Services

Copy page

Document Forensics

Detect document tampering, forgery, and manipulation using AI-powered forensic analysis with 15+ detection techniques.

Overview

The Document Forensics service provides comprehensive forensic analysis to detect tampered, forged, or AI-generated documents. Using advanced techniques including Error Level Analysis (ELA), noise analysis, clone detection, metadata inspection, and AI detection, the service identifies manipulation signs in identity documents, payslips, utility bills, and business registration documents.

Base Path: /v1/forensics

Key Features

• Tampering Detection - Error Level Analysis, noise analysis, clone detection
• Metadata Analysis - Software detection (Photoshop, GIMP), date manipulation
• AI Generation Detection - Identify AI-generated or deepfake documents
• Template Validation - Verify documents match expected formats
• Digital Signature Verification - Check PDF signatures and trust levels
• Document-Specific Analysis - Specialized checks for IDs, payslips, bills, business docs
• Fraud Scoring - Unified fraud score with PASS/MANUAL_REVIEW/REJECT decisions

Supported File Formats

• Images: JPEG, JPG, PNG, TIFF, WebP
• Documents: PDF (single and multi-page)
• Max file size: 10MB per file

---

API Endpoints

Full Forensic Analysis

Comprehensive document forensic analysis with all available detection techniques.

Endpoint: POST /v1/forensics/analyze

Request:

Code
 
curl -X POST https://api.botskyc.com/v1/forensics/analyze \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "[email protected]"

Query Parameters:

Param	Type	Default	Description
mode	string	full	Analysis mode: full or quick
document_type	string	unknown	Hint: identity, income, address, business

Response:

Code
 
{
  "format_detected": "pdf",
  "original_filename": "payslip.pdf",
  "file_size_bytes": 245678,
  "document_type": "income",
  "tampering_likelihood": 0.15,
  "tampering_level": "LOW",
  "confidence": 0.92,
  "findings": [
    {
      "check": "metadata_analysis",
      "result": "PASS",
      "details": "No suspicious metadata found",
      "severity": "LOW"
    },
    {
      "check": "ela_analysis",
      "result": "PASS",
      "details": "Error levels consistent across document",
      "severity": "LOW"
    },
    {
      "check": "font_consistency",
      "result": "WARNING",
      "details": "Minor font inconsistency detected in salary field",
      "severity": "MEDIUM",
      "region": { "x": 150, "y": 280, "width": 200, "height": 30 }
    }
  ],
  "metadata": {
    "software": "Microsoft Word",
    "create_date": "2025-12-01T10:00:00Z",
    "modify_date": "2025-12-01T10:05:00Z"
  },
  "ela_result": {
    "anomaly_score": 0.12,
    "suspicious_regions_count": 0
  },
  "noise_result": {
    "consistency_score": 0.95
  },
  "clone_result": {
    "clones_detected": false,
    "clone_pairs": 0
  },
  "ai_generated": {
    "ai_probability": 0.02,
    "suspected_generator": null
  },
  "fraud_score": {
    "total_score": 15,
    "normalized_score": 0.15,
    "decision": "PASS",
    "signals_triggered": 1
  },
  "recommendations": [
    "Document appears authentic with minor anomalies",
    "Consider reviewing font inconsistency in salary area"
  ],
  "processing_time_ms": 3200,
  "timestamp": "2026-02-06T10:30:00Z"
}

---

Quick Forensic Check

Fast metadata-only analysis for common tampering signs. Use for high-volume screening.

Endpoint: POST /v1/forensics/quick

Request:

Code
 
curl -X POST https://api.botskyc.com/v1/forensics/quick \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "[email protected]"

Response:

Code
 
{
  "format_detected": "pdf",
  "tampering_likelihood": 0.85,
  "tampering_level": "HIGH",
  "confidence": 0.88,
  "findings": [
    {
      "check": "software_detection",
      "result": "FAIL",
      "details": "Document created with Adobe Photoshop CC 2024",
      "severity": "HIGH"
    },
    {
      "check": "metadata_dates",
      "result": "WARNING",
      "details": "Creation date modified after original save",
      "severity": "MEDIUM"
    }
  ],
  "metadata": {
    "software": "Adobe Photoshop CC 2024",
    "create_date": "2025-11-15T14:00:00Z",
    "modify_date": "2025-12-01T09:30:00Z"
  },
  "fraud_score": {
    "normalized_score": 0.85,
    "decision": "REJECT"
  },
  "processing_time_ms": 450
}

Quick vs Full Analysis:

Feature	Quick	Full
Metadata analysis	✅	✅
Software detection	✅	✅
Error Level Analysis	❌	✅
Noise analysis	❌	✅
Clone detection	❌	✅
AI generation check	❌	✅
Template validation	❌	✅
Digital signatures	❌	✅
Processing time	~0.5s	~3-5s
Cost	Lower	Higher

---

ID Forensics - Detect Tampered IDs

Specialized forensic analysis for identity documents (Omang, Passport, Driver's License).

Endpoint: POST /v1/forensics/identity

Request:

Code
 
curl -X POST https://api.botskyc.com/v1/forensics/identity \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "[email protected]"

Additional Checks for Identity Documents:

• MRZ (Machine Readable Zone) validation
• ID format validation against known templates
• Photo area tampering detection
• Security feature verification (microprint, watermarks)
• Font consistency across fields
• Ghost layer detection

---

Income Forensics - Detect Altered Payslips

Specialized forensic analysis for income documents (payslips, tax returns, bank statements).

Endpoint: POST /v1/forensics/income

Request:

Code
 
curl -X POST https://api.botskyc.com/v1/forensics/income \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "[email protected]"

Additional Checks for Income Documents:

• Salary figure manipulation detection
• Benford's Law analysis on numerical data
• Date chronology validation
• Employer details consistency
• Tax calculation verification
• Font and alignment analysis in amount fields

---

Address Forensics - Detect Altered Bills

Specialized forensic analysis for address proof documents (utility bills, bank statements).

Endpoint: POST /v1/forensics/address

Request:

Code
 
curl -X POST https://api.botskyc.com/v1/forensics/address \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "[email protected]"

Additional Checks for Address Documents:

• Address field tampering detection
• Billing period consistency
• Account number format validation
• Provider logo and branding verification
• Date manipulation detection

---

Business Forensics - Detect Altered Registration Docs

Specialized forensic analysis for business registration documents and CIPA certificates.

Endpoint: POST /v1/forensics/business

Request:

Code
 
curl -X POST https://api.botskyc.com/v1/forensics/business \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "[email protected]"

Additional Checks for Business Documents:

• Registration number format validation
• Official stamp/seal verification
• Director name consistency
• BIN certificate template matching
• CIPA document format validation

---

Service Health

Check forensics service health status.

Endpoint: GET /v1/forensics/health

Code
 
curl https://api.botskyc.com/v1/forensics/health

Response:

Code
 
{
  "status": "healthy",
  "service": "forensics-api",
  "version": "1.0.0"
}

---

Supported Formats

Get list of supported file formats and analysis techniques.

Endpoint: GET /v1/forensics/formats

Code
 
curl https://api.botskyc.com/v1/forensics/formats \
  -H "Authorization: Bearer YOUR_API_KEY"

Response:

Code
 
{
  "formats": ["pdf", "jpeg", "jpg", "png", "tiff", "webp"],
  "max_file_size_mb": 10,
  "analysis_techniques": [
    "metadata_analysis",
    "error_level_analysis",
    "noise_analysis",
    "clone_detection",
    "font_consistency",
    "template_validation",
    "digital_signature",
    "ai_detection",
    "camera_fingerprint",
    "text_skew_analysis",
    "security_features",
    "benford_law",
    "structural_analysis",
    "semantic_analysis",
    "vision_api"
  ]
}

---

Fraud Score Decision Matrix

The forensics service returns a unified fraud score with automated decisions:

Score Range	Decision	Tampering Level	Recommended Action
0-20	PASS	UNLIKELY / LOW	Accept document
21-50	MANUAL_REVIEW	LOW / MODERATE	Flag for human review
51-100	REJECT	HIGH / VERY_HIGH	Reject and request new document

---

Integration Workflow

Pre-Verification Forensics

Run forensics before document verification to catch fraud early:

Code
 
async function verifyWithForensics(documentFile, documentType) {
  const apiKey = process.env.BOTSKYC_API_KEY;

  // Step 1: Run forensics check first
  const forensicsForm = new FormData();
  forensicsForm.append('file', documentFile);

  const forensicsResponse = await fetch(
    `https://api.botskyc.com/v1/forensics/${documentType}`,
    {
      method: 'POST',
      headers: { 'Authorization': `Bearer ${apiKey}` },
      body: forensicsForm
    }
  );

  const forensics = await forensicsResponse.json();

  // Step 2: Check fraud score
  if (forensics.fraud_score.decision === 'REJECT') {
    return {
      verified: false,
      reason: 'Document appears to be tampered or forged',
      forensicsResult: forensics
    };
  }

  // Step 3: If forensics passes, proceed with verification
  const scanForm = new FormData();
  scanForm.append('documents', documentFile);

  const verifyEndpoint = documentType === 'identity'
    ? '/v1/identity/scan'
    : documentType === 'income'
    ? '/v1/documents/income/scan'
    : documentType === 'address'
    ? '/v1/documents/address/scan'
    : '/v1/documents/scan';

  const verifyResponse = await fetch(
    `https://api.botskyc.com${verifyEndpoint}`,
    {
      method: 'POST',
      headers: { 'Authorization': `Bearer ${apiKey}` },
      body: scanForm
    }
  );

  const verification = await verifyResponse.json();

  return {
    verified: true,
    forensics: forensics,
    verification: verification,
    needsReview: forensics.fraud_score.decision === 'MANUAL_REVIEW'
  };
}

// Usage
const result = await verifyWithForensics(payslipFile, 'income');
if (result.needsReview) {
  console.log('Document flagged for manual review:', result.forensics.findings);
}

Python Example

Code
 
import requests
import os

def analyze_document(file_path, doc_type='identity'):
    api_key = os.getenv('BOTSKYC_API_KEY')

    with open(file_path, 'rb') as f:
        response = requests.post(
            f'https://api.botskyc.com/v1/forensics/{doc_type}',
            headers={'Authorization': f'Bearer {api_key}'},
            files={'file': f}
        )

    response.raise_for_status()
    result = response.json()

    print(f"Tampering Level: {result['tampering_level']}")
    print(f"Fraud Score: {result['fraud_score']['normalized_score']}")
    print(f"Decision: {result['fraud_score']['decision']}")

    for finding in result['findings']:
        if finding['severity'] in ['HIGH', 'CRITICAL']:
            print(f"⚠️ {finding['check']}: {finding['details']}")

    return result

# Usage
result = analyze_document('payslip.pdf', 'income')

---

Analysis Techniques

Technique	Description	What It Detects
Error Level Analysis	Compares JPEG compression levels	Pasted or edited regions
Noise Analysis	Checks noise consistency	Spliced or composited areas
Clone Detection	Finds duplicated regions	Copy-paste tampering
Metadata Analysis	Inspects EXIF/PDF metadata	Editing software, date changes
Font Consistency	Analyzes text rendering	Altered text fields
Template Validation	Matches against known formats	Fraudulent document layouts
Digital Signature	Verifies PDF signatures	Signature tampering
AI Detection	Detects AI-generated content	Deepfakes, synthetic docs
Camera Fingerprint	Checks JPEG compression patterns	Double compression
Benford's Law	Statistical analysis of numbers	Fabricated financial data
Text Skew	Analyzes text alignment	Cut-and-paste text
Security Features	Checks microprint/watermarks	Missing security elements
Structural Analysis	Ghost layers, wobbly text	Digital editing artifacts
Semantic Analysis	Date/number logic checks	Illogical data patterns

---

Error Codes

Code	Status	Message	Resolution
200	Success	Analysis completed	-
400	Bad Request	Invalid file or unsupported format	Check file type (JPEG, PNG, PDF)
401	Unauthorized	Invalid API key	Check your API key
413	Too Large	File exceeds maximum size	Reduce file size (max 10MB)
429	Too Many Requests	Rate limit exceeded	Implement backoff
500	Server Error	Analysis failed	Contact support

---

Pricing

Service	Price per Request
Quick Check	BWP 3-5
Full Analysis	BWP 8-12
Specialized (ID/Income/Address/Business)	BWP 5-8

Volume discounts available. Contact [email protected].

---

Support

• Email: [email protected]
• API Reference: Full API Docs
• Supported Formats: Call GET /v1/forensics/formats

---

Related Documentation:

• Identity Verification
• Document Processing
• Risk & Compliance
• Error Handling