Drop a document, tell it what the document is supposed to be, and it runs a set of deterministic forensic checks (not an AI guess) and hands back a ranked list of risk indicators with the evidence behind each one. Everything happens on your device; the file is never uploaded anywhere.
The score is a plain weighted sum, not a learned model. Every constant below is the exact one the tool uses, and every finding shows its exact point contribution. We publish it because a screening tool that shows its work is one you can actually trust.
Category caps exist so a handful of weak signals in one area can never add up to look like strong evidence.
A low score does not authenticate a document. A document made from scratch with a paystub-generator site can be structurally clean and still not be genuine.
A high score is not proof of fraud. Always verify with the document's issuer before acting on it.
Many edited PDFs still carry their own earlier versions inside the file. When one is found, it's rebuilt and compared side by side with the current version, so you see exactly what changed, not just that something did.
Every PDF names the software that produced it. That name is checked against known payroll/statement systems, ordinary photo and PDF editors, and known paystub-generator services, and the edit history is checked for editing software appearing after the document was supposedly finalized.
Numbers set in a font that appears nowhere else on the page, text pasted onto a scanned image, and text hidden underneath a covering box are all detected, and any hidden text is recovered and shown to you.
Gross minus deductions should equal net, to the cent. Tax withholding should sit in an expected range. Year-to-date totals should track the pay period. Routing numbers, IBANs, and card numbers are checked against their own official checksums, not just their shape.
Creation and last-modified dates are compared to each other and to the dates the document itself claims, and to transaction dates inside the content, so an out-of-order or impossible date doesn't slip through.
Photos are checked for editing-software fingerprints and re-compression signs. Images also get checked for a signed "Made with AI" label (Content Credentials) and for generation details some AI tools leave behind, sometimes including the exact prompt used to create the image.
A PDF and a photo of the same document don't hand this tool the same amount to work with, and the scoring is built to be honest about that instead of pretending otherwise. A PDF can carry its own edit history inside the file. The earlier-version recovery described above only exists because PDFs are built that way. A photo has none of it. All a photo offers is EXIF fields, JPEG re-compression traces, and, occasionally, a signed AI-generation disclosure if the tool that made it left one behind. Those are real signals, but photos are also trivial to strip metadata from or re-save through a messaging app, so the caps in the table above aren't arbitrary: image signals top out at 25 points against a document-structure cap of 70, and no matter how many image findings turn up, they can't push the risk band past Elevated by themselves. If someone hands you a photo of a printout instead of the original PDF, read a clean result as "there wasn't much here to check," not "this passed."
A PDF or a JPG/PNG/WebP photo of a pay stub, bank statement, invoice, receipt, or utility bill, up to 150MB, though anything over 50MB will take longer to check.
Pay stub, bank statement, invoice, or other: this picks the right math checks and sets expectations for who should have produced it.
Structure, software fingerprints, fonts, hidden text, math, dates, and image signals are checked. Cheap checks like metadata and checksums usually show up within about a second; a page-by-page comparison renders a little after that, once you open that finding.
A risk score and band, every finding explained in plain language with the checks that passed too, and a printable report.