Spotting a fake bank statement comes down to three checks: look for visual and formatting flaws the document itself, run the math to confirm every balance reconciles, and verify the account directly with the issuing bank rather than trusting what’s printed on the page. A forger can imitate a bank’s letterhead, but reproducing months of internally consistent transactions, correct running balances, and standardized deposit codes is far harder. And no visual inspection substitutes for a call to the bank through a number you found independently.
Visual and Formatting Red Flags
Banks generate statements from automated systems using precise, consistent templates. Every page of a real statement carries the same fonts, spacing, margins, and logo placement. When someone alters a statement by hand, small visual errors almost always slip through.
- Font mismatches. Subtle shifts in typeface, size, or weight within a single line or between sections. A real bank system renders every character from the same template.
- Low-resolution logos. A pixelated or slightly blurry bank logo suggests the image was copied from a website rather than embedded by the bank’s own software.
- Irregular spacing. Columns that don’t align, text that drifts from the margins, or uneven gaps between rows point to manual layout work.
- Ghosting and layered edits. When someone erases and retypes text in a PDF editor, faint traces of the original text sometimes remain visible. Opening the file in design software can reveal hidden layers the editor forgot to merge.
- Color inconsistencies. Shading or background tints that shift partway through a page suggest parts of the document were spliced together from different sources.
One check that sounds useful but isn’t: PDF metadata. Downloading a PDF automatically updates its modification timestamp, and many editing tools leave the original creator field unchanged even after alterations. A metadata mismatch might justify closer inspection, but matching metadata does not confirm anything.
Math and Transaction Patterns
A bank’s computer system never makes arithmetic mistakes. Add the opening balance to all deposits, then subtract all withdrawals and fees. The result should match the closing balance exactly. Even a one-cent discrepancy in a supposedly bank-generated document is a serious red flag.
Beyond the reconciliation, look at the transactions themselves for patterns real accounts rarely produce.
- Repeated round-number amounts. Deposits or withdrawals of exactly $500.00, $1,000.00, or $2,500.00 appearing again and again are statistically unusual, since real purchases, bills, and deposits almost always carry odd cents.
- Weekend or holiday processing. Non-automated transactions dated on Sundays or federal bank holidays suggest the forger didn’t check a calendar. Banks don’t process manual transactions on days they’re closed.
- Mismatched descriptions. A large charge labeled as a utility payment that appears three times a week, or a merchant description that doesn’t fit the business category, reveals someone who doesn’t understand ordinary spending patterns.
- Missing standard codes. Legitimate direct deposits from employers and government agencies carry standardized descriptions, often including identifiable company names and consistent formatting. Vague labels like “DEPOSIT” or “TRANSFER” where you’d expect an employer’s name can signal fabrication.
Verify the Statement With the Bank
Visual inspection and math checks raise suspicion. Only the issuing bank can confirm whether a statement is genuine. Before you call, gather:
- The account holder’s full legal name, matched to a government-issued ID rather than to what’s printed on the statement.
- The account number, or at minimum the last four digits shown on the statement.
- The exact statement period dates. Banks track records by specific monthly or quarterly cycles.
- The bank’s fraud or verification contact information, found on the institution’s official website. Never use the phone number printed on the suspect statement. Forgers sometimes replace it with their own number to intercept verification calls.
Fannie Mae Form 1006
Mortgage lenders and other financial professionals use the Request for Verification of Deposit (Fannie Mae Form 1006) to confirm account balances and history directly with the bank. You fill in the applicant’s information and send the form to the bank, which completes it and returns it directly to you. The applicant never handles the completed form, which keeps them out of the loop and prevents tampering.1Fannie Mae. Verification of Deposits and Assets
You can submit the form through a bank’s secure online portal, by fax, or by certified mail. Some institutions also allow phone-based verification, though this typically requires a signed authorization from the account holder permitting the bank to release account details.2United States Department of Justice Archives. Customer Consent and Authorization for Access to Financial Records Processing usually takes a few business days. The bank returns the form indicating whether the reported information matches its records, or flags the account for internal review if it doesn’t.
Cross-Check the Income Independently
Even a technically genuine statement can carry inflated deposits if the applicant controls the account. Independent income sources close that gap.
IRS Tax Transcripts
The IRS Income Verification Express Service (IVES) lets authorized lenders request a borrower’s tax records, with the borrower’s consent, using Form 4506-C.3Internal Revenue Service. Income Verification Express Service (IVES) The transcript can include line items from filed returns, wage and income data from W-2s and 1099s, and account status information.
If a bank statement shows monthly deposits totaling $8,000 but the W-2 transcript reports annual wages of $48,000, the numbers don’t align. Because transcripts come directly from the IRS, a forger cannot alter them.
Payroll Clearinghouses
Some lenders use independent clearinghouses that collect employment and income data directly from employers and payroll processors. The Work Number, operated by Equifax Workforce Solutions, is one example. Lenders, government agencies, and other authorized parties can access this data to confirm income claims independently of any documents the applicant provides.4Consumer Financial Protection Bureau. The Work Number Cross-referencing a statement’s deposit history against payroll data will quickly expose fabricated income entries.
Skip the PDF Entirely
Rather than reviewing a PDF the applicant provides, a growing number of lenders and landlords pull account data directly through digital account-linking services. These services use bank APIs to retrieve transaction history, balances, and account ownership details straight from the bank’s systems. The data never passes through the applicant’s hands, so there’s no opportunity to alter it.
Account-linking services can return routing and account numbers, confirm that an account is open and active, verify that the account holder’s name matches, and provide up to 24 months of categorized transactions. Under the CFPB’s Personal Financial Data Rights rule, the largest banks and financial institutions, those with at least $250 billion in total assets, must begin complying with new data-sharing requirements by April 1, 2026, with smaller institutions following on later dates.5Consumer Financial Protection Bureau. Section 1033.121 – Compliance Dates Direct digital verification will become more widely available as the rule takes effect.
What the Submitter Risks
Understanding the criminal exposure on the other side matters for two reasons. It tells you why the stakes justify a real verification effort, and it tells you what to preserve if you decide to report.
Making a false statement to influence a federally insured bank, credit union, or mortgage lender on a loan or credit application is punishable by a fine of up to $1,000,000, up to 30 years in prison, or both.6Office of the Law Revision Counsel. 18 USC 1014 – Loan and Credit Applications Generally A separate bank fraud statute targeting schemes to defraud a financial institution carries the same maximum penalty, and prosecutors often charge both.7Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud
When the forged statement is emailed or uploaded, wire fraud charges can apply. The baseline is up to 20 years; if the scheme affects a financial institution, the ceiling rises to 30 years and a $1,000,000 fine.8Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television If the forgery uses another person’s name or account number without authorization, aggravated identity theft adds a mandatory two-year sentence that must run consecutively to the underlying fraud sentence.9Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft Most states separately criminalize forgery, fraud, and criminal simulation, with penalties depending on the state and the dollar amount involved.
What to Do Once You’ve Confirmed a Fake
Your next step depends on your role.
If you’re a bank or other financial institution and the suspicious document involves $5,000 or more in funds, federal regulations require you to file a Suspicious Activity Report (SAR) with FinCEN within 30 calendar days of detecting the suspicious activity. If you haven’t identified a suspect, you may take an additional 30 days, with a 60-day outside limit. Violations requiring immediate attention, such as an ongoing scheme, also require notifying law enforcement by phone right away.10eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
If you’re a landlord, employer, or other non-bank entity, SAR rules don’t apply to you, but you can still act. Deny the application based on the failed verification. Report the fraud to the FBI’s Internet Crime Complaint Center at ic3.gov, particularly if the forged document was transmitted electronically.11Federal Bureau of Investigation. Common Frauds and Scams Contact local law enforcement to file a report, which creates a record that may help if the same person targets other victims.
Whatever your role, preserve everything: the suspect statement, your communications with the applicant, verification records, and notes on what triggered your suspicion. If the case leads to prosecution, those records become evidence. Don’t confront the applicant before speaking with law enforcement.