Document Tampering: Name and Date Swaps on Genuine Files

The most common form of document tampering is not a forged document: it is a genuine one with a few fields changed, usually the holder's name and one or two dates. The issuer's layout, logo, fonts and account numbers are all real, which is why a visual check passes and why the alteration is found by comparing the file against other documents and official records.

This guide describes how name and date swaps work, which documents they target, which checks expose them, and what Australian law and AUSTRAC expect. It is written for compliance, lending, HR and onboarding teams that receive files as PDFs or phone photos.

What a name and date swap is

A name and date swap replaces the identity or period printed on an authentic document while keeping everything else intact. The person doing it starts from a real payslip, utility bill, bank statement or certificate, often their own from a different period or someone else's, and edits the fields that decide whether it is accepted.

Two variants dominate:

• Name swap: a real document belonging to a third party (a relative, a former housemate, a colleague) is re-labelled with the applicant's name.
• Date swap: the applicant's own genuine document is moved forward so that an expired or too-old proof appears current, for example a four-month-old electricity bill presented as last month's.

Both are cheap. A PDF editor or a photo app is enough, and no template has to be reproduced. That is why this pattern is far more common than fully fabricated documents in the files reviewers describe on professional forums.

Why genuine documents are the preferred base

Genuine documents are preferred because they carry authentic details that a forger would otherwise have to invent. BSB and account numbers, barcodes, address formats, employer names and totals are already correct. The forger only has to touch a few pixels or text objects.

The documents most often reworked

Proof of address, payslips and bank statements are the documents most often reworked, because they are the ones accepted with the least verification. Government-issued photo ID is harder to alter and is checked more often against a security feature or database.

For payslips, the interplay between gross pay, PAYG withholding, superannuation and year-to-date totals is a rich source of inconsistencies; our article on edited payslips and amount, date and name changes covers the arithmetic. For bank statements, running balances and the monthly sequence of transactions are the weak point. Income can also be compared against an ATO Notice of Assessment or the income statement an applicant can show from myGov and the ATO.

Checks that expose a swap

The most reliable checks compare a document with something it should agree with: other documents, the file's own history, or an official record. Looking harder at a single page rarely helps.

1. Name consistency across the file. The name on the ID, payslip, bank statement and utility bill should match in spelling, order, middle names and apostrophes or hyphens. A bill in a name that appears nowhere else is a prompt for a question, not proof of fraud.
2. Date logic. Check that the issue date falls after the period it covers, that a statement date matches the provider's billing cycle, and that no date falls on a day the issuer does not publish.
3. Arithmetic and sequence. Totals, running balances and year-to-date figures must reconcile. A swapped month often leaves the previous or next month inconsistent.
4. File-level evidence. Producer software, creation and modification timestamps, and incremental saves can show that a "bank-generated" statement was last saved in a consumer PDF editor. Our guide to how to tell if a PDF has been edited lists what to look at.
5. Record checks. ABNs, ACNs and certificate IDs can be compared against the issuing body's records. For identity documents, the government's Document Verification Service lets approved organisations check whether the details match the issuing agency's record.

A multi-layer analytical approach combining metadata, file structure, and cross-document consistency is the methodology used to identify tampered documents. No single layer is conclusive: metadata can be stripped, and a legitimate document may be regenerated by a portal.

What forum users ask

Questions in compliance and lending communities are practical, and two come up repeatedly.

"The bank statement is genuine but the name does not match the applicant. Is that fraud?" Not necessarily. Joint accounts, a recent name change, a business account or a partner's account all produce mismatches. The point is to ask for an explanation and a second document linking the two names, such as a marriage certificate or a joint-account letter, and to record the answer.

"The PDF has no editing traces, so is it clean?" No. A swap made on a printed copy that was then rescanned leaves no editing software in the metadata. Visual and cross-document checks have to cover that case: look for compression differences, misaligned text baselines and a scan that is cleaner than the rest of the page.

Users also say, in plain terms, that the worrying files are "too perfect" ones: a scan with an even background and sharp text on a document that was supposedly photographed on a kitchen table.

The Australian legal and regulatory context

Under section 144.1 of the Criminal Code Act 1995 (Cth), forgery of a Commonwealth document carries up to 10 years' imprisonment, and section 145.1 applies the same maximum to using a forged document. State and territory criminal codes cover forgery of private documents, and obtaining a financial advantage by deception can be charged under Division 134 of the Criminal Code Act 1995. Penalties differ by jurisdiction.

For reporting entities, the AML/CTF Act 2006 requires customer identification procedures that verify identity from reliable and independent documents or electronic data. AUSTRAC guidance applies, and the reforms to the Act that AUSTRAC has been phasing in during 2026 extend obligations to additional sectors such as real estate agents, lawyers and accountants; check AUSTRAC's published commencement dates for your sector. Personal information collected in the process is governed by the Privacy Act 1988 and the Australian Privacy Principles, overseen by the OAIC. As of October 2026, a reporting entity that accepts an altered document it should have questioned carries the compliance consequence, not only the person who altered it. This article is general information, not legal advice.

A practical process for a team

A defensible process ties every accepted document to at least one independent comparison. A workable sequence:

• Extract name, address, dates and identifiers from every document in the file.
• Compare them with each other and with the application.
• Check dates against validity rules (age of proof, expiry, period covered).
• Run file-level checks on PDFs and images.
• Escalate a mismatch to a human with the specific fields that disagree, not a generic "suspicious" flag.
• Keep the evidence: what was compared, when, and what the reviewer decided.

Teams in banking and KYC usually start with name and date consistency across documents, because it catches the common case at low cost, then add file forensics on the files that fail it. Our article on cross-document validation beyond OCR explains why extraction alone is not enough, and the document verification guide puts these checks in context. Details of how files are handled are on the security page.

Frequently Asked Questions

What is document tampering?

Document tampering is the unauthorised alteration of a genuine document, such as changing a name, a date or an amount, so that it is accepted for a purpose it would not otherwise meet. It differs from fabrication, where the whole document is invented.

How can I detect a name or date swap on a PDF?

Compare the name and dates against the other documents in the file, check that the totals and sequences reconcile, and inspect the PDF's producer and modification history. Where a register exists, verify the reference number there.

Can a clean scan still be tampered with?

Yes. If the change was made before printing and rescanning, editing traces are gone. Cross-document checks and register lookups are the reliable layer in that case.

Is a name mismatch proof of fraud?

No. Name changes, joint accounts and business accounts explain many mismatches. Treat it as a prompt to ask for a linking document and record the answer.

Who is liable if a firm accepts an altered document?

The person who altered it can face criminal liability, and the reporting entity remains responsible for its own customer identification and risk-assessment obligations under the AML/CTF Act. Keeping a record of the checks performed is the best protection.

To see how AI-generation signals can complement your existing controls on incoming files, see our AI and deepfake detection approach.