Back to home

Document Tampering Detection for UK Mortgage Brokers

By Casefile

Document Tampering Detection for UK Mortgage Brokers

Document tampering detection is the process of establishing whether a payslip, bank statement, tax form or ID has been altered, fabricated or reused after it was issued. For a UK mortgage broker, it combines three layers: visual and content checks, file-level forensics such as metadata and format validation, and cross-checks between documents that should agree with each other. No single layer is enough. The strongest results come from running all three on every case, before the file reaches a lender.

TL;DR

  • Tampering is rarely visible to the eye. Check file metadata, arithmetic and consistency between documents, not only appearance.
  • Cross-document checks catch the most common problem: a payslip figure that does not match the wage deposits on the bank statement.
  • The FCA expects firms to run reasonable checks on customer information. Past enforcement shows that failing to do so can end in withdrawal of approval.
  • Automating collection and checks gives every case the same controls and leaves an audit trail.
  • Casefile automates these checks for UK brokers and keeps data in the UK.

Table of Contents

Why tampering is a broker problem, not only a lender problem

Mortgage application fraud takes place when false or altered documents are provided to support an application. The scale of the temptation is documented: a survey commissioned by Cifas found that 16% of UK adults said they, or someone they know, had misled mortgage companies about their salary, and some respondents would inflate earnings by as much as £10,000. The same survey found that 14% of respondents did not think misleading a lender was illegal.

Those figures matter to brokers because the broker is the first person to see the documents. The FCA's published guidance on mortgage fraud says lenders should maintain systems and controls dedicated to detecting and preventing mortgage fraud. The same guidance notes that a broker's presence on the FCA register is only a baseline, and that higher-risk cases may warrant original documents instead of broker-certified copies. A broker with weak controls is a risk to the lender relationship as well as to the client.

The regulatory record is direct. In a Final Notice from 2013, the FCA found that an individual had failed to ensure his firm had appropriate controls to verify information submitted by clients to support mortgage applications. A decision notice concerning Martin Lafrance similarly cites a failure to ensure reasonable checks verified the accuracy of customer information.

What counts as tampering

Tampering covers more than a crude edit. The most useful way to classify it is by what was done to the document. A local authority guide on false ID lists four types of false document, including a genuine document used by someone else and a genuine document that has been altered. The same logic applies to financial paperwork:

  1. Altered genuine documents. A real payslip with the gross pay, employer name or date changed.
  2. Fabricated documents. A payslip or statement built from a template, with no real source behind it.
  3. Selective or edited statements. Transactions removed, or a salary credit added, so that income appears higher or commitments disappear.
  4. Borrowed documents. A genuine document that belongs to someone else, for example a utility bill in another person's name.
  5. Incremental resubmission. The same application resubmitted with small changes. The FCA's guidance flags that sophisticated systems can detect these patterns.

The three layers of tampering detection

Layer 1: Content and visual checks

This is the layer most brokers already run by hand. The HMRC anti-money laundering guidance says verification should include checking spelling, validity dates and security features, and obtaining more than one form of ID where needed. The Home Office publication Examining identity documents explains how to detect basic forgeries in identity documents.

In practice, this layer looks for:

  • Inconsistent fonts, spacing or alignment within a single line or table.
  • Misspelt employer names, bank names or addresses.
  • Expired or implausible dates, such as a payslip dated on a non-working day.
  • Logos with poor resolution compared with the rest of the page.
  • Photo ID that does not show the expected security features.

The limit of this layer is plain: a competent forger fixes all of the above. It also depends on the reviewer's attention, which varies across a long day and a heavy caseload.

Layer 2: File-level forensics

Digital tampering is not always visible. The Crown Prosecution Service explains that digital files carry metadata describing how and when data was collected and edited, and that normal saving can change those underlying properties. The practical lesson for brokers is to keep the original file as received, not a re-saved or re-exported copy.

File-level checks typically cover:

  • Metadata. Creation and modification timestamps, and the software used. A bank statement PDF that was last saved by a consumer photo or document editor, rather than by the issuer's system, warrants a closer look.
  • Revision history. Evidence of incremental saves or overlaid objects in a PDF.
  • Format conformance. The National Archives notes that tools such as JHOVE and veraPDF check whether a file conforms to its expected format specification, which helps flag irregular or corrupted files that may have been tampered with.
  • Image forensics. Pixel-level inconsistencies, such as differing compression levels in a patch where a figure was replaced.

A clean metadata trail does not prove a document is genuine, since metadata can itself be edited. Equally, an odd trail has innocent explanations: a client may have opened a statement and printed it to PDF. The finding is a reason to ask a question, not an accusation.

Layer 3: Cross-document consistency

This layer is where most mortgage-specific tampering is caught, because a forger usually alters one document and forgets the others. The checks are arithmetic and comparative:

  • Does the net pay on the payslip match a deposit on the bank statement, from the same employer, on a plausible date?
  • Do the year-to-date figures progress sensibly from month to month?
  • Does the tax code and National Insurance deduction fit the stated gross pay?
  • Does the bank statement show regular payments to a lender, card provider or credit agreement that the client did not declare?
  • Do the name and address agree across the ID, utility bill and statements?
  • For the self-employed, do the figures on the tax return agree with the income shown on the statements? Casefile's guide to tax return verification covers this in detail.

Cross-checking also finds the problem that is far more common than outright forgery: undeclared commitments and income that does not reconcile. These are the things lenders query, and the things that delay offers.

A worked example

Take an applicant who declares a salary of £48,000 and supplies three payslips. Each payslip shows a net figure consistent with that salary. The broker opens the three months of bank statements and finds credits from the employer that are about £400 a month lower than the payslip net pay. The statements also show a monthly payment to a car finance provider that the fact find does not mention.

Income mismatch and undeclared car finance

Neither discrepancy is proof of fraud. The payslips may be genuine and the statement may show a second account where part of the pay is paid. But both need explaining before submission. If the broker finds them, the case can be corrected or declined on the broker's terms. If the lender finds them, the broker gets a query at best, and at worst a question about their own controls.

This is why the order of work matters. The checks should run when documents arrive, not when the case is about to be submitted.

Building a repeatable process: 5 steps

  1. Define the document list per applicant. Employed, self-employed, contractor and mixed-income applicants need different evidence. A fixed list for everyone either over-asks or misses documents.
  2. Collect originals through a controlled channel. Photos of screens, forwarded emails and re-saved PDFs destroy useful metadata. A secure upload keeps the file as the client sent it.
  3. Run file and content checks on arrival. Metadata, format validity, arithmetic on payslips and statements, and security features on ID.
  4. Cross-check across documents. Match wages to deposits, look for commitments in outgoings, and compare names and addresses.
  5. Record the decision. Who reviewed it, what was flagged, what the client said and who approved it. Casefile's article on document approval workflow controls sets out how to make that trail traceable for auditors.

The FCA's themes add a management point. Firms should not incentivise staff solely on sales numbers without quality measures such as fraud, and the guidance recommends rotating relationship managers to reduce collusion risk. A process that does not depend on one person's judgement helps with both.

Manual, point tools and workflow platforms compared

ApproachStrengthsLimits
Manual review by adviser or case handlerNo new cost; flexibleSlow; inconsistent; misses metadata and arithmetic; relies on attention
Standalone forensic toolsStrong on file-level analysisSeparate from the case; no document list, chasing or approval trail
Document workflow platform with built-in checksCollection, checks, cross-referencing and audit trail in one placeNeeds onboarding; choose one with UK data handling

For a small brokerage, the middle option often creates an extra step without removing the first. The question to ask of any option is whether it checks documents against each other, and whether it records the result.

Identity and property-side checks

Tampering detection on income documents sits alongside identity and property checks. For ID, the HMRC and Home Office pages above are the practical references. On the property side, buyers and their advisers can also use an independent property due diligence checklist for buyers in England and Wales to cover risks that sit outside the mortgage file, such as flood risk and planning applications.

What the law says

The legal exposure for the applicant is serious, and brokers should be able to explain it plainly. Under the Fraud Act 2006, dishonestly making a false representation with intent to make a gain or cause loss is an offence of fraud by false representation. The research behind this article records a maximum of 5 years' imprisonment on indictment under that Act, and up to 10 years under the Forgery and Counterfeiting Act 1981 for using a false instrument with intent to deceive.

The CPS describes forgery as making a false document with the intention to induce somebody to accept it as genuine and to act to their or another's prejudice. This is also a reason to handle suspicions carefully: if you believe a document is forged, take advice from your compliance officer on reporting obligations, and do not tip off the client or submit the case.

Our perspective

We build Casefile for UK brokers, and we see the same pattern in document checking. The tampered payslip is the rare case. The common case is a file that does not add up: income that does not match deposits, a commitment that was left off, a document that is out of date. Brokers lose time on these because the checks happen late and by hand.

So our approach is to move the check to the moment of upload. Documents are collected through a branded client portal, the document list builds itself from the client's payment types, and the platform cross-checks bank statements, payslips, tax forms, ID and utility bills. It highlights discrepancies such as undeclared commitments and mismatched wage deposits before the case reaches a lender, and it supports checks for tampering and document authenticity.

Our perspective — overview diagram

We also hold that where the data sits is part of the control. Casefile keeps data in UK-only residency, with no manual or offshore handling, and every action is recorded in an audit trail. A tool that finds fraud but creates a data protection problem has not helped the brokerage.

Our view is that detection should support the adviser's judgement, not replace it. A flag is a prompt to ask the client a better question.

— Darren

How Casefile supports tampering detection

Casefile is a cloud-based platform for UK mortgage brokerages. It automates document collection, cross-checks documents, flags discrepancies and undeclared commitments, matches wage deposits, detects tampering and manages approval queues, under the brokerage's own branding. You can read how documents are stored and protected on the data security page, or see the platform at gocasefile.com. The same approach is covered for the wider workflow in our guide to mortgage document automation.

Practical rules for small brokerages

  • Keep raw files. Do not re-save, screenshot or convert client documents before checks are done.
  • Ask for originals when risk is higher. The FCA guidance supports requiring originals rather than certified copies in those cases.
  • Separate roles. The person who collects documents and the person who approves them should not always be the same. Our piece on role based access control explains how to set permissions by task.
  • Write down the client's explanation. Many discrepancies are innocent, and a recorded answer protects everyone.
  • Escalate, do not improvise. Suspected forgery goes to your compliance lead.

FAQ

How can you tell if a PDF bank statement has been tampered with?

Look beyond the page. Check metadata for the software used and the modification date, look for inconsistent fonts or compression patches, and verify the arithmetic of running balances. Then compare the credits with the payslips. A file that fails any of these needs a question to the client, not an assumption.

Is document tampering a criminal offence in the UK?

Yes, where it is done dishonestly to gain or cause loss. Mortgage cases are generally prosecuted as fraud by false representation under the Fraud Act 2006, and the Forgery and Counterfeiting Act 1981 covers false instruments. If you suspect it, speak to your compliance officer before taking any step with the client.

Does a mortgage broker have to check documents for tampering?

The FCA expects firms to maintain adequate systems and controls and to make reasonable checks on the accuracy of customer information, as its decision notice on Martin Lafrance illustrates. The rules do not name a specific tool. They expect a process that works and can be evidenced.

Can software detect all forged documents?

No. Software finds file anomalies and inconsistencies quickly and consistently, but a sophisticated forgery may pass, and genuine documents can look odd. Treat a flag as a prompt for adviser review and use cross-document checks alongside it.

Sources

This article was generated with AI, and whilst it is our expectation that the article is accurate, it should not be taken as advice.