AI-Generated Document Detection: Spotting Visual Artifacts (US Guide)

AI-generated document detection relies on spotting visual artifacts left by the generation process itself, not by manual editing. Three families of signal matter: texture and noise patterns too statistically regular for a real scan or photograph; lighting and shadow physics that break down across an image, especially on stamps and embossed seals; and mismatches between what a field shows visually and what it encodes in a machine-readable zone, barcode or QR code. None require the document to "look wrong" — a fake can be visually flawless and still fail all three.

This article is provided for informational purposes and does not constitute legal or regulatory advice.

What counts as a visual artifact in an AI-generated document

Fraudulent documents produced with generative AI fall into two categories. Fully synthetic documents are built from nothing by a generative model — a Generative Adversarial Network (GAN) or a diffusion model — trained to reproduce a document type (pay stub, bank statement, driver's license, utility bill) without starting from a genuine original. Partially edited documents start from a real scan and use generative AI to replace specific fields — a name, an amount, a photograph — while leaving genuine security features intact elsewhere. The second category is harder to catch precisely because most of the document is real.

A visual artifact, in the forensic sense used here, is a trace left by the generation mechanism rather than by human retouching. A diffusion model builds an image through iterative denoising, starting from random noise and refining it step by step until it resembles the target document type. That statistical process produces pixel-level texture distributions that differ measurably from an optically captured photograph or scanner output, even when the result looks convincing to a reviewer. Recent academic forensics work documents this gap specifically for document images, distinct from the natural photography most AI-detection research has focused on (arXiv, Beyond Natural Images: Rethinking AI-Generated Image Detection in Documents).

Detection of synthetic content is deployed as an additional layer of AI-generation signals according to client configuration and sector risk profile, complementing existing structural checks — an approach that sits alongside our deepfake document detection guide, which covers synthetic identity documents more generally, and our companion piece on Error Level Analysis for document fraud, which targets compression artifacts from conventional photo editing rather than AI generation.

Why this vector is growing, and who it targets

Generative tools capable of producing a convincing pay stub, bank statement or ID photograph in under a minute became widely accessible from 2024 onward, while human review capacity has not scaled at the same pace. Manual fraud detection alone catches only 37% of cases, with an average detection delay of 87 days, according to the Association of Certified Fraud Examiners (ACFE, Report to the Nations 2024). That gap predates generative AI, and a document a model produces in seconds does nothing to close it.

US regulators have taken notice too: FinCEN issued Alert FIN-2024-Alert004 in November 2024 warning institutions about exactly this fraud (more below), corroborated internationally by ENISA's threat landscape work, which independently flags AI-generated synthetic content as a growing document-fraud vector since 2024 (ENISA, Threat Landscape 2024).

The sectors most exposed process high volumes of supporting documents remotely, without a physical encounter with the applicant: consumer lending (fabricated pay stubs and bank statements), insurance (fabricated claims evidence), residential rental (fabricated proof-of-income letters), and employment eligibility verification (fabricated driver's licenses, Social Security cards or Green Cards submitted for E-Verify checks). A reviewer has seconds to validate a document a model took roughly as long to produce.

The technical breakdown: texture, lighting, and field-encoding mismatch

Three categories of signal recur in a forensic review, each targeting a different weakness in how generative models work.

Texture and statistical noise. A genuine scan or photograph carries sensor noise and print grain physically tied to the capture device and paper stock — irregular by nature. A diffusion-generated document instead tends to produce background textures that are statistically too regular: patterns repeat with a periodicity invisible to the eye but visible to a frequency-domain analysis. Some newer models overcorrect and inject uniform artificial noise instead, which unlike a real scan does not vary by region.

Lighting and shadow physics. An authentic photograph of a document resting on a surface respects a single, coherent light source: shadows cast by a fold, a staple or an embossed seal all follow the same direction and intensity. Generative models still struggle to maintain that coherence, particularly around raised elements — notary seals, holograms, wet-ink signatures — where contradictory shadow directions, or a missing cast shadow where one is required, give the generation away.

Visible field versus encoded field mismatch. On structured documents — a US passport with a Machine-Readable Zone (MRZ), a driver's license with a PDF417 barcode, a certificate with a QR code — the visible field must match exactly what is encoded. A model trained on visual appearance routinely fails to generate an MRZ or barcode whose check digit is valid, since the check digit is a deterministic function of the surrounding characters, not a visual pattern to imitate. The same failure shows up as a visible date of birth diverging from the encoded date, or a document number differing from the barcode payload — hard to fabricate by hand without the checksum algorithm.

Comparison: authentic document markers versus AI-generation signals

No single row is reliable alone — a genuine document can have poor metadata, and a well-executed fake can pass one texture check. Cross-referencing several signals is what makes the approach actionable, the same reasoning behind Error Level Analysis as a complementary check.

What compliance and fraud teams are asking

Compliance and fraud-prevention teams tend to ask a version of the same two questions once they start dealing with AI-generated submissions in volume.

The first is whether a document that "looks perfect" can still be AI-generated. It can: visual perfection used to correlate with authenticity, and no longer does. A diffusion model's output can be indistinguishable from a genuine scan while still failing a statistical texture check or an MRZ checksum — and a retouched document differs from a fully generated one in exactly this way: the former leaves compression artifacts localized to the edited region, the signal Error Level Analysis targets, while the latter's artifacts are distributed across the whole image as a statistical property of generation.

The second is operational: how do you apply this at volume without a human examining every submission under magnification? These checks run as an automated first pass — flagging texture, shadow and MRZ or barcode mismatches across every incoming document — so review time concentrates on the cases the automated layer surfaces.

FinCEN's deepfake alert and the Bank Secrecy Act reporting duty

FinCEN Alert FIN-2024-Alert004, issued November 13, 2024, is the single most important regulatory reference point for this vector in the US. It warns banks and money services businesses that generative AI is being used to produce fake identity documents, cloned voices and synthetic video to defeat identity verification and due diligence controls, and sets out red-flag indicators for AML programs.

The operative duty flows from the Bank Secrecy Act (BSA, 31 U.S.C. § 5311 et seq.), which already requires covered institutions to file a Suspicious Activity Report (SAR) when activity appears designed to evade reporting requirements or involves apparent criminal conduct. FinCEN's alert clarifies how the existing SAR regime applies here, and instructs that a SAR involving suspected deepfake fraud reference the key term "FIN-2024-DEEPFAKEFRAUD" — making a document that fails the checks above exactly the evidence such a narrative needs.

US regulatory framework: federal AML duties and a state-by-state fraud and privacy patchwork

Unlike the UK, where the Fraud Act 2006 and Forgery and Counterfeiting Act 1981 supply a single national framework, the US splits the legal response across federal and state law. Submitting a fabricated document to obtain money from a bank, or transmitting it electronically for a financial benefit, typically falls under bank fraud (18 U.S.C. § 1344) or wire fraud (18 U.S.C. § 1343). Forgery itself is largely state-law territory: each state prosecutes forgery and identity-fraud offenses under its own penal code, so the charge varies by jurisdiction rather than one federal statute.

On the AML side, FinCEN is the primary regulator and financial intelligence unit under the BSA — combining what the FCA and OPBAS do in the UK — while money laundering is criminalized under the Money Laundering Control Act (18 U.S.C. § 1956), the counterpart to the UK's Proceeds of Crime Act 2002. For business-facing checks on a fabricated Certificate of Good Standing or Articles of Incorporation, the reference point is the Corporate Transparency Act of 2021 (CTA), requiring many entities to report beneficial ownership to FinCEN and standing as the US analogue to the UK's Economic Crime and Corporate Transparency Act 2023 (FinCEN beneficial ownership information page).

Privacy diverges most sharply: the US has no federal law equivalent to the UK GDPR or Data Protection Act 2018, and no single national regulator playing the ICO's role. A workflow processing a driver's license, Social Security number or photograph instead answers to a patchwork of state privacy laws led by the CCPA, with the FTC enforcing unfair and deceptive practices generally rather than acting as a dedicated data protection authority. Organized identity fraud is referred to the FBI — roughly the equivalent of escalating to the National Crime Agency in the UK.

Within that framework, a verification platform such as CheckFile gives compliance teams AI-generation signals as a complement to existing controls, without claiming to catch every forgery alone. Our page on AI-generated document and deepfake detection sets out how this layer fits a broader workflow, applicable to banking KYC as much as lending and leasing onboarding — see our security approach for the standards behind it, and our pricing page for plans.

Frequently Asked Questions

Can a visually perfect document still be AI-generated?

Yes — this is the central challenge here. Diffusion models can produce images indistinguishable from a genuine scan to the human eye. The artifacts that give them away are usually statistical (texture distribution, MRZ or barcode checksum validity), not something a reviewer can spot by looking harder.

What's the difference between a retouched document and a fully AI-generated one?

A retouched document starts from a genuine scan with specific fields edited, leaving compression artifacts localized to the edited area. A fully generated document was never a real scan, so its artifacts are distributed statistically across the whole image — why texture analysis and Error Level Analysis are complementary.

Does the MRZ or barcode really reveal an AI-generated document?

It is one of the more reliable signals available. A generative model trained on visual appearance frequently fails to produce an MRZ or PDF417 barcode with a valid check digit, or encodes data that does not match what is printed — hard to fabricate manually without the checksum algorithm.

Which industries are most exposed to AI-generated document fraud?

Lending, insurance claims, residential rental, and employment eligibility verification are most exposed, since each processes high volumes of documents submitted remotely with little physical contact, leaving a narrow review window per case.

What US law applies to submitting an AI-generated fake document?

There is no single national forgery statute equivalent to the UK's Forgery and Counterfeiting Act 1981 — forgery is prosecuted under state penal codes, which vary by jurisdiction. At the federal level, a fabricated document used for financial benefit through interstate wires or a bank typically falls under wire fraud (18 U.S.C. § 1343) or bank fraud (18 U.S.C. § 1344), regardless of whether it was forged manually or generated by AI.

In summary

Texture and noise irregularities, shadow and lighting inconsistencies, and mismatches between visible and machine-readable fields are three distinct, complementary signals for catching AI-generated documents — each catching failure modes the others miss, none reliable alone at volume. FinCEN's Alert FIN-2024-Alert004 and the BSA reporting duty behind it make this a live regulatory expectation, not just a technical nice-to-have, alongside the CTA's beneficial-ownership layer and the CCPA-led state privacy patchwork. To see how this fits alongside metadata checks, Error Level Analysis and cross-document review, visit AI-generated document and deepfake detection, compare plans on the pricing page, or start from our document verification guide.