A perfect forgery
extracts perfectly.
A retouched document looks fine and reads fine. Holofin checks what the eye can't: the issuer's signature, the totals redone from scratch, and whether the documents in a case agree.
One weak signal decides nothing. Three converging on one document, while the rest checks out, is worth a look.
The problem
"Fake document"
means five different things.
Each is caught a different way. A reviewer's eye catches one or two; the rest leave nothing to see on the page.
Fabricated
Made from scratch, often by an online generator. Its IBAN or VAT number does not compute.
Caught by recomputed identifiers
Retouched
A genuine document with one value changed, like a balance going from 1,485.51 to 11,485.51.
Caught by seal, totals, file
Someone else's
Genuine and untouched, but it belongs to a sibling or a parent. Only the person is wrong.
Caught by cross-document check
Expired or superseded
True on the day it was issued, not today: last year's extract, a reissued certificate.
Caught by dates and freshness
Fake or inactive issuer
A well-formed payslip from an employer that stopped trading eighteen months ago.
Caught by official registries
Only one of the five leaves a trace in the file.
That is why file forensics alone is never enough.
See the five checksHow it works
From a pile of documents
to signals you can check.
- 01
Intake
API, portal, SFTP or email. Bundles are split and each document is classified.
bank_statement - 02
Extraction
Every field, with the spot on the page it came from.
closing_balance · p.1 - 03
Controls
Five independent checks on each document and on the whole case.
5 levels run - 04
Signals
Each failure explained: both values, the page, and how strong it is.
1 document at risk - 05
Your decision
You set what passes, what goes to review and what stops.
Send to review
Why five
No single check
catches everything.
So we run five.
Each one is blind to what the others see. A clean file can carry a forged seal; a genuine, untouched document can belong to someone else. Stacked together, very little gets through.
Controls
Five checks.
Strongest proof first.
We never blend them into one score, so every alert tells you which check fired: an invalid signature, or a harmless re-export.
Verification at the source
Where the issuer sealed the document, we verify the seal, then check that the printed values still match it.
Official registries
Does the company exist, is it still trading, and are the signatories its officers? In France we check Origami, our own registry; elsewhere, the official register through our partners.
Recomputed totals
Change one figure and everything that follows from it must change too. We redo the maths.
Across the case
The only check that catches a genuine document belonging to someone else. Names, employers and addresses must agree.
The file itself
Reads how the file was built, not what it says. Runs on every document, and points where to look: it never refuses a case on its own.
Documents
Each document
carries its own proof.
| Document | What we check | What gives a fake away |
|---|---|---|
| Bank statement → | Opening + credits − debits = closing, line by line | A closing balance its own lines don't add up to |
| Payslip | Gross − deductions = net; employer matches the case | A net that doesn't follow from the gross |
| Tax assessment | Issuer seal verified, sealed values vs printed values | A printed amount the seal doesn't vouch for |
| Identity document | MRZ check digits vs the names, dates and number above | A machine-readable zone that disagrees with the page |
| Company extract | Registration check digits, identifiers, age of the extract | A generated number that fails its check digit |
| Invoice | VAT arithmetic, IBAN mod-97, issuer in the registry | An IBAN that fails mod-97, a supplier that closed |
Worked example
A lending case
where one figure moved.
Four documents, one retouched: a "1" added in front of the March closing balance. The page looks flawless.
The document vs its own figures
The gap is exactly 10,000.00: the signature of an inserted digit.
The signals, graded
The accounting equation does not hold
The running balance is broken
Different font subset on the balance line
PDF producer: consumer editor
Means nothing alone: honest people re-export statements too.
The other three documents check out
Seal valid, MRZ consistent, payslips recompute. The suspect document stands alone.
Your reviewer gets a named document, a sum to check and a page to open. Not a score to interpret.
Decision
Holofin reports and explains.
The decision stays with your teams.
A signal is not an accusation. You set the thresholds: what passes, what goes to review, what stops.
Nothing is refused automatically
The verdict prepares the decision, it doesn't take it, as GDPR article 22 requires.
Evidence, not a verdict
A failed sum, a broken signature, two values that disagree. Calling it a forgery is for a court.
Ambiguous cases go to review
A married name, a renamed company, a re-export: escalated with the reason attached.
Every signal can be challenged
Because it is explicit. Never "the algorithm said so".
What is kept behind every signal
- Level that fired
- issuer, registry, internal consistency, case or file
- Values compared
- both of them, with the document and page of origin
- Seal verification result
- issuing certificate and signature validity
- Control engine version
- hololang 4.2
- Date the controls were frozen
- 2026-10-02
- Decisions and reclassifications
- kept append-only
A case challenged a year later is re-read with the controls that applied at the time.
Integration
The signal arrives
before the case moves on.
An alert is useless once the money is gone. The checks plug in where documents already arrive.
REST API
Post a document or a case, get fields and signals back.
Webhooks
Notified the moment a signal fires.
SFTP
Overnight batches, or re-check a back catalogue.
Document management
Documents filed back with their type and results.
Upload portal
Checked at upload, so a bad document is re-requested before the case opens.
Frequently asked
On document fraud detection
Run Holofin on your own cases
Send us real cases, including frauds you already caught. We return the signals document by document, and tell you what we missed.
