Document forensics
Also known as: Questioned document examination · Document authenticity analysis · Document verification · Document fraud detection
The technical examination of a document to establish whether it is authentic — checking security features, fonts, printing and signs of tampering that are not visible to the naked eye.
Legal basis
ICAO Doc 9303 — Machine Readable Travel Documents (security features)
Reading the data on a document is one thing; proving the document is genuine is another. Document forensics examines the object itself: the watermark, microprinting, guilloche background, font and spacing patterns, the response to ultraviolet light, and the marks left by cropping, splicing or reprinting. Many of these security features follow the ICAO Doc 9303 specification for travel documents, and the broader discipline is known as questioned document examination.
In remote onboarding, document forensics is what separates a legitimate driver's license or passport image from a forgery or a genuine document that has been altered — swapping the photo, changing a number, assembling a PDF. It complements the other steps of identity verification: an NFC read proves the chip's signature, facial recognition ties the face to the document, and document forensics confirms that the image of the document itself was neither fabricated nor edited.
Frequently asked questions
What is document forensics?
It is the technical examination that establishes whether a document is authentic, checking security features (watermark, microprinting, UV response), fonts, printing and signs of tampering. In digital onboarding, it is what catches forged documents or genuine ones that have been altered.