To verify a bank statement, inspect the document for signs of tampering, audit the arithmetic line by line, and then confirm the balance directly with the issuing bank using a Verification of Deposit, matched monthly statements, or a secure data-aggregator feed. The document check catches obvious forgeries. The direct confirmation catches the clever ones, because the numbers come from the bank rather than from the person asking you to trust them.
Check the Document Before You Trust the Numbers
Start with the typography. A real bank statement uses one typeface, consistent character spacing, and tidy column alignment from the first page to the last. When someone edits a PDF in a consumer tool, the replacement text rarely matches perfectly. Look for letters sitting slightly above or below the baseline, subtle shifts in font weight, and columns in the transaction history that have drifted out of alignment. These are the fingerprints of a cheap edit.
Logos are the next quick tell. Banks produce statements with sharp, high-resolution branding in their exact institutional colors. A blurry, pixelated, or stretched logo suggests someone pulled an image off a website and dropped it into a fabricated document. Compare it against current materials on the bank’s own site if anything looks off.
Then do the math. Add every deposit, subtract every withdrawal from the opening balance, and compare your total to the stated ending balance. The numbers should match to the penny. Forgers who insert or delete transactions routinely forget to update the summary line, and a one-cent discrepancy means something was changed after the bank generated the document. This is the single most decisive check you can run without contacting anyone.
Watch for Transaction Patterns That Signal Fabrication
A document can look clean and still describe activity that never really happened. The classic scheme is the circular transfer: money moves from Account A to Account B, then back to A in roughly equal amounts, sometimes routed through a third account to disguise the loop. The point is to inflate the apparent balance or revenue without any real money changing hands. Look for deposits and withdrawals of identical or near-identical amounts involving the same counterparty inside a short window.
The other common tactic is the temporary cash injection. A large sum lands in the account just before the statement period, creates a healthy-looking snapshot, and then leaves immediately after. Unusually round figures, suspiciously flat balances, and a sudden spike in deposits right before an application date all deserve a second look.
If you’re underwriting to Fannie Mae guidelines, any single deposit greater than 50 percent of the borrower’s total monthly qualifying income counts as a “large deposit” and requires documentation of its source. When a deposit has both documented and undocumented portions, only the unsourced amount is measured against the 50 percent threshold. Accounts opened within 90 days of the application date carry their own sourcing requirements regardless of deposit size.1Fannie Mae. Depository Accounts Acceptable sourcing documentation includes items like a gift letter, a sale contract, or tax refund paperwork.
Confirm the Balance With the Bank Directly
The most reliable confirmation is one the account holder never touches. The Verification of Deposit, Fannie Mae Form 1006, is designed for exactly this: the lender sends the form directly to the bank, and the bank returns the completed form directly to the lender.2Fannie Mae. Verification of Deposit Form 1006 The applicant has no opportunity to alter the data in transit.
Before you send the form, collect the account holder’s full legal name, the exact account number, and the bank’s routing or branch information. The applicant must sign the authorization section of Form 1006, because without that signature the bank will refuse the request. This is a Gramm-Leach-Bliley requirement: under 15 U.S.C. ยง 6802, a financial institution cannot share a customer’s nonpublic personal information with a nonaffiliated third party unless the customer has been given notice and an opportunity to authorize or opt out.3Office of the Law Revision Counsel. 15 U.S. Code 6802 – Obligations With Respect to Disclosures of Personal Information Most institutions accept VOD requests through secure fax, encrypted email, or a dedicated verification portal.
The bank fills in the current balance and related account details and returns the form. Processing typically takes two to five business days, and most banks charge a fee. One caveat: if you rely on a VOD without accompanying bank statements showing recent activity, you must independently verify the source of funds for any account opened in the last 90 days and for any balance significantly larger than the average balance shown on the form.1Fannie Mae. Depository Accounts
Working From the Statements Themselves
Many lenders skip the VOD and work from the borrower’s actual bank statements. Fannie Mae’s Desktop Underwriter accepts two consecutive monthly statements covering 60 days of account activity for purchase transactions, or one monthly statement covering 30 days for refinances. Monthly statements must be dated within 45 days of the loan application, and quarterly statements within 90 days.4Fannie Mae. Requirements for Certain Assets in DU
The trade-off is straightforward. Statements show the actual transaction history, which is where you spot circular transfers and temporary injections. A VOD confirms the balance but typically doesn’t include that transaction-level detail. On the other hand, statements come from the applicant and could have been altered before you ever see them; a VOD comes straight from the bank. Many underwriters use both: statements for the transaction review, and a VOD to confirm the bottom-line numbers independently. Either method satisfies Fannie Mae requirements on its own.4Fannie Mae. Requirements for Certain Assets in DU
Electronic Verification Through Data Aggregators
Services like Plaid and Finicity connect directly to the bank’s systems through an API. The applicant logs into their bank through the aggregator’s interface, and transaction data and balances flow in real time from the bank’s servers. Because the data never passes through a PDF the applicant could edit, the risk of document manipulation drops to essentially zero, and the lender receives a formatted report within seconds.
The rules governing this access are changing. The CFPB’s Personal Financial Data Rights rule, which implements Section 1033 of the Consumer Financial Protection Act, requires the largest financial institutions to make account data available through secure digital interfaces that authorized third parties can access via APIs starting April 1, 2026. Smaller institutions have staggered compliance deadlines running out to 2030, and banks cannot charge for providing this access.5Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services
The same rule puts limits on how long your access lasts. When a consumer revokes access, the data connection must end immediately, and deletion of their data becomes the default. Authorizations expire automatically after one year unless the consumer expressly reauthorizes, and the revocation process has to be straightforward.5Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services If you’re the party relying on aggregator data, your window to pull it depends on whether the consumer has revoked or allowed the one-year clock to run out.
If the Funds Come From Outside the United States
Foreign assets add steps. Fannie Mae requires that documents of foreign origin be in English or arrive with a complete and accurate translation attached to the original. The lender must also document that the foreign assets were converted into U.S. dollars and deposited into a U.S. or state-regulated financial institution, with the dollar-denominated funds verified before the loan closes.6Fannie Mae. Foreign Assets Expect the process to take noticeably longer than domestic verification, and budget time for translation and currency-conversion paperwork. Large international deposits may also pull in anti-money-laundering due diligence, including identification of beneficial owners and documentation of the source of funds for higher-risk accounts.7FINRA. Frequently Asked Questions Regarding Anti-Money Laundering
What Falsified Statements Cost the Person Who Submits Them
The reason verification procedures exist is that submitting a doctored statement is a federal crime. Executing or attempting to execute a scheme to defraud a financial institution, or to obtain money from one through false representations, carries a maximum penalty of a $1,000,000 fine, up to 30 years in prison, or both.8Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud Prosecutors don’t have to prove the fraud succeeded; the attempt carries the same maximum.
Even where the dollars are too small to attract federal prosecution, submitting falsified financial documents will usually mean immediate denial of the application, termination of any existing business relationship, and a Suspicious Activity Report filed with the Financial Crimes Enforcement Network. That report follows the individual and can complicate future banking for years. Catching these attempts early, with the checks above, is exactly what the whole verification process is built to do.