Credit, onboarding and claims decisions can still be heavily dependent on documents, even with the increased adoption of Open Banking.
A payslip can support income verification, a bank statement can support a view of cash flow and commitments, a utility bill can support address validation, and an invoice or report can support an insurance claim. The assumption underneath each of those processes is that the document describes something that actually happened, yet that assumption is becoming harder to rely on.
Experian’s Fraud in the Age of AI: Identity, Risk and Consumer Behaviour research found that 59% of Australian and 58% of New Zealand fraud decision-makers said their existing Know Your Customer and identity verification checks are not equipped to detect GenAI-generated documents.
As convincing documents become easier to produce at scale, risk and fraud teams need to look beyond whether evidence appears credible and ask whether it can be trusted. Understanding how the threat is changing – and where existing controls leave gaps – is becoming an important consideration within decisioning while balancing the need to avoid unnecessary friction.
Document fraud accessibility and scalability
Producing a convincing fake document may now be possible through a simple prompt or template purchase, reducing the skill, software and time previously required. Resistant AI’s Global Document Fraud Report 2026, based on analysis of more than 170 million documents, reported a 90-fold increase in generative AI detections within the documents it analysed between 2025 and 2026.
Some widely used generative AI tools can produce documents with realistic-looking detail, as illustrated in this video.
Resistant AI’s report also describes document farms, generators and templates offered for sale, making fabrication more accessible without requiring someone to build a convincing document from scratch.
The risk comes not only from the quality of these documents, but from the scale at which they can be produced and reused. When apparently credible evidence can be produced quickly, the same fabricated document can appear across many applications with only small changes to a name, an employer or a figure. Resistant AI describes this repeated use of document fraud tactics across submissions as serial fraud, with patterns that may be missed when each application is assessed on its own.
Document fraud sits across first-party and third-party fraud
It is tempting to treat document fraud as an organised crime problem. In practice it spans the full spectrum of behaviour, which is part of what makes it difficult to control with a single treatment.
At one end is first-party behaviour: a genuine, verified applicant who edits their own payslip to improve an income figure, removes a transaction line from a statement to present cleaner conduct, or adjusts a date to meet an eligibility rule. At the other end are professional operations using custom templates, metadata stripping and deliberate evasion tactics across coordinated multi-document campaigns.
Among the documents analysed by Resistant AI, around one in three showed signs of tampering with structural integrity, while close to one in ten were assessed as high risk. These classifications indicate document risk rather than establishing fraudulent intent.
The distinction matters because routine actions such as re-saving, compressing or screenshotting a document can alter its structure without indicating fraud. Treating every anomaly as fraud creates work for teams and friction for genuine customers, so the useful capability is one that helps teams distinguish routine document changes from indicators that warrant further investigation.
Verifying the person does not verify the evidence
While identity verification helps assess whether someone is who they claim to be, document forensics assesses whether a file shows signs of manipulation or AI generation. The two controls address different risks and can complement each other, although document forensics does not, on its own, establish whether the underlying income, transaction or event is genuine.
A genuine, fully verified customer can submit a manipulated payslip. A stolen or synthetic identity can be supported by a fabricated proof of address that helps it pass onboarding. In each case the identity check and the document check are testing different things, and a clean identity result can create confidence that the supporting evidence has not earned.
Reviewing documents by eye can be unreliable when generative AI produces files that appear internally consistent, correctly formatted and visually plausible, particularly when assessors are working at volume and under time pressure. Indicators of manipulation may sit in the file’s structure, metadata or generation artefacts rather than in its visible content.
Fabricated evidence can compromise the decision itself
Document fraud is often discussed as an access problem – whether a bad actor gets through onboarding. The more significant consequence is that fabricated evidence corrupts the inputs to a decision that the organisation then stands behind.
An overstated income figure can affect serviceability and affordability assessments, while an edited bank statement can change the view of commitments and conduct. A fabricated invoice or report can similarly influence whether a claim appears genuine and what is paid, undermining the resulting decision even when the decisioning process is applied as intended.
Because the evidence behind approvals informs portfolio quality, pricing assumptions, provisioning and early-arrears performance, the consequences of fabricated documents can extend beyond an individual decision. Where decisions need to be explainable to regulators and auditors, the integrity of the supporting evidence also forms part of that account, making document fraud a credit risk and governance concern as well as a fraud issue.
Stronger protection should not mean more friction for every applicant
Asking every applicant for additional documents, certified copies, callbacks or manual verification can increase processing costs and create friction for genuine customers. Experian’s research found that 52% of consumers surveyed reported abandoning a sign-up when verification felt too intrusive, illustrating why additional scrutiny needs to be proportionate.
Applying additional scrutiny to every applicant also spreads effort evenly across a population where risk is not evenly distributed. The more useful approach is a proportionate one, where the level of intervention reflects what the evidence and the wider risk picture indicate.
Automated document forensics supports that approach because it can run in the background using documents already submitted, although flagged cases may require further verification. Assessing documents as they are submitted can help teams prioritise cases for manual review, in line with their policies and risk thresholds. Document risk indicators and supporting evidence can help teams decide what to do next and explain why.
Where document forensics fits alongside identity, credit and open data
Experian offers Resistant AI’s document forensics capability in Australia and New Zealand, enabling organisations to consider document risk alongside identity, credit, open data and other fraud signals. The capability is also available through the Ascend Platform.
Resistant AI Documents examines how PDFs, images and other document files are built for indicators of manipulation or AI generation, with supported document types, languages and cross-application analysis depending on the capability and deployment.
The value of a document verdict increases when it is considered alongside the other signals an organisation already holds. A document risk indicator read together with identity, credit, open data and other fraud signals supports a more complete view of the application and a more proportionate response – additional verification where the picture warrants it, and potentially fewer additional checks where the wider risk picture supports it. Decisioning, credit policy and governance remain with the organisation.
The practical question for risk and fraud teams
The question is no longer whether documents can be faked convincingly, it is whether your organisation can tell the difference at the speed and volume your onboarding, lending and claims processes now run at, and whether it can do so without asking more of every genuine customer.