AutowriteVisit Website →
← Back to blog

Mortgage Document Tampering: Procurement Questions for Canadian Brokers

October 9, 2026
Mortgage Document Tampering: Procurement Questions for Canadian Brokers

The fastest, most reliable way to catch tampered mortgage documents is a layered workflow: manual triage for visual and metadata red flags, automated tamper detectors for image and structural anomalies, independent source verification for income and identity, and a trained human reviewer to adjudicate flagged files. Immediate steps include checking PDF metadata, running a tamper-detection scan, and confirming income against an independent source with mortgage pre-approval in Canada. Regulatory frameworks from OSFI and FINTRAC shape how this workflow should be documented.

TL;DR:

  • Check visual inconsistencies and PDF metadata first, then combine image forensics, structural analysis, and OCR consistency rather than trusting any single detector.
  • Verify income and identity through independent sources, and route suspicious files to trained reviewers with localized evidence and a written decision before underwriting proceeds.
  • Buyers should require explainable flags, audit logs, and Canadian data residency; internal systems suit teams with mature machine learning and unique datasets.
  • FINTRAC requires identity records for at least five years and production within 30 days of a request; preserve originals and review evidence.
Autowrite
Spend Less Time on Mortgage Paperwork
Autowrite streamlines mortgage document intake, classification and data extraction, helping brokers manage paperwork while keeping compliance in view.
Explore Autowrite

Table of Contents

Quick fraud red-flag checklist and triage steps

Before any file reaches a deeper automated scan, a quick visual and structural pass catches a surprising share of tampered documents. Fonts that shift mid-paragraph, inconsistent spacing around dollar figures, blurry logos, or a signature that doesn't match other pages in the file are common giveaways. CMHC lists common mortgage fraud types and red flags that lenders should watch for, and many of them show up first as these visual inconsistencies.

A fast triage checklist should cover:

  • Visual inconsistencies: mismatched fonts, uneven spacing, distorted logos, or signatures that differ from other pages in the file.
  • File-level checks: PDF metadata, creator and editor fields, timestamps, embedded fonts, and unusual file size or compression artifacts.
  • Cross-document checks: stated income that doesn't match bank deposit patterns, or an employer phone number that doesn't match public records.
  • Triage routing: send the file to an automated scan, request the original from the source, or escalate directly to manual review.

Our list of mortgage fraud red flags covers the most common patterns brokers encounter during intake.

How automated tampering detection actually works

Automated detectors generally rely on three technical approaches, each catching something the others miss. Image forensics looks for pixel-level artifacts: noise inconsistencies, compression mismatches, and edge irregularities around areas that were copied, pasted, or digitally altered. These methods can localize exactly where an edit likely happened, which is useful evidence for a human reviewer.

PDF structural analysis and metadata inspection look underneath the visible page. A document that claims to be a scan but carries a creator string from editing software, missing embedded fonts, or object streams that don't match the stated page count is a strong tamper signal, even when nothing looks wrong visually.

OCR combined with natural language processing extracts every field and checks it for internal consistency: does the stated income match the math on the pay stub, does the template match other documents from the same employer, and does any field contain a value that's statistically unusual for that document type.

No single signal is reliable alone. Combining scores from image forensics, metadata checks, and OCR consistency into one fused risk score reduces false positives significantly compared with relying on any single detector, which is the pattern AWS demonstrates in its mortgage fraud detection pipeline.

Three detection signals combine into a risk score

Build vs. buy: vendor questions and procurement checklist

Deciding whether to build tamper detection in-house or buy a vendor solution comes down to a few practical factors: how fast you need results, where your data has to reside, how the tool integrates with your loan origination system, how explainable its flags are to an underwriter, and the ongoing cost of maintaining models as fraud patterns evolve.

Before signing with any vendor, ask about:

  • What data trained the detection models, and how often they're retrained.
  • How false positives are surfaced and how reviewers can override a flag.
  • Whether decisions come with explainable evidence, like localization masks or audit logs, not just a score.
  • Where data is stored and processed, and whether that meets Canadian residency expectations.

Building in-house only makes sense when you have mature ML capability and a dataset vendors don't have access to. For most brokerages, the procurement red flag to watch is a vendor that can't explain why a document was flagged. A black-box score with no evidence is close to useless in front of a regulator or an insurer.

Practical implementation pipeline: from intake to decision

A working tamper-detection pipeline follows a predictable sequence, whether built in-house or assembled from vendor components.

  1. Intake: enforce acceptable file formats and minimum scan resolution, and require the original file when anything looks suspicious at upload.
  2. Classification and OCR: route each document by type and extract fields with a confidence score, flagging low-confidence extractions for review.
  3. Tamper detection: run image forensics, metadata checks, and template-similarity comparisons, producing a combined risk score with localization evidence showing where an edit may have occurred.
  4. Rules engine: map risk scores to actions (approve, review, or reject), and log every decision with the inputs that drove it.
  5. Human-in-the-loop review: display evidence masks, metadata findings, and source comparisons side by side, and require a written adjudication note before closing the file.
  6. Integration: push outputs into the loan origination system, CRM, and fraud case management tools so flagged files don't get lost between systems.

Pro Tip: Start with deliberately conservative thresholds that over-flag files, then use reviewer feedback to retrain and tighten thresholds over time rather than guessing at the right cutoff on day one.

This mirrors the production pattern AWS describes using Amazon Textract for extraction and Amazon Fraud Detector for rules-based scoring, where mid-confidence cases route to human reviewers while clear approvals and clear rejections move automatically.

Regulatory and recordkeeping obligations to consider

OSFI's Guideline B-20 expects federally regulated financial institutions to maintain mechanisms for detecting, preventing, and reporting misrepresentation, including falsified income documents, as part of standard underwriting practice.

Separately, FINTRAC requires mortgage brokers, lenders, and administrators to verify the identity of every person for whom a mortgage loan record is kept, and to retain those records for at least five years.

When tampering is suspected, structure your evidence export to include the original file, extracted fields with confidence scores, localization masks or annotated images, the metadata dump, and the reviewer's written decision, all bundled together with timestamps. That bundle is what makes a later investigation or insurer report defensible. For identity verification methods that satisfy FINTRAC specifically, our guide to FINTRAC client ID methods breaks down acceptable approaches.

Autowrite: an operational example and how document intelligence helps

Document intelligence platforms built for mortgage workflows generally cover classification, OCR and field extraction, and workflow routing, which gives a tamper-detection rules engine clean inputs to score against. We built Autowrite to handle classification, extraction with line-level confidence scoring, and audit-ready exports as part of the broker workflow, which matters because a tamper flag is only as useful as the evidence behind it.

When piloting any automation layer alongside tamper detection, the metrics worth tracking are extraction accuracy, hours of manual review saved per file, and the false-positive rate once thresholds settle. Outputs like confidence scores and flagged-field lists feed directly into a rules engine, and the same audit trail that supports underwriting also supports a later fraud investigation or insurer report. Our primer on mortgage document automation covers integration patterns in more detail.

Autowrite: an operational example and how document intelligence helps — overview diagram

Practical perspective: prioritize risk, not perfection

Chasing a perfect detector is the wrong goal. Put your effort into the highest-risk document types, income verification and appraisals, where falsification does the most damage. Run small pilots, measure outcomes, and tune thresholds instead of trusting a vendor's default settings. No automated system replaces a human reviewer on edge cases, and that human judgment is also what keeps the process auditable.

— Anant Bawa

How Autowrite speeds document processing and supports tamper-detection workflows

Autowrite

Running tamper detection on top of a slow, manual intake process just adds another bottleneck. We built Autowrite to handle document classification, OCR extraction with line-level confidence, and workflow routing so flagged files move straight into review instead of sitting in an inbox. Every extraction and routing decision generates an audit-ready export, which gives a tamper-detection rules engine clean evidence to work from. If you're piloting automation alongside fraud detection, track time saved per file, extraction accuracy, and how much manual review workload drops during the trial. Our Starter, Pro, Legend, and Enterprise plans include a 14-day free trial for licensed brokers who want to test this before committing.

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

FAQ

What are the most common signs of a tampered mortgage document?

Common signs include mismatched fonts or spacing, blurry or resized logos, inconsistent signatures across pages, and PDF metadata showing an editing tool instead of a scanner. CMHC lists additional fraud typologies that lenders should monitor as part of routine review.

Can automated tools detect altered pay stubs or appraisal reports?

Yes, automated image forensics and metadata analysis can flag pixel-level edits and structural inconsistencies in pay stubs and appraisal reports, often before a human reviewer would notice anything visually. AWS has demonstrated a production pipeline combining document classification, extraction, and tamper scoring for exactly this purpose.

What records must lenders keep after verifying a mortgage applicant's identity?

FINTRAC requires mortgage brokers, lenders, and administrators to keep identity verification records for at least five years, and those records must be reducible within 30 days of a request.

What should a broker do after confirming a document was tampered with?

Escalate the file to a designated fraud review process, preserve all original evidence including metadata and extracted fields, and follow your institution's reporting obligations under OSFI's misrepresentation detection expectations. Do not proceed with underwriting until the discrepancy is resolved through an independent source.

Does Autowrite replace the need for manual fraud review?

No, Autowrite is built to speed up classification, extraction, and routing so flagged files reach a human reviewer faster, not to replace that review. The platform's line-level confidence scoring and audit exports are designed to support, not substitute for, trained adjudication.

Sources