A fake bank statement now takes one prompt. Here’s what catches it.

TL;DR: In a Money20/20 interview with NYSE, Ocrolus CEO Sam Bobley said generative AI tools can now produce fake bank statements and pay stubs that are basically undetectable to the human eye. Ocrolus responds by identifying deepfake documents created from scratch as well as manipulated ones, giving every document it processes a high, medium or low risk authenticity score and pairing its AI with deterministic checks. Bobley also described a fraud agent Ocrolus is developing for small business lending that checks business locations, reviews and transaction patterns.

Faking a bank statement used to take real Photoshop skill. Now it takes a single prompt. “A few years back, in order to commit fraud, you had to be pretty sophisticated with Photoshop and document tampering and manipulation,” Ocrolus CEO Sam Bobley told JD Durkin in a Money20/20 interview with NYSE. “Now, it’s as simple as a prompt. You type into Claude or ChatGPT, give me a fake bank statement, give me a fake pay stub or make an edit to this pay stub and it spits out a new copy that’s basically undetectable to the human eye.”

Ocrolus data shows how often suspicious documents reach lenders. Across 1.46 million small business loan applications Ocrolus analyzed over 90 days, 1 in 8 contained suspicious documents and 175,000 applications were flagged. That rate held steady across the full period.

Why the fake ID book stopped working

Bobley compared the old model of fraud review to a bouncer at a bar. Fraud teams at lenders “used to be like the ID book that you see when you’re trying to enter a bar with a fake ID,” he said, “and the guy’s flipping through and he knows what the common fake IDs look like.”

Reviewers looked for altered fonts or formats, or a statement that didn’t look the way a Chase bank statement should. Over time, fraud teams developed a real skill at identifying the fakes.

Generative AI broke that model. “The problem now is the fakes are so good that even the best human eye cannot detect the difference,” Bobley said.

He described the response as an arms race. “As fraudsters are getting smarter and smarter, technology companies like Ocrolus also have to play in that arms race and give our lenders the tools to defend against these newer types of fraud.” Bobley said that this year in particular, Ocrolus is “more focused on helping lenders defend against fraud.” Ocrolus has also covered the mortgage fraud patterns that manual review misses.

How Ocrolus scores AI-generated document fraud

Ocrolus already analyzed documents for manipulation and Photoshop edits. It has now enhanced that with a new capability to identify deepfake documents created from scratch. Bobley said Ocrolus layers that detection “with lending specific knowledge of the types of fraud that are most commonly committed” on documents such as bank statements and W-2s.

The result is an authenticity score on every document Ocrolus processes. The score tells the lender whether a document is high risk, medium risk or low risk, which Bobley said “really helps them triage and do a more powerful review.”

AI with deterministic checks for regulated lending

Durkin raised the growing scrutiny Fannie Mae and Freddie Mac are putting on how mortgage lenders use AI. Bobley said regulated markets like mortgage require a balance. Lenders “want the latest and greatest AI capabilities, but they cannot afford to have AI-related hallucinations or errors make it into their decision process.”

In his view, Fannie Mae and Freddie Mac are trying to allow companies to use AI, with deterministic checks and compliance processes on top to ensure AI is not making mistakes. Ocrolus takes the same approach. “We use the best AI models in our processing engine, but we also have document-specific data validations and deterministic processes along with an insurance policy on our data that gives the regulators and the lenders comfort in the output that we’re producing,” Bobley said.

What a fraud agent adds to small business fraud review

Bobley said AI agents are “chipping away at jobs that used to be performed manually and not necessarily replacing those jobs, but pushing those jobs to even more cerebral expert elements of the work.”

Small business fraud analysts typically go beyond a document-level check. They search the business, see whether it has reviews and confirm it has a legitimate place on Google Maps. Ocrolus is developing a fraud agent that does a lot of this work.

The agent reads the business bank statements, determines whether they are fraudulent or deepfake and scores them. It can also pull industry data, check Google Maps, check whether Google reviews are human-generated or AI-generated and look at whether transaction patterns make sense for the type of business. Bobley’s example: “You’re a dentist office but your address shows that you’re actually in the middle of a field somewhere.” Ocrolus takes all of those signals and returns “an even more robust fraud score.”

The fraud agent is still in development. Detection of documents created from scratch and an authenticity score on every document are how Ocrolus equips lenders against these newer types of fraud now. Watch Bobley’s full interview above, and see how Ocrolus document fraud detection scores every document a lender receives.

Key takeaways

• Generative AI tools can produce a fake bank statement or pay stub from a single prompt, and Ocrolus CEO Sam Bobley says the output is “basically undetectable to the human eye.”
• Across 1.46 million SMB loan applications Ocrolus analyzed over 90 days, 1 in 8 contained suspicious documents and 175,000 applications were flagged.
• Fraud teams once worked like a bouncer with a fake ID book, and Bobley says AI-generated fakes now beat even the best human eye.
• Ocrolus identifies deepfake documents created from scratch as well as manipulated ones, and it gives every document a high, medium or low risk authenticity score.
• Ocrolus pairs its AI models with document-specific data validations, deterministic processes and an insurance policy on its data, and it is developing a fraud agent for small business lending.

FAQs

What is AI-generated document fraud?

AI-generated document fraud is the use of generative AI tools to create fake financial documents, such as bank statements and pay stubs, or to edit real ones. Ocrolus CEO Sam Bobley has said a fraudster can now type a request into a tool like ChatGPT and get back a document that is “basically undetectable to the human eye.”

Can lenders detect a fake bank statement made with AI?

Not reliably by eye. Bobley has said AI-generated fakes are now good enough that “even the best human eye cannot detect the difference.” Ocrolus identifies deepfake documents created from scratch as well as manipulated documents and gives each one an authenticity score.

What is a document authenticity score?

A document authenticity score rates how likely a document is to be fraudulent. Ocrolus gives every document it processes a score that tells the lender whether it is high risk, medium risk or low risk. Bobley has said the score helps lenders triage and do a more powerful review.

How common is document fraud in small business lending?

In an Ocrolus analysis of 1.46 million small business loan applications over 90 days, 1 in 8 applications contained suspicious documents and 175,000 applications were flagged. The rate held steady across the full period.

How are Fannie Mae and Freddie Mac approaching AI in mortgage lending?

According to Bobley, Fannie Mae and Freddie Mac are trying to allow companies to use AI with deterministic checks and compliance processes on top to ensure AI is not making mistakes. Ocrolus pairs its AI models with document-specific data validations and deterministic processes for the same reason.