match the real world?

Content tests ask whether the transactions make sense against facts outside the document. A forger can copy a bank's layout, but inventing a year of plausible activity is hard, because real accounts leave traces in other records that the forger cannot see.

### Payroll, fees and recurring items

Check dates that follow a calendar. Payroll should land on the same schedule each period, and if it lands on a Saturday or a bank holiday, ask why, because most banks post on business days only. A monthly service fee should appear every month at the same amount and the same point in the cycle. Loan payments, rent and subscriptions should recur at stable amounts. A statement where none of these repeat is either an unusual account or an invented one.

### Check sequences and reference numbers

A business writes checks from numbered stock, so the numbers on its statements sit in a narrow, rising range. Check numbers that repeat, or that fall far outside the range the business is using, deserve a look. Compare the sequence with the check register or the cancelled check images if you have them. Gaps are normal, because uncleared checks sit outstanding. Invented numbers that land in the wrong range are not.

### Cross-checks against records you already hold

The strongest content test is a comparison with another source. Match deposits to invoices, receipts and the sales ledger. Match withdrawals to the bills the business says it paid. Ask whether the counterparties on the statement exist and whether their amounts match what they would have invoiced. When you hold the ledger or the client's accounting file, reconciling it to the statement lines turns this from a feeling into a count of unmatched items.

PreciseBankFlow reads each statement line, runs the footing and duplicate checks and gives each field a confidence score, which narrows the job to the lines worth your attention. It does not judge whether a document is forged, so the file tests above remain your own work.

## How do you verify a bank statement with the bank directly?

Verifying with the bank means getting the numbers from the bank itself, not from the person who gave you the statement. It is the only test a forger cannot pass, because it bypasses the document entirely. Use it whenever a statement drives a decision, such as a loan, an audit conclusion or a settlement.

### Routes, from best to weakest

1. **Online access at the bank.** Have the account holder sign in while you watch, or log in with their consent, and download the statement yourself. This gets you the original file.
2. **A direct request to the bank.** With the account holder's written consent, ask the bank for a copy or for a confirmation of balances. Use the contact details you find independently, never the phone number or email printed on the statement you are testing.
3. **A third-party verification service.** Some services retrieve data from the bank with the holder's consent. Check how the service connects and what it can show you before you rely on it.
4. **A bank letter.** Weakest, since the letter itself can be forged, so call the issuing branch on a number you looked up.

### What to confirm

You rarely need to verify the whole statement. Confirm the opening balance, the closing balance and any large or unusual deposit that carries the story. If those match the bank's records, an edit elsewhere on the page changes little. If they do not, you have your answer.

### Keep the chain of custody

Record who obtained each file, when, and how. A statement you downloaded yourself on a stated date is better evidence than one emailed to you. If the matter could become a dispute, a note of how each document reached you makes the later work easier, and the analysis described in [how forensic accountants analyze bank statements to trace funds](/blog/bank-statement-analysis-forensic-accountants-run) starts from exactly this record.

## Fake bank statement checks that give false comfort

Some checks feel rigorous and prove nothing, because forgers already pass them. Knowing which tests are weak keeps you from stopping early. Treat each of the following as a reason to carry on, not a reason to relax.

- **The statement looks professional.** Layouts and logos are easy to copy. Appearance tells you nothing about the numbers.
- **The totals add up.** A forger who edits carefully rewrites every balance. Footing catches careless edits, not careful ones. Passing means the statement is internally consistent, not that it is real.
- **The account number and bank name are correct.** Anyone can copy those from a genuine statement or a voided check.
- **The PDF opens without warnings.** Edited files open fine.
- **A clean metadata record.** Metadata is easy to strip, so a clean record is neutral, not reassuring.
- **A scan or photo.** Images hide edit traces. A scan is a reason to ask for the original file, not a reason to accept it.
- **The person is trustworthy.** Trust in the person is not evidence about the document. Verify the document, not the reputation.

### Genuine statements that look wrong

The reverse mistake matters too. Real statements contain oddities: a bank may reissue a statement with a different producer field, a scan may be rotated, a payroll may post on a Saturday because the provider and the bank use different cutoffs. One oddity is a question, and several together are a pattern. Do not call a statement fake on one test.

### A 12-point checklist for spotting an altered statement

Use this checklist when a statement matters and you cannot yet confirm it with the bank. Score each item pass, fail or unable to test. One failed item justifies a direct check with the bank. Two or more justify stopping work until you have the original.

#### Arithmetic tests

1. Opening balance plus credits minus debits equals the printed closing balance.
2. Every running balance follows from the one above it.
3. The summary box totals and item counts match the detail lines.
4. Opening balance equals the prior statement's closing balance.

#### File tests

5. The producer and creator fields name a bank system, not an editor.
6. Creation and modification dates fit the statement period and each other.
7. Fonts, sizes and spacing are uniform across all amounts.
8. Text selects and searches as whole lines, not as pasted fragments.

#### Content tests

9. Payroll, fees and recurring items arrive on schedule.
10. Check numbers run in plausible order and match the register.
11. Deposits match invoices or the sales ledger, and the counterparties exist.
12. Opening balance, closing balance and the key deposits agree with the bank's own records.

Items 1 to 4 work on any statement, including a scan. Items 5 to 8 need the original PDF. Items 9 to 12 need records outside the statement, and item 12 is the only one that can show a statement is genuine. When a statement fails and the account behind it is real, the next question is what the genuine activity shows, which [eight fraud red flags in genuine statements](/blog/fraud-detection-bank-statements-red-flags) covers.

If you want the footing and duplicate checks run across a stack of statements before you start the file and content tests, you can [request a spot in the early group](/get-started).