Document Tampering: Name and Date Swaps on Genuine Files

The most common form of document tampering is not a forged document: it is a genuine one with a few fields changed, usually the holder's name and one or two dates. The issuer's layout, logo, fonts and account numbers are all real, which is why a visual check passes and why the alteration is found by comparing the file against other documents and official records.

This guide describes how name and date swaps work, which documents they target, which checks expose them, and what Canadian law and FINTRAC expect. It is written for compliance, lending, HR and onboarding teams that receive files as PDFs or phone photos.

What a name and date swap is

A name and date swap replaces the identity or period printed on an authentic document while keeping everything else intact. The person doing it starts from a real pay stub, utility bill, bank statement or certificate, often their own from a different period or someone else's, and edits the fields that decide whether it is accepted.

Two variants dominate:

• Name swap: a real document belonging to a third party (a relative, a former roommate, a coworker) is re-labelled with the applicant's name.
• Date swap: the applicant's own genuine document is moved forward so that an expired or too-old proof appears current, for example a four-month-old utility bill presented as last month's.

Both are cheap. A PDF editor or a photo app is enough, and no template has to be reproduced. That is why this pattern is far more common than fully fabricated documents in the files reviewers describe on professional forums.

Why genuine documents are the preferred base

Genuine documents are preferred because they carry authentic details that a forger would otherwise have to invent. Account and transit numbers, barcodes, address formats, employer names and totals are already correct. The forger only has to touch a few pixels or text objects.

The documents most often reworked

Proof of address, pay stubs and bank statements are the documents most often reworked, because they are the ones accepted with the least verification. Government-issued photo ID is harder to alter and is checked more often against a security feature or database.

For pay stubs, the interplay between gross pay, income tax, CPP or QPP, EI and year-to-date totals is a rich source of inconsistencies; our article on edited payslips and amount, date and name changes covers the arithmetic. For bank statements, running balances and the monthly sequence of transactions are the weak point. Income can also be compared against a Notice of Assessment, which applicants can download from their CRA My Account.

Checks that expose a swap

The most reliable checks compare a document with something it should agree with: other documents, the file's own history, or an official record. Looking harder at a single page rarely helps.

1. Name consistency across the file. The name on the ID, pay stub, bank statement and utility bill should match in spelling, order, middle names and accents, which matter for French-language names. A bill in a name that appears nowhere else is a prompt for a question, not proof of fraud.
2. Date logic. Check that the issue date falls after the period it covers, that a statement date matches the provider's billing cycle, and that no date falls on a day the issuer does not publish.
3. Arithmetic and sequence. Totals, running balances and year-to-date figures must reconcile. A swapped month often leaves the previous or next month inconsistent.
4. File-level evidence. Producer software, creation and modification timestamps, and incremental saves can show that a "bank-generated" statement was last saved in a consumer PDF editor. Our guide to how to tell if a PDF has been edited lists what to look at.
5. Record checks. Corporation numbers, business numbers and certificate IDs can be compared against the issuing body's records.

A multi-layer analytical approach combining metadata, file structure, and cross-document consistency is the methodology used to identify tampered documents. No single layer is conclusive: metadata can be stripped, and a legitimate document may be regenerated by a portal.

What forum users ask

Questions in compliance and lending communities are practical, and two come up repeatedly.

"The bank statement is genuine but the name does not match the applicant. Is that fraud?" Not necessarily. Joint accounts, a recent name change, a business account or a spouse's account all produce mismatches. The point is to ask for an explanation and a second document linking the two names, such as a marriage certificate or a joint-account letter, and to record the answer.

"The PDF has no editing traces, so is it clean?" No. A swap made on a printed copy that was then rescanned leaves no editing software in the metadata. Visual and cross-document checks have to cover that case: look for compression differences, misaligned text baselines and a scan that is cleaner than the rest of the page.

Users also say, in plain terms, that the worrying files are "too perfect" ones: a scan with an even background and sharp text on a document that was supposedly photographed on a kitchen table.

The Canadian legal and regulatory context

Under section 366 of the Criminal Code, making a false document knowing it is false, with intent that it be used as genuine, is forgery, and section 367 sets a maximum of 10 years' imprisonment when prosecuted by indictment. Altering a genuine document to make it false counts as making a false document, and section 368 separately covers knowingly using, dealing with or acting on a forged document. See the Criminal Code of Canada for the full text.

For reporting entities, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations require identity to be verified using prescribed methods, including the government-issued photo identification method, the credit file method and the dual-process method. FINTRAC publishes guidance on each method and on how long documents must be unexpired and original. Personal information in the documents you collect is governed by PIPEDA and, in Quebec, by Law 25. As of October 2026, a reporting entity that accepts an altered document it should have questioned carries the compliance consequence, not only the person who altered it. This article is general information, not legal advice.

A practical process for a team

A defensible process ties every accepted document to at least one independent comparison. A workable sequence:

• Extract name, address, dates and identifiers from every document in the file.
• Compare them with each other and with the application.
• Check dates against validity rules (age of proof, expiry, period covered).
• Run file-level checks on PDFs and images.
• Escalate a mismatch to a human with the specific fields that disagree, not a generic "suspicious" flag.
• Keep the evidence: what was compared, when, and what the reviewer decided.

Teams in banking and KYC usually start with name and date consistency across documents, because it catches the common case at low cost, then add file forensics on the files that fail it. Our article on cross-document validation beyond OCR explains why extraction alone is not enough, and the document verification guide puts these checks in context. Details of how files are handled are on the security page.

Frequently Asked Questions

What is document tampering?

Document tampering is the unauthorized alteration of a genuine document, such as changing a name, a date or an amount, so that it is accepted for a purpose it would not otherwise meet. It differs from fabrication, where the whole document is invented.

How can I detect a name or date swap on a PDF?

Compare the name and dates against the other documents in the file, check that the totals and sequences reconcile, and inspect the PDF's producer and modification history. Where a record exists, verify the reference number there.

Can a clean scan still be tampered with?

Yes. If the change was made before printing and rescanning, editing traces are gone. Cross-document checks and record lookups are the reliable layer in that case.

Is a name mismatch proof of fraud?

No. Name changes, joint accounts and business accounts explain many mismatches. Treat it as a prompt to ask for a linking document and record the answer.

Who is liable if a firm accepts an altered document?

The person who altered it can face criminal liability under the Criminal Code, and the reporting entity remains responsible for its own identity-verification and risk-assessment obligations under the PCMLTFA. Keeping a record of the checks performed is the best protection.

To see how AI-generation signals can complement your existing controls on incoming files, see our AI and deepfake detection approach.