Gen AI document forgeries are slipping past loan underwriters: What’s the fix?

By Vignesh Krishnakumar, CTO and Co-founder, HyperVerge

Underwriters once caught forged documents by sight because forgeries carried visible mistakes such as a soft hologram on an Aadhaar card, the wrong typeface on a PAN card, or a bank statement whose balances failed to reconcile. Generative image tools have removed those mistakes because a model can now produce an Aadhaar card, PAN card or even a six-month bank statement that is clear and consistent on the screen. Separating a real document from a fake one with a simple visual check is way more challenging than it was before generative image tools entered the picture.

Google released Nano Banana in August 2025 and it quickly became one of the most-used applications in the country. Researchers tested the newer version of the tool in December 2025 and found the output realistic enough to mislead and found that the visible watermark can be cropped out. Google has since disabled the ability to generate government-issued ID cards on Gemini altogether. Every Gemini image now carries an invisible SynthID watermark in the pixel data. While this is great for digital verification, print that image into a physical document and the SynthID has nothing left to read, still leaving a bank employee checking a card at the counter with no metadata to query. So what’s the solution? As RBI Governor Sanjay Malhotra said at FIBAC 2026, “It is AI and AI alone that can help limit AI frauds,” arguing that rules-based detection engines cannot keep pace with fraud that moves as fast as an API call.

Rightly so, as recent research found that digital document forgeries rose by 244% in 2025 and for the first time it overtook physical counterfeits as the most common form of document fraud. This is a serious concern in lending, where India loses the largest share of its fraud value. The Reserve Bank of India recorded bank fraud of ₹17,822 for the 2025-26 fiscal year and the advances category, which covers loans, accounted for the largest share of fraud. Every loan begins with a set of documents and it’s where fraudsters set out to deceive. In my experience, fully AI-generated documents now account for roughly a third of the forgery attempts we catch. Aadhaar accounts for the majority of forgery attempts, with PAN making the remainder because fraudsters concentrate on the documents underwriters trust most.

Underwriting is the point of entry

Unlike fraudulent payments, which a bank can identify and contain, a fraudulent loan file produces a legitimately approved credit line until the first missed payment. By that time, the funds would have usually moved through accounts that fraudsters generally close quickly. The damage compounds after approval and hence, document check is the most effective place to stop fraud.

It’s perhaps why the strain on underwriting is growing quickly. Visual inspection exists to know whether a document looks correct. Generative tools satisfy this standard with ease. Lenders today need verification technology that answers two important questions: Is the document genuine? Did it come from the source it claims?

It’s almost impossible to identify AI-driven fraud with manual review, especially given the speed and scale of digital lending. Financial institutions need automated fraud detection and document verification systems for loan underwriting. While there are numerous such solutions in the market, five capabilities separate solutions that meet the moment from the ones that don’t pass muster.

What great fraud-detection solutions can do

The first is verification against the source. The solution must confirm whether an Aadhaar or PAN card was actually issued by the authority. This is done with cross referencing databases, so a document which looks flawless but matches no record fails.

Second is forensic file analysis capabilities. A genuine bank statement comes as a structured PDF that carries metadata and a digital signature, while AI-generated statements carry the traces of the tools that created them. The solution must read the underlying data rather than the visible image, while flagging content that a model generated or altered.

Cross-document consistency is third. A legitimate application is internally coherent with the name, address and dates agreeing across documents. Fabricated documents are assembled separately and tend to disagree. A good solution flags those discrepancies without having a human prompt it.

Fourth is injection defense, and it matters as much as the document check itself. A fraudster with a flawless forgery does not photograph it. They feed the image straight into the verification flow as a file, so the system inspects a fabrication that never touched a camera. Detection alone cannot win that contest, because generation quality and detection quality are locked in a race. What lenders should demand instead is control of the capture itself: every document and image entering the system through a hardened capture layer at an SDK level that admits only a live, real-world capture and rejects injected or generated media at the point of entry.

Finally, continuous verification closes the set. A check at account opening is just as important as monitoring devices and behavioral signals over time. A file that clears intake and then behaves like a shell account should surface for review before the next disbursement.

For most of the profession’s history, an inconsistent document was a warning sign. With AI-driven fraud becoming more prevalent, a flawless document deserves the same scrutiny because near-perfect forgeries have become cheap to manufacture. Lenders who invest in the right fraud-detection tools will protect themselves from fraud. The moment is now to take preventive measures to stop fraud instead of reacting to incidents once the loss occurs.