The Forged Bank Statement Problem

“Every KYC file is a stack of claims wearing the costume of proof.” At least that is what some compliance officer once told me.

Forging documents used to take skill, equipment and nerve, so the average file could be trusted because the average fraudster couldn't be bothered.

That equilibrium is gone. Generative AI produces bank statements with correct fonts, plausible transaction histories and clean formatting in seconds. Template sites sell editable utility bills for the price of lunch. The craft barrier that made document fraud rare has been demolished, and the volume is following: identity and document fraud attempts have climbed steeply year over year, and gen-AI-driven fraud losses in the US alone are projected by Deloitte to reach $40 billion by 2027.

Meanwhile, most compliance processes still "verify" documents the same way: an analyst looks at the PDF, decides it looks right, and files it.

An analyst cannot eyeball this problem away

Let's be fair to the analyst. They were never really inspecting documents forensically. They were pattern-matching against experience - “does this look like the HSBC statements I've seen before?” That worked when forgeries were bad. Modern fakes are generated from the same templates the real documents use. There is nothing for the eye to catch.

Worse, the volume math never worked. An analyst with thirty files to clear this week spends perhaps two minutes per document. Even a trained forensic examiner needs longer than that, and your analysts are not trained forensic examiners. So document review in most firms is, functionally, a ceremony. Everyone performs verification - nobody performs it.

The industry's dirty secret is that a competent fake has always sailed through. AI just means there are now a lot more competent fakes.

Where the fakes show up in the investment world

This is not a retail-only problem, and the investment-world variants are the expensive ones.

Source of funds and source of wealth evidence - bank statements, brokerage statements, sale agreements - is the most forged category, because it's the one that launders the money's story. Proof of address documents are trivially faked and rarely checked against anything. Corporate documents are the sleeper risk: a fabricated certificate of incumbency or doctored register extract can insert a fake director or hide a real owner inside an otherwise genuine structure. And increasingly, entire supporting casts are synthetic - a fake statement from a fake private bank, complete with a cloned website if anyone bothers to check.

What actually catches modern fakes

The good news: the same technology that industrialised forgery industrialises detection. But you have to look in the right places, and the right places are mostly not the pixels.

Internal consistency: 

• Do the transactions actually sum to the balances? 

• Do interest calculations make sense? 

• Do statement periods align with dates elsewhere in the file? 

Cross-document consistency: 

• Does the address on the utility bill match the one on the account statement, the registry filing, the subscription agreement? 

• Does the salary on the payslip support the claimed wealth trajectory? 

External corroboration: 

• Does the bank branch exist? 

• Does the sort code match the institution? 

• Does the company number resolve in the registry, with the same directors? 

Digital forensics: 

• Metadata, fonts, layer analysis, compression artifacts 

The practical playbook

1. Retire the eyeball as a control

If your procedure says an analyst "reviews the document for authenticity," rewrite it. Name the specific checks, or admit the step is decorative.

2. Verify claims

Reframe the goal when reviewing document: the document is evidence for a claim, and the claim is what needs verifying. "Statement received" is filing. "Balance consistent with three independent sources" is verification.

3. Check every file

Risk-based sampling assumes you can smell risk. The whole point of modern fakes is that you can't. Forensic-grade checking on every document is only unrealistic if humans do it - which is the strongest argument for not having humans do it.

4. Track the fraud rate you find

Firms that implement real document checking are routinely startled by what was already in their book. The fakes you've caught is a meaningless metric if you weren't looking; start measuring once you genuinely are.

How can Steward help?

This is core to how Steward works: our AI reads every document in every file - statements, bills, registry extracts, trust deeds - extracts every claim, and checks them against each other and against external sources. The arithmetic gets done, the addresses get compared, the registries get queried. On every file, every time, at a cost that makes universal checking economically boring.

Final Thoughts

Generative AI ended the era when document fraud was rare enough to ignore and visible enough to catch by eye. Don’t just squint harder at PDFs - verify every claim against everything else you know, at machine scale.

Ready to move beyond manual document verification? Book a demo with Steward to see how our AI-native platform automatically verifies claims against external sources, ensuring you catch the fakes that traditional methods miss.