Koncile detects tampering in the PDF or scan of an employment verification letter, offer letter or contract, and documents generated or edited by AI, then returns a fraud score from 0 to 100, cross checked with the pay stubs.
Create a free account to run the analysis.
Create a free accountFor document volumes or an API, talk to an expert.
The document checker used by insurers, banks and large companies
4.8 / 5
Start with a database: The Work Number, or the employer's HR department reached on a number you find yourself, never the one printed on the letter. When there is no record (small employer, foreign company, recent hire, self employed), check the document: employer identity, job title, start date and salary against the pay stubs and bank deposits, signer, then the file itself.
The first results on employment verification are about databases, and they should be. But each one answers a different question, and none of them looks at the letter the applicant sent you.
Equifax's service holds employment and income data reported by participating employers. Lenders, landlords and background screeners query it, with the applicant's consent. When the employer is in the base, it is the fastest answer. When it is not, you are left with the documents.
Form I-9 and E-Verify answer one question: can this new hire legally work in the United States. They check identity and work authorization at hiring. They say nothing about a past job, a salary or the letter an applicant uses to rent an apartment or get a loan.
Find the employer's main number yourself, from its website or a public listing, and ask HR to confirm the title, the dates and, where they agree, the salary. A phone number that only works on the letter is one of the most common tricks.
Small employers, foreign companies, recent hires, the self employed: many applicants have no record in any base. That is where the document has to be checked, and where most fakes get through.
Employment letters and contracts arrive as PDFs, scans or photos, and rarely alone. The checker reads the file first, to catch an edit or an AI generated document, then compares the fields with the pay stubs in the same application.
When a PDF is edited, the file often keeps its earlier versions. Koncile rebuilds them and shows the before and after, former salary included. The software that produced the PDF and its dates are compared with the date on the letter: a consumer editor after that date triggers an alert.
On a scan or a photo, K-Detect, our image analysis model, isolates edited areas: an amount erased and retyped, a pasted signature, a rebuilt letterhead. It also flags letters and contracts generated in whole or in part by AI.
Our contract model reads the parties, dates, amounts and termination terms. Employer, start date and salary are compared with the pay stub in the same file. At one client, a pay stub at 40 hours a week sat next to a contract at 165k a year: the two documents did not describe the same job. Full comparison across a whole application is in development.
Every piece of software writes a PDF its own way: object order, numbering, compression. This fingerprint points to the engine that produced the file, even when the metadata was wiped. A letter from the same engine as known fakes inherits their alert.
Knowing what a genuine letter contains is the fastest way to see what a fake gets wrong.
The employer's letterhead and contact details, the employee's name, job title, start date and employment status, often the salary or hourly rate, and the name, title and contact of the person who signs. It is dated and addressed to the person or organisation that requested it.
Every figure on the letter shows up somewhere else: salary and hours on the pay stubs, year to date totals consistent with the start date, net pay as regular deposits on the bank statement, employer name on the W-2. A letter that agrees with nothing else in the file is the signal.
As a PDF sent by email or uploaded to a portal, sometimes as a phone photo. The PDF is the better case: it keeps the software that produced it, its dates and sometimes its earlier versions.
Four cases come up in lending, tenant screening and hiring files. Two leave traces in the file, two only in the rest of the application.
The most common case: an authentic letter or contract whose salary, start date or status was changed in a PDF editor. What gives way: a file saved again after its date, an editing tool in the metadata, the former value still inside the PDF, a slightly different font on the amount alone.
A template, a real or invented company name, a pasted signature, and a phone number that rings a friend. These letters come out of a word processor or a generator, not out of the employer's HR system. A company you cannot find, or a line of business unrelated to the job, are the first signals.
A generative AI assistant writes a convincing letter in minutes, and edits an existing PDF without effort: in an internal test, Claude and ChatGPT edited a PDF invoice with no difficulty. The text is clean, the file is not: an unexpected producer, a structure that looks like no HR system.
A real business signs a real letter for a job that does not exist. The document is authentic and intact, so no file check sees it. Only the application speaks, when the pay stubs show no credible withholdings or the bank statement never receives the salary.
Without a tool, these three checks stop clumsy fakes in a few minutes. Ask for the original PDF, not a photo or a rebuilt copy.
Look up the company's website, address and main phone number from public sources, not from the letter. Call HR and ask them to confirm the title and dates. An employer that only exists on the letterhead stops the file there.
The salary or hourly rate must show up on the pay stubs at the same hours, with year to date totals that fit the start date, and the net pay as regular deposits on the bank statement. A mismatch is the most reliable signal you have.
Use our free PDF metadata viewer: creating software, producer and dates. A letter that went through a PDF editor or an online converter after the date it carries deserves a call to the employer.
Koncile's fraud detection API gives you a score from 0 to 100 and detailed explanations of manipulation risks, right inside your own tools.
Employer, job title, status, start date and salary, ready to cross check.
High, medium or low level, with a one sentence explanation.
High risk from 80.
A one line summary ready for your information system.
curl -X POST https://api.koncile.ai/v1/upload_file \ -H "Authorization: Bearer $API_KEY" \ -F "files=@employment-letter.pdf"requests.post("https://api.koncile.ai/v1/upload_file/", headers={"Authorization": f"Bearer {API_KEY}"}, files=[("files", open("employment-letter.pdf", "rb"))]){ "status": "DONE", "General_fields": { "Employer": {"value": "Example Logistics Inc.", "confidence_score": 0.98}, "Annual_salary": {"value": "165000", "confidence_score": 0.97} }, "Fraud_detection": { "risk_score": 76, "summary": "PDF edited after the letter date: salary inconsistent with pay stub", "signals": [ {"name": "Traces of edits", "severity": "high"}, {"name": "Cross document consistency", "severity": "medium"} ] }}Wherever a letter or a contract stands in as proof of income, a fake opens a loan, a lease or an assignment on false terms. Here is where the checker fits in.
When The Work Number has no record, the letter and the pay stubs carry the file. They are checked together before approval, not after the first missed payment.
Property managers receive employment letters with pay stubs and bank statements. The check runs on receipt, and each document keeps the detail of its tests.
Letters from former employers and contracts arrive in volume, as photos or PDFs. The checker flags the ones that deserve a call before the placement.
Proof of employment checked in seconds at high volume, with every test kept for internal audit and examiners.
A salary changed on a real letter often leaves no visible error. The checker relies on signals invisible to the naked eye, in the file and in the comparison with the other documents.
| Document element | What Koncile checks | What gives an edit away |
|---|---|---|
| Producer software | Creator and Producer of the PDF, compared with what an HR system or a word processor writes | A PDF editor or an online converter after the date on the letter |
| File dates | Creation and modification dates, compared with the date on the document | A file modified weeks after it was signed, dates rewritten or missing |
| Saved versions | Versions appended at the end of the file, dormant objects | The former salary or start date still inside the PDF |
| Fonts | Embedded fonts and encoding, field by field | An amount retyped in a different font from the rest of the letter |
| File nature | Native PDF, scan, photo or hybrid file | A signature or a logo pasted as an image on a native PDF |
| Image | On a scan or a photo: edited areas and AI generated parts, with K-Detect | A flat patch under the salary, text laid over the original image |
| Document fields | Parties, job title, status, start date, salary, hours, termination terms | Hours that do not fit the salary, a status that contradicts the pay stubs |
| Consistency across documents | Employer, start date and salary compared with the pay stub | A salary or a start date that changes from one document to the next |
An employment letter carries a salary, an address and sometimes a Social Security number. Founded by a former lawyer, Koncile was built with data protection at the core of its architecture: third party SOC 2 audit, GDPR compliance, secure hosting. Documents are encrypted, deleted after analysis and never used to train a third party model.
Through a database such as The Work Number, with the applicant's consent, or by calling the employer's HR department on a number they find themselves. When neither answers, they rely on the documents: employment letter, pay stubs, W-2 and bank statements, which must all tell the same story.
A letter from an employer confirming that a person works there, with the job title, start date, status and often the salary, signed by someone in HR or management. Lenders, landlords and immigration services ask for it as proof of income or employment.
Many lenders do, often through The Work Number or a call to the employer. Landlords and hiring teams are less consistent, and that is where edited letters slip through. Checking the document takes seconds, a call takes longer: do the first on every file, the second on the doubtful ones.
Company letterhead, full contact details, the employee's name, title, start date and status, salary if agreed, a date, and a named signer with a title and a reachable work contact. A letter with only a mobile number or a free email address deserves a second look.
Find the employer yourself and call HR. Match the salary with the pay stubs and the bank deposits. Then read the file: a letter edited in a PDF editor after its date, or one that keeps a former salary inside the PDF, is a red flag.
It can help, mainly to spot an unlikely salary or an inconsistent date. It lacks three things: models specialised in images edited or generated by AI, knowledge of the traces each editing tool leaves, and the comparison with the pay stubs in the same file. A language model is only one part of the machine.
It does not see a genuine letter signed by a complicit employer for a job that does not exist: the document is authentic. Full comparison across a whole application is still in development. On a photo, the original file's metadata is lost and only the image is judged.
It depends on your volume. The price combines a base subscription and a cost per page or per document processed. The plans are detailed on the pricing page.
Yes. Koncile complies with SOC 2 and GDPR, and an independent firm certifies our security and data protection. Your documents are hosted securely with a provider that itself holds SOC 2 and ISO 27001 certifications.
Each document gets its own method: a proprietary ML model for photos, known metadata and forensics for native PDFs, and contextual cross checks.
Inflated balances, deleted lines, a PDF rewritten with software other than the bank's.
See the detection
Net pay changed, contributions that do not match gross pay, a layout that does not match the payroll software.
See the detection
Photo replaced, date of birth or number changed, an MRZ that no longer matches the fields.
See the detection
Edited amounts, wrong VAT, duplicates and made up suppliers.
See the detectionUpload your bank statements, pay stubs or IDs: Koncile extracts the data and flags fakes in seconds.
Talk to an expert
