SUSPICIOUS

scan_rows_copied.jpg

generic 1 page(s) IMAGE evidence score 0.63 (not a probability) sha256 60cc6bf1de78f604…

High-severity evidence of tampering (TL-IMG-002).

Where

Page 1 page 1
1

Findings (1)

#1 high TL-IMG-002 Duplicated image region page 1 · image · confidence 0.90

On page 1, a 1077x102 px region is repeated 0 px right and 225 px down, with 100% of its ink pixels identical. Copy-pasted content inside the same image looks like this.

Evidence
{
  "shift_bin": [
    0,
    75
  ],
  "shift_px": [
    0,
    225
  ],
  "similarity": 1.0,
  "source_px": [
    81,
    446,
    1158,
    548
  ]
}

Checks

DetectorLayerStatusFindings / reason
signaturesstructureskippednot a PDF
revisionsstructureskippednot a PDF
metadatastructureskippednot a PDF
edit-markerscontentskippednot a PDF
fontscontentskippednot a PDF
overlayscontentskippednot a PDF
alignmentgeometryskippednot a PDF
statement-logiclogicskippeddocument type is generic, not a bank statement
invoice-logiclogicskippeddocument type is generic, not an invoice
identifierslogicskippedno text layer
jpeg-gridimageran0
copy-moveimageran1

Read this before acting

  • Findings are evidence for a human reviewer, not proof of fraud.
  • A document rebuilt from scratch in the issuer's own software leaves few structural traces.
  • Edits made before the PDF was generated (for example in a spreadsheet) cannot be detected from the file structure.
  • Image input: only pixel-level checks apply; structure checks need a PDF.

Generated by tamperlint 0.1.0.dev0 on 2026-09-28 06:47 UTC. Report schema 1.0. Findings are evidence for a human reviewer, not proof of fraud.