🔎
Layer 01 — Critical
Font injection detection
Character-level font analysis across every word. Edited documents leave subset font prefixes (ABCDEF+Arial) that reveal exactly which words were changed — with page and word coordinates as proof.
text_injected_on_document
editor_fonts_detected
editor_generated_document
👤
Layer 02 — Critical
Identity fraud detection
Compares the visible customer name (OCR-rendered) against the original name in the raw PDF data layer. Catches name substitution attacks that completely bypass visual inspection.
customer_name_mismatch
📄
Layer 03 — High
PDF binary & revision analysis
Reads raw binary structure to detect incremental edits, hidden revision layers, multiple %%EOF markers, and tampered cross-reference tables — proof the document was modified after creation.
incremental_updates
pdf_content_modified
multiple_xref_tables
🔌
Layer 04 — High
Metadata & AI tool intelligence
Checks creator, producer, and modification fields against 70+ known fraud tools — AI generators (Canva, Firefly, Midjourney), PDF editors (Acrobat, Smallpdf), and office suites. Stripped metadata is itself a signal.
ai_tool_in_metadata
pdf_editor_in_metadata
stripped_metadata
📊
Layer 05 — High
Transaction math verification
Extracts the full transaction table, verifies every running balance end-to-end, checks the closing balance, and applies Benford's Law to detect statistically improbable digit distributions in fabricated data.
balance_mismatch
running_balance_breaks
benford_law_violation
🔗
Layer 06 — High
Cross-document duplicate detection
Semantic vector embeddings identify when a new document's transaction set closely matches one already on file — even when amounts, dates, or names have been changed. Catches recycled statements across applicants.
duplicate_transactions
🚫
Layer 07 — Critical
Content legitimacy scanning
Scans text for explicit fraud markers: sample watermarks, lorem ipsum filler, placeholder names (John Doe), template labels, demonstration disclaimers, and known fake document generator website references.
sample_statement
known_generator_site
lorem_ipsum_filler
📏
Layer 08 — Medium
Layout & font consistency
Genuine bank statements have consistent column alignment, line spacing, and font usage. DocPrism detects alignment breaks, character spacing anomalies, and font switching mid-line — artifacts of desktop editing.
text_block_misalignment
font_switching_within_line
📜
Layer 09 — Configurable
Negative database matching
A team-managed pattern library. Flag known fraud tool producers, match transaction signatures to prior cases, and blacklist document fingerprints. New patterns added by admin — no code changes needed.
negative_db_metadata_tool
negative_db_transaction