Loupe / Every check
Document fraud checks: Every check Loupe makes, and what your team reads when one fails.
In short Loupe runs every one of these checks on every document, with nothing to switch on. When a check finds something, your team reads the reason in plain words, with the page and the spot it applies to. Every result also lists what the file says about itself, and whether each of those facts made Loupe more or less concerned.
01 · Figures
Every sum on the page has to work.
Loupe reads the figures from text and from scans, and works through them the way an accountant would.
| What Loupe checks | What your team reads if it fails |
|---|---|
| Pay less deductions equals net pay | Net pay is £400.00 more than gross pay less deductions. |
| Year-to-date figures follow from this period | Taxable pay to date doesn’t equal last month’s figure plus this month’s. |
| Running balances on a statement | The balance after 14 October doesn’t follow from the balance before it and the payment. |
| Opening and closing balances | The closing balance doesn’t equal the opening balance plus money in less money out. |
| Statement totals | Total paid in doesn’t match the payments listed. |
| Invoice and bill line totals | Line 3 is 4 × £12.50 but shows £60.00. |
| VAT at the stated rate | VAT of £184.00 isn’t 20% of the £820.00 subtotal. |
| Meter readings follow on | This reading is lower than the previous one on the same bill. |
02 · Words on the page
A changed word rarely matches its neighbours.
Each word is compared with those around it, whether it came from the file’s text or was read from a scan.
| What Loupe checks | What your team reads if it fails |
|---|---|
| Typeface, size and weight within a line | The amount “3,237.60” is set in a different typeface from the rest of the line. |
| Spacing, sharpness and position | This word sits off the line its neighbours share. |
| Text hidden under a box | A white box covers text that is still in the file: underneath it reads “2,837.60”. |
| Text hidden under a pasted picture | A picture pasted onto page 1 covers text that is still in the file: underneath it reads “1,250.00”. |
| Notes typed over the page | “£4,250.00” was typed over “£1,250.00” as a note on top of the document. |
| Text no one can see | Text that can’t be seen reads “£1,250.00” where the page shows “£4,250.00”. |
| A scan’s searchable text against the page | The page shows “8.59” where the file’s searchable text says “6.59”. |
| Fonts swapped in a later edit | A font was replaced after the file was first saved. |
| Fonts that don’t belong | One figure uses a font no other text on the page uses. |
| Fonts not built into the file | The file relies on a font it doesn’t carry, which documents from an issuer’s own system rarely do. |
03 · The pages
Every page of a genuine document was made the same way.
Paper, light, grain and sharpness should match from page to page and across each page.
| What Loupe checks | What your team reads if it fails |
|---|---|
| A page unlike the others | Page 2 was captured differently from pages 1 and 3: its grain and darkness don’t match. |
| A patch unlike the rest of its page | The area around the net pay figure has different noise from the rest of the page. |
| The same page used twice | Page 3 of this statement is the same image as page 1 of another document in the pack. |
04 · The file’s history
A PDF remembers what was done to it.
Loupe reads every saved version inside the file, and what made and changed it.
| What Loupe checks | What your team reads if it fails |
|---|---|
| Edits added after the first save | The file was saved 2 more times after it was made. The last save rewrote the text on page 1. |
| Content added in a later version | Something was added to page 1 after the file was first saved. |
| What a figure said before it was changed | On page 1, “£1,250.00” was changed to “£4,250.00” after the file was first saved. |
| Pages added or taken out | The file had 3 pages when it was first saved and now has 2. |
| Saved again after it was made | The file was changed on 4 October, two days after it was created. |
| Made or saved with editing software | This bank statement was made or saved with a PDF editor. Banks issue statements from their own systems. |
| Saved by different software from the one that made it | The file was made by one program and saved again by another. |
| Records that disagree with each other | The file’s two records of the software that made it disagree. |
| Made before the dates printed in it | The file was made on 1 March, before 31 March, a date printed in it. |
| Changed after it was signed | The file was changed after it was digitally signed. |
| A signature that doesn’t cover the whole file | The signature doesn’t cover the whole of the file it was made for. |
| Software or fonts newer than the file | The file says it was made on 1 March 2023, but it was written by software that came out in September 2023. |
| Printed from a web page | This payslip was printed from a web page, not issued as a document of its own. |
| One font added twice | Page 1 holds two separate copies of the font Arial, as when text is added in a later edit. |
| Saved again in full | The file’s identifiers show it was saved again after it was first made. |
05 · Photos and scans
A photo carries a record of how it was taken.
Phone photos and scanned images keep details that an edit usually disturbs.
| What Loupe checks | What your team reads if it fails |
|---|---|
| Edited in image software | The image was saved by a photo editor. |
| Changed after it was taken | The image was changed on 6 October, three days after it was taken. |
| A stored preview that doesn’t match | The small preview stored inside the image shows something different from the image itself. |
| A camera photo saved again | The photo says it was taken on a phone, but it was saved again afterwards by other software. |
| Pages taken on different devices | Page 1 was taken with one phone and page 2 with another. |
| A page scanned differently | Page 2 was scanned at about 120 dots per inch and the other pages at about 200. |
| A screenshot instead of the document | This bank statement is a screenshot rather than the document itself. |
| The device, time and place recorded | Listed with the result, so your team can see where and when it was taken. |
06 · Word, Excel and email
Word files, spreadsheets and emails keep their own records.
Loupe reads who made them, how they were changed and, for an email, when it really travelled.
| What Loupe checks | What your team reads if it fails |
|---|---|
| A statement or payslip sent as a Word or Excel file | This bank statement is a Word document. Banks issue statements from their own systems. |
| Made from a ready-made template | This payslip was made from a ready-made template, not issued from a payroll system. |
| Changes the file still records | The file still records a change made on 2 December: “2,630.95” was replaced with “3,630.95”. |
| A figure typed at a different sitting | “9,250.00” was typed in a different editing session from the document’s other figures. |
| A figure typed over a formula | In the sheet “Statement”, B4 holds 4,300.00 typed in by hand, where the figures above and below it are worked out by formula. |
| An email changed after it was sent | The email’s text no longer matches the signature the sender’s mail server added when it was sent. |
| Dates the mail servers don’t back up | The email says it was sent on 3 September, but the first mail server received it on 3 October. |
| A sender the receiving server doubted | When this email arrived, the receiving mail server found it didn’t come from the domain it names. |
| A reply quoting a later message | This email quotes a message dated 12 October, after it was itself sent on 3 October. |
| An attachment made after it was sent | This file says it was made on 12 October, after the email it came with was sent on 3 October. |
| A ZIP holding an older copy | The file says it was made on 12 October, but the copy in the ZIP was last changed on 2 October. |
| Who made it, who saved it last and how long it was edited for | Listed with the result, with the template it came from and how many times it was saved. |
07 · Made from scratch, or by AI
A document nobody issued gives itself away differently.
There’s no edit to find in a document generated whole, so Loupe looks for what a real issuer would never produce.
| What Loupe checks | What your team reads if it fails |
|---|---|
| Generated by an AI tool | This page shows the marks of an image generator rather than a printer, scanner or camera. |
| Labelled as made by AI | The file’s Content Credentials say the picture was made by AI, with ChatGPT. |
| An AI generator’s prompt left in the file | The file carries the prompt and settings of Stable Diffusion, which makes pictures with AI. |
| The hidden watermark some AI tools add | The picture carries the hidden watermark that Stable Diffusion XL adds to the pictures it makes. |
| References that can’t exist | The National Insurance number isn’t one that can ever be issued. |
| Dates that can’t be right | A payment is dated 31 September. |
08 · Copied and pasted
A figure lifted from elsewhere still carries where it came from.
Loupe looks for parts of a page copied from somewhere else on it, or pasted in from another image.
| What Loupe checks | What your team reads if it fails |
|---|---|
| An area copied within the page | The figure in the total column is a copy of one higher up the same page. |
| Something pasted in from another image | The signature and stamp were pasted in from a different image. |
| Text rubbed out and typed again | This area has been whited out: it has none of the paper texture around it. |
| Where on the page | Every result shows the page with the areas Loupe is concerned about marked. |
09 · Reference numbers
A made-up number usually fails its own check digits.
Tax, payroll, VAT and bank references are checked for their shape and, where they have one, their check digit.
| What Loupe checks | What your team reads if it fails |
|---|---|
| Tax and payroll references | The tax reference on this payslip isn’t a number that can exist. |
| VAT numbers | The VAT number fails its check digits. |
| Sort codes, account numbers and IBANs | The IBAN fails its check digits. |
| An IBAN for a different account | The IBAN holds the sort code 12-34-56, but the sort code printed is 65-43-21. |
| Driving licence numbers | The driving licence number is for someone born on 11 March 1976, but the date of birth printed is 11 May 1976. |
| Electricity supply numbers | The supply number on this bill fails its check digit. |
10 · Dates
A real issuer’s dates fit the calendar.
Pay dates, tax months and salary payments are checked against the tax year and the days banks are open.
| What Loupe checks | What your team reads if it fails |
|---|---|
| A weekday that doesn’t fit its date | The letter is dated Thursday 30 January 2026, but that was a Friday. |
| The tax month against the pay date | The pay date 31 October 2025 falls in tax month 7, but the payslip says month 10. |
| Pay on a bank holiday | The pay date 25 December 2025 is Christmas Day, when banks don’t pay salaries. |
| A salary paid in when banks are closed | The salary of £2,630.95 is dated 25 August 2025, the summer bank holiday. |
| Pay below the minimum wage | Gross pay of £800.00 for 160 hours is £5.00 an hour, below the lowest minimum wage at the time. |
11 · Across the pack
Documents from one person should agree with each other.
When several documents arrive together, Loupe compares what each one says.
| What Loupe checks | What your team reads if it fails |
|---|---|
| The same person’s reference numbers | The payslip and the year-end tax summary give different tax ID numbers for the same person. |
| Pay between documents | Salary on the October payslip doesn’t match the employer’s letter. |
| Pay to date from one payslip to the next | The February payslip’s pay to date is £300.00 short of January’s plus February’s own. |
| Statements that follow on | The April statement opens with £2,480.10, but March’s closed with £480.10. |
| Statement numbers in order | The statement after number 41 is numbered 45. |
| A P60 against the last payslip of the year | The P60 shows £6,123.40 of tax for the year, but the March payslip shows £6,523.40. |
| A page reused in another document | This page also appears in statement-sep.pdf. |
| The same file sent twice | payslip-aug.pdf and payslip-aug(1).pdf are the same file. |
12 · Across applications
The same document turning up for two different people.
Loupe remembers what it has seen for your organisation, for as long as your retention rules allow.
| What Loupe checks | What your team reads if it fails |
|---|---|
| A document used in an earlier application | This payslip was also sent with an application in March, under a different name. |
| The same template with the figures changed | This statement matches one seen last month, with only the amounts different. |
13 · What the file declares
Every result lists what the file says about itself.
Software, dates, saved versions, signatures, device and place, each marked as raising concern or not.
| What Loupe checks | What your team reads if it fails |
|---|---|
| Made by, and saved by | Shown on every result, with whether it raised concern. |
| Created, changed and how many times saved | Shown on every result, with the dates and the saved versions found. |
| Fonts, signatures and what they cover | Shown on every result. |
| For photos: device, time taken, place and editing software | Shown on every result. |
Bring a document you weren’t sure about, and we’ll run it through with you.
It’s £1 for each document checked. Bring a few you weren’t sure about to a walkthrough and we’ll go through them with you.