8 Red Flags on a Bank Statement: The Underwriting Quick Guide
A visual reference for lenders, mortgage brokers, and underwriters. The eight tells of a tampered or fabricated bank statement, with examples and what to verify when you spot one.
Bank statement fraud is rising. The FBI's 2023 IC3 report logged $12.5B in reported losses across financial crimes, and the lending industry consistently flags doctored bank statements as one of the most common synthetic-identity and income-fraud vectors. The good news: most fabricated statements fail basic visual and numeric checks. The bad news: those checks have to be done manually unless you've automated them, and the patterns are subtle enough that an underwriter doing a 90-second pre-approval review will miss them.
This is a quick reference to the eight tells you can spot before you ever load a statement into a fraud-detection tool. None of them is conclusive on its own. Two or three together should escalate the file.
Want to use this guide on your blog? Copy this embed code:
1. Balance Math That Does Not Reconcile
Real bank statements have running balances that always equal previous balance + transaction amount. Tampered statements often fail this check because the forger edited a transaction amount without re-calculating every subsequent running balance.
How to verify: Pick three consecutive rows. Confirm that row N balance = row N-1 balance + row N amount (or minus, for debits). Do this at the top, middle, and end of the statement. If any of the three fails, the statement has been edited or there's a parsing issue.
Why forgers miss this: Bank statement editing tools (Photoshop, PDF editors) make it easy to change a number visually. Recalculating every downstream balance is tedious and easy to forget.
2. Font Inconsistencies in Specific Rows
Real bank statements use one font throughout the transaction table. Tampered statements often show specific cells - especially amounts - in a slightly different font, weight, or color than the surrounding rows.
How to verify: Zoom in to 300%+ on the transactions tab. Look for amounts that have different stroke weight, kerning, or baseline alignment vs adjacent rows. Common giveaways: a Courier-family font interleaved with a sans-serif, or anti-aliasing differences that suggest the cell was overlaid as an image.
Why this happens: The forger pastes a screenshot of a fake amount over the original or types a replacement in a different font.
3. Suspiciously Round Numbers
Real income, expenses, and balances have cents. A statement where the major deposits are all $5,000.00, $10,000.00, $2,500.00 with zero cents - especially repeating - is statistically improbable.
How to verify: Calculate the fraction of round-dollar deposits in the income column. Real W-2 payroll deposits hit the cent (e.g., $3,847.32). Self-employed and gig-economy deposits even more so. If more than 30% of deposits are perfectly round, escalate.
Why this happens: Forgers default to round numbers because they're easier to type and "feel like" income to the unfamiliar eye.
Exception: Wire transfers, intentional round-amount savings transfers, and some recurring transfers (e.g., $500.00 transfer to savings) are legitimately round. Look at the WHOLE pattern, not individual transactions.
4. Dates Out of Chronological Sequence
Real bank statements are listed in posting order. If you see a row dated 01/05 after a row dated 01/08, something is wrong - either the statement was tampered with (a row inserted out of order), or it's a multi-account bundle where you're reading two streams interleaved.
How to verify: Walk the date column top to bottom. Note any row that has an earlier date than the row above it. Confirm whether you're looking at a single-account or bundle statement before flagging.
Why this happens: Forgers add a row (often a fake deposit) and forget to renumber or re-sort.
Caveat: Some banks list pending transactions ahead of posted transactions, and some statements separate "Deposits and Additions" from "Withdrawals" - dates within each section follow order but the sections themselves may not. Check the section headers before escalating.
5. Routing Number / MICR Line Mismatch
Real bank statements have a routing number in the header that matches the MICR line at the bottom (the magnetic-ink character recognition strip used on checks). Tampered statements often have a header from one bank pasted on a body from another bank, so the routing numbers don't match.
How to verify: Compare the routing number in the bank header against the routing number in the MICR line at the bottom of the page. Look up the routing number on the Federal Reserve's E-Payments Routing Directory to confirm it belongs to the bank named in the header.
Why this happens: Forgers grab a real statement from one bank and overlay a different bank's header.
6. PDF Metadata Shows an Editor (Not the Bank)
Every PDF has metadata stating which software produced it. Real bank statements show the bank's statement-generation system (e.g., "Chase eStatement Generator" or "Oracle BI Publisher"). Tampered statements often show a PDF editor in the Modified-By or Producer field.
How to verify: Open the PDF, go to File -> Properties (Acrobat) or Tools -> Show Inspector (Preview on Mac). Check the Producer, Creator, and Modified Date fields. If the Modified Date is later than the statement period and the Producer is Adobe Acrobat Pro, Foxit, or another PDF editor, the file has been edited after the bank issued it.
Why this is decisive: Banks generate PDFs server-side and do not re-save them. Any post-generation edit shows up in the metadata unless the forger explicitly stripped it (which leaves its own traces).
7. Mixed Negative Number Formats
Real bank statements pick one convention for negatives and use it throughout - either a leading minus (-$450.00), parentheses (($450.00)), a "DR" suffix, or a separate Withdrawals column. Tampered statements often have negatives in mixed formats because rows were assembled from multiple sources.
How to verify: Scan all negative amounts. Note the format of each. If you see a mix - e.g., 90% leading-minus and 10% parentheses - the parentheses rows likely came from a different source.
Why this happens: Forgers copy rows from multiple real statements and forget to normalize the formatting.
8. Pixelated or Pasted-Over Bank Logo
Real bank statement logos are vector or high-DPI raster, sharp at any zoom level. Tampered statements often have logos that pixelate when zoomed because they were grabbed from a low-resolution screenshot or pasted from a different source.
How to verify: Zoom to 400-800% on the bank logo in the header. Sharp at every zoom = real. Pixelation, jagged edges, or anti-aliasing artifacts = pasted in.
Why this happens: Forgers grab the logo from a Google image search or screenshot, which is lower resolution than the original.
What to Do When You Spot Two or More
A single red flag may be benign. Two or more = escalate to a structured fraud review:
- Pull statements directly from the bank when possible. Many banks support Plaid Identity Verification or similar third-party verification. The applicant authorizes a direct read from the bank, eliminating PDF-handling fraud entirely.
- Run the statement through a fraud-detection tool. Ocrolus, Inscribe, and Plaid all detect document tampering at scale.
- Cross-check with tax transcripts. For self-employed borrowers, IRS Form 4506-C lets you pull tax transcripts directly from the IRS. Income reported on bank statements should reconcile with income on tax transcripts (allowing for legitimate timing and category differences).
- Verify employment directly. A 30-second call to the employer's HR line confirms whether the W-2 deposits on the statement are real.
Where Bank Statement Conversion Fits
Fraud detection requires structured data. A PDF bank statement is unstructured visual content - hard to validate at scale unless you extract the transactions first. That's where PDFSub's Bank Statement Converter fits in the workflow:
- Extracts every transaction (date, description, amount, balance) to a structured format your fraud-detection tool can read
- Recognizes 20,000+ bank templates worldwide, including non-US banks where Ocrolus and similar tools may have gaps
- 130+ language support for international applicants
- Browser-based processing for sensitive financial documents - the file does not leave your device on the Tier 1 extraction path
PDFSub does not perform fraud detection itself. It produces the clean structured data that downstream fraud-detection workflows depend on. For a primer on converting bank statements for mortgage and lending workflows, see How to convert bank statements for mortgage applications. For format choice when feeding the data into your underwriting system, see QBO vs CSV vs OFX.
The Quick Underwriting Checklist
Print this. Pin it next to your monitor.
- Balance math reconciles on at least three sampled rows
- Same font throughout the transactions table (no oddball cells)
- Fewer than 30% round-dollar deposits in the income column
- Dates are in chronological order within each section
- Header routing number matches MICR line at bottom
- PDF metadata Producer is the bank's system (not Adobe / Foxit / other editor)
- Modified Date is not after the statement period
- All negatives use the same format (one of: minus, parentheses, DR, separate column)
- Bank logo is sharp at 400% zoom
Two or more failures = escalate.