Document Tampering: Name and Date Swaps on Genuine Files

The most common form of document tampering is not a forged document: it is a genuine one with a few fields changed, usually the holder's name and one or two dates. The issuer's layout, logo, fonts and reference numbers are all real, which is why a visual check passes and why the alteration is found by comparing the file against other documents and official records.

This guide describes how name and date swaps work, which documents they target, which checks expose them, and what the law says in the UK. It is written for compliance, credit, HR and onboarding teams that receive files as PDFs or photos.

What a name and date swap is

A name and date swap replaces the identity or period printed on an authentic document while keeping everything else intact. The person doing it starts from a real payslip, utility bill, bank statement or certificate, often their own from a previous period or someone else's, and edits the fields that decide whether it is accepted.

Two variants dominate:

• Name swap: a real document belonging to a third party (a relative, a former tenant, a colleague) is re-labelled with the applicant's name.
• Date swap: the applicant's own genuine document is moved forward so that an expired or too-old proof appears current, for example a three-month-old proof of address presented as last month's.

Both are cheap. A PDF editor or a photo app is enough, and no template has to be reproduced. That is the main reason this pattern outnumbers fully fabricated documents in the files that reviewers describe on professional forums.

Why genuine documents are the preferred base

Genuine documents are preferred because they carry authentic details that a forger would otherwise have to invent. Reference numbers, barcodes, address formats, employer names, sort codes and totals are all already correct. The forger only has to touch a few pixels or text objects.

The documents most often reworked

Proof of address, payslips and bank statements are the documents most often reworked, because they are the ones accepted with the least verification. Identity documents are harder to alter and are checked more often against a chip or database.

For payslips, the interplay between gross pay, tax, National Insurance and year-to-date totals is a rich source of inconsistencies; our article on edited payslips and amount, date and name changes covers the arithmetic in detail. For bank statements, running balances and the monthly sequence of transactions are the weak point.

Checks that expose a swap

The most reliable checks compare a document with something it should agree with: other documents, the file's own history, or an official register. Looking harder at a single page rarely helps.

1. Name consistency across the file. The name on the ID, payslip, bank statement and utility bill should match in spelling, order, middle names and accents. A bill in a name that appears nowhere else is a prompt for a question, not proof of fraud.
2. Date logic. Check that the issue date falls after the period it covers, that a statement date matches the provider's billing cycle, and that no date falls on a day the issuer does not publish.
3. Arithmetic and sequence. Totals, running balances and year-to-date figures must reconcile. A swapped month often leaves the previous or next month inconsistent.
4. File-level evidence. Producer software, creation and modification timestamps, and incremental saves can show that a "bank-generated" statement was last saved in a consumer PDF editor. Our guide to how to tell if a PDF has been edited lists what to look at.
5. Register checks. Company numbers, tax reference numbers and certificate IDs can be compared against the issuing body's records.

A multi-layer analytical approach combining metadata, file structure, and cross-document consistency is the methodology used to identify tampered documents. No single layer is conclusive: metadata can be stripped, and a legitimate document may be regenerated by a portal.

What forum users ask

Questions in compliance and lending communities are practical, and two come up repeatedly.

"The bank statement is genuine but the name does not match the applicant. Is that fraud?" Not necessarily. Joint accounts, a recent name change, a business account or a partner's account all produce mismatches. The point is to ask for an explanation and a second document linking the two names, such as a marriage certificate or a joint-account letter, and to record the answer.

"The PDF has no editing traces, so is it clean?" No. A swap made on a printed copy that was then rescanned leaves no editing software in the metadata. Visual and cross-document checks have to cover that case: look for compression differences, misaligned text baselines and a scan that is cleaner than the rest of the page.

Users also say, in plain terms, that the worrying files are "too perfect" ones: a scan with an even background and sharp text on a document that was supposedly photographed on a kitchen table.

The UK legal context

Under the Forgery and Counterfeiting Act 1981, making or using a false instrument with the intention that it be accepted as genuine is an offence carrying up to 10 years' imprisonment. Altering a genuine document so that it is false counts as making a false instrument. Section 3 of the Forgery and Counterfeiting Act 1981 defines the instruments covered, and the Fraud Act 2006 separately covers fraud by false representation.

For regulated firms, the obligation is to verify identity on the basis of documents or information from a reliable and independent source under the Money Laundering Regulations 2017, and to apply enhanced checks where risk is higher. In the EU, Regulation (EU) 2024/1624 sets the same expectation. As of October 2026, a firm that accepts an altered document it should have questioned bears the compliance consequence, not only the person who altered it. This article is general information, not legal advice.

A practical process for a team

A defensible process ties every accepted document to at least one independent comparison. A workable sequence:

• Extract name, address, dates and identifiers from every document in the file.
• Compare them with each other and with the application form.
• Check dates against validity rules (age of proof, expiry, period covered).
• Run file-level checks on PDFs and images.
• Escalate a mismatch to a human with the specific fields that disagree, not a generic "suspicious" flag.
• Keep the evidence: what was compared, when, and what the reviewer decided.

Teams in banking and KYC usually start with name and date consistency across documents, because it catches the common case at low cost, then add file forensics on the files that fail it. Our article on cross-document validation beyond OCR explains why extraction alone is not enough, and the document verification guide puts these checks in context. Details of how files are handled are on the security page.

Frequently Asked Questions

What is document tampering?

Document tampering is the unauthorised alteration of a genuine document, such as changing a name, a date or an amount, so that it is accepted for a purpose it would not otherwise meet. It differs from fabrication, where the whole document is invented.

How can I detect a name or date swap on a PDF?

Compare the name and dates against the other documents in the file, check that the totals and sequences reconcile, and inspect the PDF's producer and modification history. Where a register exists, verify the reference number there.

Can a clean scan still be tampered with?

Yes. If the change was made before printing and rescanning, editing traces are gone. Cross-document checks and register lookups are the reliable layer in that case.

Is a name mismatch proof of fraud?

No. Name changes, joint accounts and business accounts explain many mismatches. Treat it as a prompt to ask for a linking document and record the answer.

Who is liable if a firm accepts an altered document?

The person who altered it can face criminal liability, and the regulated firm remains responsible for its own identity-verification and risk-assessment obligations. Keeping a record of the checks performed is the best protection.

To see how AI-generation signals can complement your existing controls on incoming files, see our AI and deepfake detection approach.