Fake Proof of Payment: Detecting Forged Transfer Confirmations

A seller hands over the car keys, the warehouse releases a pallet, or a landlord passes over a deposit receipt on the strength of a screenshot. The buyer's banking app shows a completed transfer, sometimes with a reference number, a green tick, and a timestamp. The money never arrives, because the screenshot was never a real payment — it was an image edited, generated, or pulled from a spoof banking app designed to look convincing for the thirty seconds it takes to close a deal.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice.

What Fake Proof-of-Payment Fraud Is

Fake proof-of-payment fraud is the presentation of a forged or manipulated document — a banking app screenshot, a PDF payment receipt, or a fabricated SWIFT MT103 confirmation — to convince a seller or service provider that a transfer has already been sent, so they release goods or access before checking whether the funds have actually cleared. It targets the moment of handover rather than the payment instruction itself: the money movement described in the document either never happened, was reversed minutes later, or was sent for a different amount to a different party.

This is distinct from mandate fraud, where criminals redirect a genuine payment by supplying fake bank account details to change where money is sent. It is also distinct from forged bank statements submitted to fake income or solvency in a loan file. Here the document is not trying to change what happens to real money — it is trying to convince someone that money has already moved when it has not.

Purchase scams, where a victim is tricked into paying for goods or services they never receive or, in the mirror-image variant covered here, a seller is tricked into releasing goods they were never paid for, accounted for 72% of all authorised push payment (APP) fraud cases in 2024 (UK Finance Annual Fraud Report 2025). Total APP fraud losses stood at just over £450 million across the year, even as case volumes fell 20% from 2023 — evidence that the underlying scam patterns, including forged payment proof, are still active even as some fraud categories decline.

How Fraudsters Build a Convincing Fake Payment Confirmation

Three techniques recur across vehicle sales, equipment leasing, wholesale trade, and marketplace deals, each aimed at a different moment in the transaction.

Screenshot editing and spoof banking apps

The simplest method edits a genuine screenshot — changing the amount, date, or payee name — or uses a purpose-built spoof app that recreates a specific bank's interface from scratch, letting the fraudster type in any sender, amount, and reference they choose. Template generators for this now circulate openly enough that creating a passable fake takes a registration and a few minutes, not photo-editing expertise. A genuine banking app never lets a user generate a "successful transfer" screen for a payment that was never submitted; a spoof app skips the bank entirely and draws the screen directly.

Fabricated SWIFT and MT103 confirmations

For larger transactions — equipment leases, wholesale invoices, cross-border vehicle purchases — fraudsters sometimes present a forged SWIFT MT103 confirmation or a so-called "conditional" MT103/23 as proof a wire is in transit. No such conditional instrument exists in the SWIFT messaging standard: a payer cannot make an MT103 contingent on the recipient completing paperwork first, and any confirmation claiming otherwise is fabricated. The document reproduces genuine-looking SWIFT field codes and bank letterhead, but it is not traceable through the actual SWIFT network because no real message was ever sent.

Fake PDF receipts and doctored remittance advice

Some fraudsters send a PDF "payment confirmation" cloned from a real bank template, complete with a transaction reference and a logo lifted from the bank's public branding. A material share of these documents can be distinguished from genuine bank-issued files by structural inconsistencies invisible on screen — PDF metadata, font substitution, and layout artefacts that differ from how the named institution actually generates its confirmations, a pattern CheckFile's document analysis pipeline is built to surface through structural checks and metadata forensics rather than visual review alone.

Where This Fraud Hits Hardest: Vehicle Sales, Leasing, and B2B Trade

Fake proof-of-payment fraud concentrates wherever a valuable asset changes hands quickly and the seller has an incentive to move fast.

Vehicle sales are a recurring target because the payment amount is large enough to reward the effort, and the item — a car — is portable and resellable within hours of collection. UK owner-forums and consumer advice sites consistently flag the "agent collection" variant, where a buyer claims to be abroad, sends a fake payment screenshot, and arranges a third-party courier to collect the car and its paperwork before the seller has checked their own account balance.

Real Questions Sellers and Buyers Ask

Specialised car-selling and marketplace forums return to the same handful of questions whenever this scam surfaces. The pattern below reflects those recurring concerns, synthesised rather than quoted directly.

Is a bank transfer screenshot ever valid proof of payment

No. A screenshot is an image, not a live connection to a bank's ledger, and spoof-app generators reproduce official-looking transfer confirmations in minutes. The only reliable proof is money appearing, cleared, in the recipient's own account, checked directly in their own banking app rather than through anything the buyer supplies.

Why does the buyer always claim the payment is "pending" or sent via a third party

Car-selling forums repeatedly describe buyers who claim to be abroad and send a courier or "agent" to collect the vehicle before the seller has confirmed funds. This detaches the person collecting the goods from the person who supposedly paid, so if the payment never appears, the seller has no buyer to chase.

Can a seller be held liable if they release goods against a fake payment proof

Releasing goods against unverified proof of payment is a business risk the seller absorbs, not a liability that shifts to the bank. Because the seller authorised no payment themselves, the APP fraud reimbursement rules that apply to victims tricked into sending money do not apply to a seller tricked into releasing goods with no payment sent in either direction.

Why Common-Sense Checks Still Fail

Manual review catches obvious fakes — misspelt bank names, mismatched fonts — but the underlying weakness is structural: staff and private sellers judge a document's appearance under time pressure created deliberately by the fraudster. Manual fraud detection across document types generally identifies around 37% of cases, with an average detection delay of 87 days, according to the ACFE 2024 Report to the Nations — figures describing organisational fraud broadly, but illustrating the same underlying problem: appearance-based review misses forgeries engineered specifically to look right at a glance, and the pressure to close a sale quickly compounds the risk.

The same document-level techniques used in equipment leasing compliance checks — validating that a file's structure and metadata match what the claimed issuer would actually produce — apply just as directly to a payment confirmation as to a lease application file.

A Verification Sequence Before Releasing Goods or Access

A short, enforced sequence closes most of the exposure this fraud exploits, whether the transaction is a private car sale or a business-to-business dispatch.

Step 1 – Treat any screenshot, PDF, or forwarded email as unverified by default. No image or document, however detailed, substitutes for funds appearing in your own account.

Step 2 – Check your own banking app directly, never a link the buyer provides. Navigate to your bank's app or website independently and confirm the balance has moved and cleared, not merely shown as pending.

Step 3 – Match the payer name to the person in front of you. Faster Payments transfers display the account name the sending bank holds; a mismatch is a signal to pause, not to proceed on a promise it will be corrected later.

Step 4 – Refuse third-party collection until funds have cleared. Any request to release goods to a courier or "agent" before you have personally verified cleared funds is a standalone red flag, regardless of how convincing the payment proof looks.

Refusing to release goods or access until payment shows as cleared funds in your own account, checked independently of anything the buyer supplies, is the control cited most consistently across UK consumer-protection guidance on purchase scams (Citizens Advice). No document-level check replaces that final step; it reduces how often a forged confirmation gets that far in the first place.

Reporting and Recovery Options in the UK

If goods have already been released against a fake payment proof, recovery options are limited and time-sensitive. Report the incident to Report Fraud, the successor service to Action Fraud, to obtain a crime reference number required for insurance claims and any dispute with a courier involved. Because this pattern does not involve the victim being deceived into sending a payment themselves, the mandatory APP fraud reimbursement rules — the Payment Systems Regulator's reimbursement requirement, effective since 7 October 2024 — generally do not extend to a seller who released an asset without receiving any funds.

Businesses accepting payment confirmations as part of a regulated onboarding or leasing process carry additional obligations: the FCA's guidance on fraudulent payments expects firms to maintain proportionate systems and controls, treating a customer-supplied payment document with the same scrutiny as any other unverified financial document submitted during onboarding, consistent with the CheckFile banking KYC solution approach to document intake.

How CheckFile Complements Direct Bank Verification

Checking your own account balance directly remains the single most reliable control against this fraud, and no document analysis tool replaces it. Where a business handles proof-of-payment documents at scale — a leasing company processing deposit confirmations, a wholesale distributor accepting remittance advice before dispatch — CheckFile applies cross-document validation across multiple fields per document to assess whether a submitted payment confirmation is structurally consistent with what the claimed issuing bank would actually produce. CheckFile offers AI-generated content detection as an optional forensic layer, available according to the sector's risk level, as a complement to existing structural document controls.

The CheckFile financing and leasing solution applies this pipeline to deposit and payment confirmations collected during equipment and vehicle finance onboarding, and the CheckFile security infrastructure provides the audit trail needed if a disputed transaction is later escalated. Teams evaluating deployment can review the CheckFile pricing page or explore the CheckFile platform directly.

For a broader view of how document verification obligations vary across sectors, see our industry verification guide. Businesses focused specifically on the underlying payment redirection risk may also find our guide to fake bank details and mandate fraud useful alongside this article.

To place fake payment confirmation detection within a dedicated approach, see AI-generated and forged document detection. CheckFile analyses submitted documents and surfaces AI-generation signals as a complement to your existing controls — it does not replace checking your own bank account before releasing goods.

Frequently Asked Questions

What is the difference between fake proof of payment and mandate fraud?

Fake proof of payment fraud forges a document claiming a transfer has already happened, used to convince a seller to release goods before checking their account. Mandate fraud instead forges bank account details to redirect a genuine, intended payment to an account the criminal controls. The two can overlap in a single scam, but the document being forged and the moment it is used are different.

Can a fake SWIFT MT103 confirmation be verified as genuine?

A payer's bank or an independent SWIFT tracing request can confirm whether a message was actually transmitted, but a recipient cannot verify a SWIFT confirmation from the document alone. There is no such thing as a "conditional" MT103 or MT103/23 that releases funds only once paperwork is completed; any confirmation claiming this feature is fabricated, regardless of how genuine the letterhead and field codes appear.

How quickly do UK bank transfers actually clear?

Faster Payments transfers between UK banks typically complete within seconds to a few hours, and domestic transfers rarely take longer than one working day under normal circumstances. A payment described by the buyer as "pending" for several days on what should be a standard domestic transfer is inconsistent with how Faster Payments normally operates and warrants direct verification with your own bank before proceeding.

Should a seller ever accept a payment confirmation instead of checking their own account?

No single document should substitute for confirming that funds have cleared in the seller's own account, checked directly through their own banking app or online banking rather than a link supplied by the buyer. Payment confirmations can support a decision once funds are independently verified, but on their own they carry no guarantee that money has actually moved.

Who should be notified if goods were released against a fake payment proof?

Report the incident to Report Fraud, the successor service to Action Fraud, to obtain a crime reference number for any insurance claim or dispute. If a courier or delivery firm was used to collect the goods, notify that firm directly, since they may hold identifying information about the individual who collected the item, and contact your bank in case the same fraudster attempts a related scam through a linked account.