Document Tampering: Name and Date Swaps on Genuine Files

The most common form of document tampering is not a forged document: it is a genuine one with a few fields changed, usually the holder's name and one or two dates. The issuer's layout, logo, fonts and account numbers are all real, which is why a visual check passes and why the alteration is found by comparing the file against other documents and official records.

This guide describes how name and date swaps work, which documents they target, which checks expose them, and what US law and regulators expect. It is written for compliance, lending, HR and onboarding teams that receive files as PDFs or phone photos.

What a name and date swap is

A name and date swap replaces the identity or period printed on an authentic document while keeping everything else intact. The person doing it starts from a real pay stub, utility bill, bank statement or certificate, often their own from a different period or someone else's, and edits the fields that decide whether it is accepted.

Two variants dominate:

• Name swap: a real document belonging to a third party (a relative, a former roommate, a coworker) is re-labelled with the applicant's name.
• Date swap: the applicant's own genuine document is moved forward so that an expired or too-old proof appears current, for example a four-month-old utility bill presented as last month's.

Both are cheap. A PDF editor or a photo app is enough, and no template has to be reproduced. That is why this pattern is far more common than fully fabricated documents in the files reviewers describe on professional forums.

Why genuine documents are the preferred base

Genuine documents are preferred because they carry authentic details that a forger would otherwise have to invent. Account numbers, routing numbers, barcodes, address formats, employer names and totals are already correct. The forger only has to touch a few pixels or text objects.

The documents most often reworked

Proof of address, pay stubs and bank statements are the documents most often reworked, because they are the ones accepted with the least verification. Government-issued photo ID is harder to alter and is checked more often against a barcode, magnetic stripe or database.

For pay stubs, the interplay between gross pay, federal and state withholding, FICA and year-to-date totals is a rich source of inconsistencies; our article on edited payslips and amount, date and name changes covers the arithmetic. For bank statements, running balances and the monthly sequence of transactions are the weak point. Tax-related documents have an extra control: income can be compared against an IRS transcript obtained with the applicant's consent through IRS Form 4506-C or the IVES program.

Checks that expose a swap

The most reliable checks compare a document with something it should agree with: other documents, the file's own history, or an official record. Looking harder at a single page rarely helps.

1. Name consistency across the file. The name on the ID, pay stub, bank statement and utility bill should match in spelling, order, middle names and suffixes. A bill in a name that appears nowhere else is a prompt for a question, not proof of fraud.
2. Date logic. Check that the issue date falls after the period it covers, that a statement date matches the provider's billing cycle, and that no date falls on a day the issuer does not publish.
3. Arithmetic and sequence. Totals, running balances and year-to-date figures must reconcile. A swapped month often leaves the previous or next month inconsistent.
4. File-level evidence. Producer software, creation and modification timestamps, and incremental saves can show that a "bank-generated" statement was last saved in a consumer PDF editor. Our guide to how to tell if a PDF has been edited lists what to look at.
5. Record checks. EINs, employer names, license numbers and policy numbers can be compared against the issuing body's records.

A multi-layer analytical approach combining metadata, file structure, and cross-document consistency is the methodology used to identify tampered documents. No single layer is conclusive: metadata can be stripped, and a legitimate document may be regenerated by a portal.

What forum users ask

Questions in compliance and lending communities are practical, and two come up repeatedly.

"The bank statement is genuine but the name does not match the applicant. Is that fraud?" Not necessarily. Joint accounts, a recent name change after marriage, a DBA or LLC account, or a spouse's account all produce mismatches. The point is to ask for an explanation and a second document linking the two names, such as a marriage certificate or a joint-account letter, and to record the answer.

"The PDF has no editing traces, so is it clean?" No. A swap made on a printed copy that was then rescanned leaves no editing software in the metadata. Visual and cross-document checks have to cover that case: look for compression differences, misaligned text baselines and a scan that is cleaner than the rest of the page.

Users also say, in plain terms, that the worrying files are "too perfect" ones: a scan with an even background and sharp text on a document that was supposedly photographed on a kitchen table.

The US legal and regulatory context

Under 18 U.S.C. § 1344, executing a scheme to defraud a financial institution, including by submitting altered documents to obtain a loan, carries up to 30 years in prison and a fine of up to $1,000,000. Knowingly making a false statement on a loan application to a federally insured institution is separately punishable under 18 U.S.C. § 1014 with the same maximum. See 18 U.S.C. § 1344 for the bank fraud statute. Fraud involving identification documents falls under 18 U.S.C. § 1028. State forgery and uttering statutes add their own penalties and vary by state.

For banks, the Customer Identification Program rule at 31 CFR 1020.220 requires risk-based procedures to verify a customer's identity, using documents, non-documentary methods or both, under the Bank Secrecy Act. FinCEN has also issued an alert on fraud schemes using manipulated and AI-generated identity documents (FIN-2024-Alert004, November 2024). As of October 2026, a financial institution that accepts an altered document it should have questioned carries the compliance consequence, not only the person who altered it. This article is general information, not legal advice.

A practical process for a team

A defensible process ties every accepted document to at least one independent comparison. A workable sequence:

• Extract name, address, dates and identifiers from every document in the file.
• Compare them with each other and with the application.
• Check dates against validity rules (age of proof, expiry, period covered).
• Run file-level checks on PDFs and images.
• Escalate a mismatch to a human with the specific fields that disagree, not a generic "suspicious" flag.
• Keep the evidence: what was compared, when, and what the reviewer decided.

Teams in banking and KYC usually start with name and date consistency across documents, because it catches the common case at low cost, then add file forensics on the files that fail it. Our article on cross-document validation beyond OCR explains why extraction alone is not enough, and the document verification guide puts these checks in context. Details of how files are handled are on the security page.

Frequently Asked Questions

What is document tampering?

Document tampering is the unauthorized alteration of a genuine document, such as changing a name, a date or an amount, so that it is accepted for a purpose it would not otherwise meet. It differs from fabrication, where the whole document is invented.

How can I detect a name or date swap on a PDF?

Compare the name and dates against the other documents in the file, check that the totals and sequences reconcile, and inspect the PDF's producer and modification history. Where a record exists, verify the reference number there.

Can a clean scan still be tampered with?

Yes. If the change was made before printing and rescanning, editing traces are gone. Cross-document checks and record lookups are the reliable layer in that case.

Is a name mismatch proof of fraud?

No. Name changes, joint accounts and business accounts explain many mismatches. Treat it as a prompt to ask for a linking document and record the answer.

Who is liable if a firm accepts an altered document?

The person who altered it can face federal and state criminal liability, and the regulated institution remains responsible for its own CIP and risk-assessment obligations. Keeping a record of the checks performed is the best protection.

To see how AI-generation signals can complement your existing controls on incoming files, see our AI and deepfake detection approach.