Skip to content

Document and image forensics are part of ZOREAL VerifyExplore Verify

Document forensics in ZOREAL Verify

Document fraud detection. Understand the evidence. Automate the work around it.

Bynn identifies signs of altered, fabricated and AI-generated evidence, from financial documents to images submitted with a claim, and automates the work of collecting it.

Revisions2, the last after issueSaved withan image editor
InvoiceINV-20418
Halvorsen Joinery
Clear: Logo unchanged
Description
Amount
Kitchen cabinet repair
1,240.00
Worktop replacement
960.00
Labour, 6 hours
540.00
Finding: Lines add up to 2,740.00
Total due4,860.00
Finding: Total set in a different font

Digitally signed, 3 September 2026

Finding: Changed after signing

Payment within 30 days of the invoice date. Thank you for your business.

ZOREAL Verify: Authenticity reportINV-20418.pdf

Signs of tampering5 findings · 1 clear

  1. Finding: Update appended after issueFile structure
  2. Finding: Last saved by an image editorMetadata
  3. Clear: Logo unchangedEmbedded images
  4. Finding: Lines add up to 2,740.00Arithmetic
  5. Finding: Total set in a different fontFonts and layout
  6. Finding: Changed after signingDigital signature

Routed to the fraud team with the findings attached.

Example: a repair invoice submitted with a claim.

A core part of Bynn's research.

Document fraud detection is where Bynn began, and it remains a core part of our AI research and portfolio. Bynn's foundations are in forensic intelligence: understanding how deception works and how to recognize it.

Document forensics, image-authenticity models and agentic fraud reasoning address different parts of the problem. Together with automated collection workflows, they connect the work of obtaining evidence with the work of assessing it.

From a submitted file to findings a reviewer can act on.

A document goes in. ZOREAL Verify examines how it was made, not only what it says, and returns an authenticity report with the reason behind every finding.

In

A repair invoice, submitted with a claim

Halvorsen Joinery

Invoice

INV-20418

Issued 3 September 2026

Kitchen cabinet repair
1,240.00
Worktop replacement
960.00
Labour, 6 hours
540.00
Total due
4,860.00

The total was raised after the invoice was issued. The lines no longer add up, and the file records the change.

ZOREAL Verify

Forensic checks

  1. File structureFindingAn update was appended to the file after it was issued.
  2. MetadataFindingLast saved by an image editor, not the software that created it.
  3. Embedded imagesClearThe supplier logo is unchanged.
  4. ArithmeticFindingThe line items add up to 2,740.00; the total reads 4,860.00.
  5. Fonts and layoutFindingThe total is set in a different font from the line items.
  6. Digital signatureFindingThe content changed after the document was signed.

Out

Authenticity report

Signs of tampering

Five checks found signs the invoice was changed after it was issued. The lines add up to 2,740.00; the total reads 4,860.00.

  • File structureAn update was appended to the file after it was issued.
  • MetadataLast saved by an image editor, not the software that created it.
  • ArithmeticThe line items add up to 2,740.00; the total reads 4,860.00.
  • Fonts and layoutThe total is set in a different font from the line items.
  • Digital signatureThe content changed after the document was signed.

Routed to the fraud team with the findings attached.

Five different problems, not one

Document fraud is a family of techniques. Each leaves different traces, so each needs its own kind of examination.

  • Document tampering

    A genuine document with something changed: an amount, a date, a name. The page still looks right; the file usually does not.

    In a real file: A repair invoice with its total increased after it was issued.

  • Fabricated documents

    A document that never existed, built from a template or generated from scratch to look like a real statement, payslip or certificate.

    In a real file: A bank statement produced from a template bought online.

  • AI-generated images

    Photos created entirely by an image generator, with no camera involved, often without any watermark or metadata to reveal it.

    In a real file: A generated photo of storm damage submitted with a claim.

  • Localized image forgery

    A real photo with one region edited, so that most of the image is authentic and only the detail that matters is not.

    In a real file: A genuine photo of a car with a dent added to one door.

  • Deepfakes

    Faces and voices swapped or synthesized in images, video and audio, used to impersonate a real person.

    In a real file: A video of an applicant whose face has been replaced with someone else's.

How the work is done

Four capabilities, each answering a different question, working in one workflow.

Document forensics

Examines how a document was made, not only what it says. Because the evidence lies in the file's construction, the analysis works across formats and languages.

  • File structure, metadata and the traces left by editing software
  • Fonts, spacing and graphical elements that do not match across fields
  • Embedded digital signatures, and whether content changed after signing
  • Findings with the reasons behind them, for a reviewer to act on

Image-authenticity models

Specialist models that treat generation and editing as separate questions, so a reviewer knows not only that an image is suspicious but why.

  • Fully AI-generated images, detected from the pixels without relying on watermarks
  • Localized edits within an otherwise genuine photo
  • Face swaps in images and video, and synthesized voices in audio

Agentic fraud reasoning

AI reasoning applied to fraud assessment within a wider evidence review. An orchestrator coordinates specialist agents, either in a fixed order or chosen for the evidence in front of it, and brings their findings together.

  • Checks chosen for the type of evidence submitted
  • Findings combined into one assessment with its reasons
  • The plan the orchestrator follows can be reviewed and changed

AI document collection

Obtaining evidence is often slower than assessing it. Collection workflows request what is needed, follow up on what is missing and identify each document as it arrives, across languages.

  • Requests and reminders in the recipient's language
  • Each document identified and its key fields extracted
  • Structured output delivered to the system that needs it
ZOREAL

Document and image forensics, in ZOREAL Verify.

Bynn's document forensics lives in ZOREAL Verify, on the ZOREAL platform. PDFChecker, part of ZOREAL Verify, analyses PDFs and document images and gathers what it finds into an authenticity report.

Detector24's specialist models examine images, video and audio for generation and manipulation, alongside it in the same workflow.

  • Structure

    How the file was built, saved and updated.

  • Metadata

    The software and the times recorded inside the file.

  • Signatures

    Whether signed content changed after signing.

  • Edits

    Traces of changes to text, figures and images.

  • Authenticity report

    Every finding with its reason, for the reviewer.

Bynn's document fraud detection is moving into ZOREAL Verify. Its checks run through Bynn today.

The boundary between ZOREAL Verify and Detector24 is still being defined. Both remain available while it is.

In banking and insurance

An insurance claim

Automating collection reduces administrative work. Detecting suspicious evidence addresses a different cost: losses from invalid, incorrect or fraudulent claims.

  1. Collect

    Invoices, reports and photos are requested from the claimant and followed up automatically.

  2. Examine

    Documents go through forensics; photos through image-authenticity models.

  3. Reason

    Agentic fraud reasoning weighs the findings and routes the claim, with optional human review when an agent is unsure.

Insurance industry

A loan application

Lenders rely on statements, payslips and company records supplied by the applicant. Each can be examined before an underwriter relies on it.

  1. Collect

    Missing statements and records are requested until the application is complete.

  2. Examine

    Each document is checked for edits, reused templates and inconsistencies.

  3. Route

    Clean files go to underwriting; suspicious ones go to the fraud team with the reasons.

Banking industry

Where document fraud detection applies

The same examination, applied wherever a decision rests on documents someone else supplied.

Questions about document fraud detection

  • What is document fraud detection?

    The examination of a document for signs that it was altered, fabricated or generated. Good detection looks at how the file was made as well as what it shows, because the most convincing forgeries look perfect on the page.

  • Which documents can be examined?

    PDFs and document images such as bank statements, payslips, invoices, bills, reports and certificates, along with photos submitted as evidence.

  • Can it detect AI-generated documents and images?

    Yes. Image-authenticity models look for the traces image generators leave, without relying on watermarks or metadata, and document forensics looks for the construction of a fabricated file.

  • Does it replace our fraud investigators?

    No. It examines every document so investigators can focus on the ones that need them, and it gives them specific findings rather than an unexplained score.

  • How does this relate to ZOREAL Verify?

    ZOREAL Verify is where Bynn's document forensics lives within ZOREAL, including PDFChecker. Bynn's document fraud work is moving into ZOREAL Verify, and its checks run through Bynn today.

  • Can collection and detection run in one workflow?

    Yes. Collection, forensics, image analysis and agentic fraud reasoning can run as one autonomous workflow, with human review wherever you want it.

Discuss your workflow.

Show us the documents your teams find hardest to trust and the process around them. We will show you what can be examined and automated.