Tag: Document Tampering

Nine Checks, One Verdict: Inside the Document Authenticity Pipeline

Posted on October 16, 2026 by - AI in Insurance, Claims Management, Intelligent Document Processing (IDP)

Nine Checks, One Verdict: Inside the Document Authenticity Pipeline - how document tampering detection works

Points clés à retenir

  • Each kind of document tampering leaves a different trace, so no single check catches all of it.
  • CoverGo IDP runs nine independent document tampering detection checks and reports each one separately.
  • Arithmetic and date checks work on photos and scans as well as PDFs. Two checks read a PDF’s internal structure and run on PDFs only.
  • Print-and-rescan detection is a soft signal. It informs the reviewer but never changes a verdict on its own.
  • When a claim includes several documents, CoverGo IDP compares service dates across all of them and flags any that disagree.

Document tampering detection starts with a simple fact: every kind of tampering leaves a different trace. Editing a PDF leaves structural evidence. Retouching a photo leaves pixel-level evidence. Generating a document from scratch leaves neither. As a result, no single check covers all of it, so the CoverGo IDP AI Agent runs nine independent checks and combines the results. In our last post, we covered how those results become one verdict. This post covers what each check actually looks for.

See it run on a tampered invoice: Book a CoverGo IDP AI Agent demo.

The numbers don’t add up

Arithmetic reconciliation compares itemized amounts against the stated total. An altered amount usually breaks the sum, which makes this one of the most dependable checks in the set. It also works on photographs and scans, not just PDFs. Before analysis, the pipeline renders each document at higher resolution, so a pen stroke that turns one digit into another doesn’t get smoothed away.

The dates don’t make sense

Date logic catches impossible and implausible dates. For example, it flags a date labeled as a Monday that falls on a Wednesday, a service date in the future, or a treatment date before the admission date. The pipeline reads the dates from the document, then checks them against the actual calendar using fixed rules rather than a model’s judgment.

The PDF was digitally edited

Two checks read the internals of a PDF. The first inspects the document’s structure for pages modified after the file was created. The second compares the PDF’s text layer with what actually appears on the page. This catches text-overlay tampering, where someone covers a number with a new one and the original stays underneath. Both checks run on PDFs only.

The image was retouched

For images and scans, the pipeline applies image forensics. Error level analysis finds regions saved at a different compression quality from their surroundings. Noise analysis finds areas whose grain doesn’t match the rest of the page, and clone detection finds copied-and-pasted regions. In addition, a character-level check examines amounts, dates, and ID numbers for inconsistent pen strokes and letterforms. A visual inspection pass also looks for whiteout, misaligned text, and fonts that change within a single field.

The document was printed and rescanned

Print-scan detection looks for moiré patterns, halftone dots, edge sharpness, and paper texture. These are the traces left when someone prints a document, alters it by hand and scans it back in. Plenty of honest claimants, however, photograph printed receipts. That’s why this check is a soft signal: it informs the reviewer but never changes the verdict on its own.

The document was AI-generated

Producing a correctly formatted, internally consistent invoice now takes no skill at all. Industry groups such as the Coalition Against Insurance Fraud have been tracking that change, which is why this kind of claims document fraud needs its own check.

The documents disagree with each other

When a claim includes more than one file, the pipeline also compares service dates across them and flags any file that disagrees with the rest. For instance, if the invoice, the medical certificate, and the discharge summary give different dates of service, they’re flagged together as a set, not treated as three documents that each look fine on their own.

Pourquoi est-ce important ?

Each check is narrow, and that’s the point. Arithmetic catches the altered total on a photographed receipt. Text-layer comparison catches the overlaid PDF. AI-generation detection catches the document no provider ever issued. Because each check runs independently and reports separately, your reviewer sees not just that something is wrong, but which kind of wrong it is.

See which checks fire on a document you bring to the call. Book a CoverGo IDP AI Agent demo →

En bref

Document tampering leaves different traces depending on how it was done, so CoverGo IDP runs nine independent checks on every document where fraud detection is on. Arithmetic and date checks flag altered numbers and impossible dates. Two PDF-only checks look for digital edits and text overlays. Image forensics looks for retouching, print-scan detection spots rescanned documents but never changes the verdict on its own, and a dedicated check looks for AI-generated documents. Each check reports separately, so your reviewers see exactly what kind of problem the system found.

Frequently Asked Questions

What does CoverGo IDP check for in a claim document?

Nine checks covering arithmetic, dates, PDF structure, PDF text layers, image retouching, character-level alterations, visual signs of editing, print-and-rescan traces, and AI generation. On multi-document claims, it also compares service dates across the files.

Do all nine checks run on every document?

No. The two PDF-structure checks can’t run on photos or scans. When a check can’t run, the pipeline marks it as skipped and leaves it out of the score, rather than counting it as passed.

Can it detect AI-generated invoices and receipts?

A dedicated check looks for documents produced by generative tools. If it finds signs of generation, the document is flagged for human review.

Will a photographed or rescanned receipt get flagged as fraud?

Not on that basis alone. Print-scan detection is a soft signal. It shows the reviewer what it found but never changes a verdict by itself.

Does document tampering detection reject claims automatically?

No. Flagged documents go to a person for review. Nothing in the pipeline refuses a claim or contacts the customer.

Pour plus d'informations ou pour assister à une démonstration animée par un expert, n'hésitez pas à contacter un membre de notre équipe.

See Which Checks Fire on Your Documents

Bring a claim document from your own book and see the CoverGo IDP AI Agent run all nine checks: what each one found, which were skipped, and why.

BOOK A DEMO

Authentic, Suspicious, Likely Tampered: How a Document Earns a Verdict

Posted on October 8, 2026 by - Claims Management, Intelligent Document Processing (IDP)

Document fraud detection: Authentic, Suspicious, Likely Tampered verdicts

Points clés à retenir

  • Every document on a fraud-enabled schema gets one of three verdicts: Authentic, Suspicious, or Likely Tampered.
  • One strong finding caps the score, so eight clean checks can’t average it back up to Authentic.
  • Each verdict comes with a plain-language summary, a breakdown of every check, and the page and region where the problem is.
  • Checks that can’t run on a document type are marked skipped and left out of the score. They are never counted as passed.
  • Likely Tampered sends the document to a person for review. It never rejects a claim automatically

Document fraud detection only helps if your claims team can act on it. “The system says this document is suspicious” is not actionable. A handler needs to know which check fired, what it found, and where on the page to look. Otherwise, the flag becomes one more queue nobody trusts. In our first post, we looked at why altered, duplicated and AI-generated documents slip past manual review, a pattern the Coalition Against Insurance Fraud has been tracking as generative tools spread. This post covers what happens next: how CoverGo IDP turns nine independent checks into one verdict, with the evidence attached.

See it run on a tampered invoice: Book a CoverGo IDP AI Agent demo.

Three document fraud detection verdicts, not a score to interpret

On a fraud-enabled schema, the CoverGo IDP AI Agent returns one of three verdicts for every document.

Authentic. No strong tampering signals were detected. The document proceeds through the normal workflow.

Suspicious. Signals fired, but not conclusively. The document is routed for manual review rather than held or refused.

Likely Tampered. There is strong evidence of tampering. What happens next is the insurer’s decision — escalate to the fraud team, request a resubmission, or hold pending investigation. It is a flag for human review, never an automatic rejection.

Handlers see a badge, not a number to calibrate against. Teams that want finer control can build routing rules on top of the verdict.

One strong signal is enough

You might expect a single check to be outvoted. That is the risk with any average. A weighted average across nine checks has an obvious weakness: a single decisive finding could be diluted by eight checks that found nothing. The pipeline handles this with override rules. When one check returns a strong, specific finding — the arithmetic does not reconcile, the visible text disagrees with the embedded text layer — that finding caps the document’s score, so it cannot be averaged back up into Authentic. A document with one unambiguous problem and eight clean checks still lands in review.

The reasoning travels with the verdict

Alongside the verdict, each document carries a detection summary in plain language, a per-check breakdown showing what every technique returned and why, and a list of flagged issues describing which check fired, what it detected, and where.

Where the evidence is visual — a retouched region, an altered digit — the flagged issue includes the page and a bounding box over the area. Where it is textual, such as a mismatch between what a PDF displays and what its text layer contains, the suspect text itself is surfaced instead. The execution log records which checks ran, which were skipped, and why.

Skipped is not the same as passed

Some checks only apply to some documents. Two of the most reliable checks read the internal structure of a PDF, so they cannot run on a photograph or scanned image of a receipt. Rather than scoring those as clean, the pipeline marks them skipped and excludes them from the calculation, so an absent check never inflates a verdict. A reviewer looking at the technique list sees exactly which checks were available for that document.

Pourquoi est-ce important ?

Document fraud detection fails in practice when handlers cannot see why something was flagged. A verdict with per-check reasoning, visible evidence, and an honest account of which checks could not run is something a claims team will act on, and something an auditor or regulator can follow after the fact.

See the per-check breakdown on your own claims documents. Book a CoverGo IDP AI Agent demo →

En bref

A fraud flag only helps if a claims handler can act on it. CoverGo IDP runs nine independent authenticity checks on each document and returns one of three verdicts: Authentic, Suspicious, or Likely Tampered. Each verdict shows which check fired, what it found, and where on the page to look. One strong finding is enough to cap a document’s score. Checks that can’t run are reported as skipped, not counted as passed. A Likely Tampered verdict sends the document for human review and never rejects the claim automatically.

Frequently Asked Questions

What verdicts does CoverGo IDP return on a claim document?

There are three: Authentic, Suspicious, and Likely Tampered. Authentic documents carry on through the normal workflow. Suspicious documents go to manual review. For Likely Tampered documents, the insurer decides the next step.

Does a Likely Tampered verdict reject the claim?

No. It flags the document for human review. Nothing in the pipeline refuses a claim, closes a case, or contacts the customer.

Can one failed check change the verdict if all the others pass?

Yes. A strong, specific finding, such as totals that don’t add up or a PDF whose visible text differs from its text layer, caps the score. The document can’t average back up to Authentic.

How does a handler see why a document was flagged?

Each verdict comes with a plain-language summary, a breakdown of what every check returned, and a list of flagged issues. Visual findings show the page and a box around the area. Text findings show the suspect text itself.

What happens when a check can’t run on a document?

It is marked skipped and left out of the score. For example, the PDF-structure checks can’t run on a photographed receipt. The reviewer can see exactly which checks were available.

Is document fraud detection on for every document?

No. It is off by default and turned on per document schema, which in practice means per document type.

Pour plus d'informations ou pour assister à une démonstration animée par un expert, n'hésitez pas à contacter un membre de notre équipe.

See the Per-Check Breakdown on
Your Own Documents

A fraud flag only helps if your team can act on it. Bring a claim document from your own book and see the CoverGo IDP AI Agent return its verdict: which check fired, what it found, and where on the page to look. If a check can’t run on that document type, you’ll see that too.

BOOK A DEMO