A verification firm we spoke to this year turned down an automated checking tool after one question.
"What happens when the experience certificate is entirely fake, but looks genuine?"
He meant a letter made from scratch. Nothing edited, nothing pasted in. Just a clean file on a letterhead the company never issued.
Every tamper check passes that document, because nothing in it was ever altered.
This guide explains what document forensics proves, what source verification proves, where each one fails, and how to combine them so your team confirms at the issuer only when it has to.
Forensics
Was this file edited?
Source check
Does the issuer hold this record?
Cross-check
Do the documents agree?
Issuer letter
Last resort for flagged cases
Table of Contents
- What Document Forensics Proves
- Why Format Changes Should Not Break Verification
- Why Forensics Needs the Original File
- Why Forensics Misses the From-Scratch Fake
- What Source Verification Proves
- Where Source Verification Runs Out
- Forensics vs Source Verification, Side by Side
- Cross-Document Checks: The Third Layer
- Which Check to Use for Each Document Type
- A Layered Workflow That Shrinks the Issuer-Letter Queue
- Official Sources, Consent and the DPDP Act
- Tuning Forensic Checks Without Flooding Reviewers
- Key Takeaways
- Frequently Asked Questions
What Document Forensics Proves: Whether a File Was Altered
Document forensics examines the file itself for signs that it was changed after creation. It answers one question well: has someone edited this document?
It needs no outside database, so it runs on every upload, in seconds, for any document type.
In practice, forensic screening catches the edits that make up most document fraud:
- Changed figures: marks, salary amounts, CGPA or percentages altered on a genuine document.
- Altered dates and names: a tenure stretched, a passing year moved, a name swapped.
- Added elements: a seal, signature, photo or logo inserted after the document was issued.
- Re-processed files: a document opened and saved again in an editor after it left the issuer.
For common fraud patterns, see our guide to AI document fraud detection, and for academic records, how to detect fake marksheets and AI-edited certificates.
Why Issuer Format Changes Should Not Break Verification
Good forensic screening keeps working when an issuer redesigns its certificate. If a tool depends on a stored copy of every "correct" layout, each redesign breaks it until someone updates the library.
That matters more than it sounds. Universities and boards change certificate formats every few years.
Old formats also stay in circulation for decades, because candidates graduate once and apply for jobs for thirty years.
DocuExprt does not need a per-issuer template library, so a new marksheet design or a 20-year-old certificate is screened the same way. Each file comes back "modified" or "not modified" with a risk score, so most files clear automatically and only flagged ones reach a reviewer.
When you evaluate any verification tool, ask one question: what happens the year an issuer changes its format?
Why Forensics Needs the Original File, Not a Photocopy
Forensic screening is built for the original file. A photocopy, a screenshot, a re-scan of a printout or a file re-saved through an editor is flagged "modified", even when nothing was faked.
This is the single most common surprise in a verification pilot. Tell candidates up front to upload the original digital file or a direct scan of the original document.
You can see the difference yourself: run an original PDF and a re-saved copy of it through our free document tampering checker.
Why Forensics Misses the From-Scratch Fake
Forensics cannot tell you whether an issuer ever issued a document. A certificate typed fresh on a copied letterhead has no edit history to find.
This is not a hypothetical risk. In December 2025, Kerala Police seized more than one lakh fake certificates carrying the names of real universities, traced to a printing house.
Printed and scanned, such a certificate can look cleaner than a genuine one that was stapled, stamped and photocopied for years.
Generative AI adds a second route. A document generated in one pass was never edited after creation, so it may pass forensic screening too.
The honest conclusion: a clean forensic report means "not edited", never "genuine". Fake certificate detection that stops at forensics will miss this whole category.
Forensics, source checks, one flow
Bring a real candidate file. We run all three checks live.
- Tamper flags on every upload
- DigiLocker and UAN, with consent
- Cross-document mismatch checks
- Pass, refer or fail per file
Loading the form… If it does not appear, open the demo page.
🔒 CERT-IN Certified🛡 ISO 27001🎟 Free trial tokens
What Source Verification Proves: Whether the Issuer Holds the Record
Source verification checks a claim against the issuer's own record, not against the uploaded file. If the record exists and matches, the document is backed by the body that issued it.
That makes it the only check that defeats a clean, from-scratch fake. The fake has no record behind it.
In India the main source channels are:
- DigiLocker and the National Academic Depository: degrees and marksheets issued directly by participating universities and boards, pulled with the candidate's consent. See our DigiLocker document verification page.
- UAN and EPFO records: employers, joining and exit dates from PF contributions, covered in our employment history verification API guide.
- PAN, GSTIN and company registries: identity and business records confirmed against the issuing department.
- Direct issuer confirmation: a letter or email from the university or employer, still the fallback for everything else.
DocuExprt connects to PAN, Aadhaar, GST and 30+ government database APIs, listed on our government verification API page.
Where Source Verification Runs Out: Coverage, Consent, Cost and Time
Source verification only works where a registry holds the record and the person consents to the check. Outside that, it has nothing to query.
The gaps show up quickly in real files:
- Older records: many degrees issued before universities began uploading to DigiLocker and NAD are not there, and individuals cannot push their own old records in.
- Private universities and small issuers: coverage varies widely by institution.
- No API at all: hospitals, most private employers and local issuing offices publish no verification interface.
- EPFO blind spots: contract roles, small establishments below the PF threshold and overseas jobs leave no passbook entry.
- Consent friction: every check needs the person's informed consent, and requests sent by email are often ignored.
Where no registry exists, the fallback is the issuer letter. A background-verification firm told us university confirmations take 20 to 45 days, often carry a fee, and vary by institution.
Some of their clients still require that genuineness letter for compliance, whatever the automated result says.
Document Forensics vs Source Verification: Side-by-Side Comparison
The two checks answer different questions, so neither replaces the other. Forensics is fast and universal but cannot prove issuance; source verification proves issuance but only where a registry exists.
🔬 Document forensics
- Proves: the file was or was not edited
- Coverage: any document, any issuer
- Speed: seconds per file
- Misses: clean, from-scratch fakes
- Consent: covers the file the person submitted
🏛️ Source verification
- Proves: the issuer holds a matching record
- Coverage: only where a registry or API exists
- Speed: real time by API; weeks by letter
- Misses: anything outside the registry
- Consent: explicit consent per check
| Factor | Document forensics | Source verification |
|---|---|---|
| Question answered | Was this file altered? | Did the issuer issue this? |
| Catches edited genuine documents | Yes | Yes, if a field differs from the record |
| Catches from-scratch fakes | Often not | Yes, where a record should exist |
| Coverage | Every document type | Registries and APIs only |
| Speed | Seconds | Seconds by API; 20-45 days by issuer letter |
| Cost profile | Low, per document | Per API call; issuer fees for letters |
| Typical failure mode | False flags on stamps and signatures | "No record found" for genuine old documents |
| Evidence value in an audit | Shows the file was screened | Shows the issuer confirmed it |
Cross-Document Mismatch Checks: The Third Layer
Cross-document checks compare what several documents, and the applicant, say about the same fact. They catch lies that are internally clean in every single file.
A fabricated document still has to agree with everything else in the application. That is hard to fake consistently.
- Declared vs documented marks: an admissions intermediary told us students' stated marks often differ from their marksheets.
- Salary across three documents: offer letter, payslip and bank credit should reconcile. See our salary slip verification guide.
- Employment dates: an experience letter's tenure against UAN joining and exit dates.
- Identity fields: name, date of birth and father's name across ID, marksheet and certificate.
A mismatch does not prove fraud. It tells the reviewer exactly which fact to confirm, which is faster than re-checking the whole file.
Shrink the issuer-letter queue
Tell us your document mix and monthly check volume.
- Tamper screening on every file
- PAN, Aadhaar, GST + 30+ govt DBs
- Your own pass and refer thresholds
- Audit logs for all actions
Or book a demo on your own files.
🔒 CERT-IN Certified🛡 ISO 27001🎟 Free trial tokens
Which Verification Check to Use for Each Document Type
Match the check to what exists behind the document. Use source verification wherever a registry covers it, and lean on forensics and cross-checks where none does.
| Document | Forensics | Source check | Cross-check | Escalate to issuer when |
|---|---|---|---|---|
| Degree / marksheet | Yes | DigiLocker / NAD where covered | Declared marks, name, DOB | Not on DigiLocker, or flagged |
| Experience letter | Yes | UAN / EPFO history | Tenure vs UAN dates | No PF record, or dates conflict |
| Payslip | Yes | Form 26AS or UAN, with consent | Offer letter and bank credit | Figures do not reconcile |
| PAN / Aadhaar / ID | Yes | Government database or secure QR | Name and DOB across documents | Record mismatch |
| Medical bill | Yes, score-based | Usually none: hospitals rarely expose APIs | Patient name, dates, amounts | High risk score or large claim |
| Domicile / caste certificate | Yes | DigiLocker where the state issues there | Address across documents | Not on DigiLocker, or flagged |
A crowdfunding platform we worked with could only use forensics on hospital bills. With no hospital API to query, a risk score decided which bills a person reviewed.
How a Layered Verification Workflow Shrinks the Issuer-Letter Queue
Run cheap, universal checks on every file first, and save slow issuer confirmation for the cases that fail or fall outside any registry. Automation speeds up first-level screening; it does not replace issuer confirmation where your clients require it.
THREE LAYERS, ONE SHRINKING QUEUE
Each layer handles fewer files than the one above it. The slow, paid issuer letter sees only what the fast layers could not settle.
In DocuExprt this runs as one workflow that routes each file by its result, against pass and refer thresholds you set.
For a BGV firm, the gain is not skipping the university. It is sending the university only the files that need it, with the reason attached.
Official Sources, Consent and the DPDP Act
Source checks are only as defensible as the channel they use and the consent behind them. Ask any provider where each record comes from, and keep the consent with the result.
A BGV firm serving multinational clients told us those clients ask one question first: is this UAN and ID data coming from an official channel, and is it legal to use?
It is the right question. Our HR document verification page states that PAN, Aadhaar and UAN checks run through official, authorised channels.
Government registries publish sanctioned integration routes too, such as DigiLocker's APIs on API Setu.
What the DPDP Act Means for Verification Consent
Under the Digital Personal Data Protection Act, 2023, verification data is personal data, so most checks rest on the person's informed consent for a stated purpose.
The DPDP Rules, 2025 were notified in November 2025 with an 18-month phased rollout. Most notice and consent obligations apply at the end of that window.
In practice that means four things for a verification workflow:
- A notice naming each check you intend to run.
- Consent tied to that purpose, not a blanket authorisation.
- A consent channel people actually respond to. Email requests are often ignored; an OTP step is harder to miss.
- An audit trail showing who verified what, when, and on what consent.
This is general information, not legal advice. Confirm your own obligations with counsel.
How to Tune Forensic Checks Without Flooding Reviewers
Treat a forensic flag as a reason to look, not a verdict. Tune the checks and thresholds to your document mix, and route anything above the threshold to a human reviewer.
Genuine documents trigger flags too. A recruitment client found that rubber stamps and wet signatures, added after printing, often read as "modified".
That is technically true. The stamp was added later. It is just not fraud.
Three settings keep the review queue useful:
- Checks per document type: choose which checks apply to each document type, rather than reviewing noise.
- Your own thresholds: a payslip and a medical bill need different pass and refer cut-offs.
- A review queue with reasons: reviewers see why a file was flagged, then record a decision.
Every reviewer decision is also data. Over a few weeks it shows which flags are noise for your documents and which ones catch real edits.
Key Takeaways
- Forensics proves a file was not edited; it never proves a document is genuine.
- A from-scratch or AI-generated fake can pass every tamper check.
- Source verification proves issuance, but only where a registry holds the record.
- Older, private-university and hospital documents often have no registry to query.
- Cross-document checks catch lies that each file hides on its own.
- Screen every file fast, then send only flagged or uncovered files to the issuer.
- Choose screening that keeps working when issuers change their formats.
- Ask for the original file: photocopies and re-saved files are flagged as modified.
Frequently Asked Questions
What is the difference between document forensics and source verification?
Document forensics screens the file itself for signs that it was edited after it was issued. Source verification checks the claim against the issuer's own record, such as DigiLocker, UAN or a government database. Forensics shows whether a file was altered; source verification shows whether it was ever issued.
Can document forensics detect a completely fake certificate?
Not reliably. A certificate created from scratch or generated by AI has no edited region to find, so it can pass forensic checks. Catching it needs source verification or issuer confirmation, and cross-document checks often expose inconsistencies with the rest of the application.
What if a degree is not available on DigiLocker?
Many older degrees and some private-university records are not on DigiLocker or NAD. For these, run forensic and cross-document checks first, then request confirmation from the university for files that are flagged or that your client requires an issuer letter for.
Can document forensics verify a photocopy?
No. Forensic screening is designed for the original file. A photocopy, screenshot, re-scan or re-saved file is flagged as modified, even when the underlying document is genuine. Ask candidates to upload the original digital file or a direct scan of the original document.
Does automated verification replace university verification letters?
No. Automated forensics, cross-checks and registry lookups speed up first-level screening and reduce how many files need an issuer letter. Where a client or regulator requires a genuineness letter from the university, the letter is still needed.
Screen Fast, Confirm at Source
Forensics and source verification are not rivals. They answer different questions, and a fake that beats one rarely beats both.
Teams that layer them catch edited documents at intake, confirm what registries can confirm, and send the issuer only the files that truly need it.
Screen first, confirm at source
Bring a sample batch. We run it live on the demo.
- 99% accuracy
- CERT-IN certified, ISO 27001
- Cloud, private cloud or on-premise
- Role-based access and audit logs
Trusted by enterprises and government boards
Free trial tokens available for testing.