How to Spot a Fake Proof of Address

Most guidance on spotting a fake proof of address assumes that the document has been tampered with, and teaches users to look for the evidence of tampering, such as mismatched fonts, dates that do not agree with each other, or a logo sitting at the wrong resolution. That advice is useful, but it only covers half of the problem.

A proof of address can fail for a second reason that leaves no trace on the page at all, which is that the document is entirely genuine and the address printed on it is simply not the address where the customer lives.

This article covers both failures, what separates them, and which check catches each one.

What is a Fake Proof of Address?

A proof of address is a document showing a person’s full legal name next to a residential address, issued by a third party such as a utility company, a bank or a government body. A fake proof of address is any document that fails to prove the customer lives where they say they live.

In the first, the file itself has been interfered with. In the second, the file is untouched and the address on it is the problem.

What Documents Can Be Used as Proof of Address?

Accepted documents vary by regulator and by institution. The table below lists some of them.

What are the Most Common Types of Fake Proof of Address?

Fake proof of address documents usually are of three types that are:

Edited Templates: A blank copy of a real bill layout, completed with invented details. The layout is authentic and everything filled into it is false, so the account number, billing period and usage figures rarely make sense as a set.

Generated Documents: A complete forgery, with the issuer’s fonts, layout and branding rebuilt from scratch. No part of it began as a real document, so there are no editing traces for a forensic check to find.

Real Documents used by the Wrong Person: Not a forgery at all. The bill is authentic and unaltered, and what fails is the link between the person and the address, either because the document belongs to somebody else or because the address is not a proof of residence.

How Can you Tell If a Proof of Address is Fake?

Here are some red flags that a reviewer can check to detect if a proof of address is fake.

• Fonts, weights, or letter spacing that change between fields on the same page
• An issue date, a billing period, and any usage figures that do not agree with each other
• Missing issuer detail, with no account reference, no customer service number and no registered address for the provider
• Resolution that is unusually high, which suggests a re-exported edited file, or unusually low, which hides edits
• An address written in a format the named issuer does not use

How does Proof of Address Verification Work?

Proof of address verification runs three checks, not one. Each check answers a different question, and skipping one leaves a specific type of fake unexamined.

Check the document has not been altered

Automated analysis examines what a person cannot see. That includes pixel-level inspection for areas that have been cloned or overwritten, compression patterns that differ across the page, and the file’s own metadata, where creation and editing timestamps sit inside every PDF. A bill edited shortly before it was uploaded is a strong signal on its own. This check catches an altered or generated file, and nothing else.

Check the address exists and can receive post

Address validation is a separate check that queries authoritative databases to confirm the address is real and reachable by post. A fake address check at this layer catches an office block, a mail-forwarding depot or a public building, even when the document passes every integrity test. What it does not tell you is who lives there.

Check data the customer does not control

FATF Recommendation 10 requires firms to verify a customer using reliable, independent source documents, data or information, and Article 13 of the EU’s Fourth Anti-Money Laundering Directive uses the same wording. A PDF the customer selects, produces and uploads is neither reliable nor independent, because the customer controls it from start to finish. Docless verification, meaning a check that confirms residency against trusted third-party data with no upload, is what links the named person to the address. This is the check that catches a genuine bill borrowed from a relative.

How can Businesses Prevent Proof of Address Fraud?

Address fraud detection at scale rests on three controls, and none of them depends on a reviewer noticing anything.

Set clear document rules for each country

Decide in advance which document types you accept in each market and how old they may be, then apply that automatically. Most programmes use a three-month window. Rules held in a policy engine apply the same way every time, which is difficult to achieve across a team of individual reviewers.

Watch for one address across several accounts

Velocity monitoring, meaning automated tracking of how often the same data point repeats, flags an address that appears on several new applications. A cluster of applications from a single Proof of residential address over a short period is worth a review, because money mule networks, where criminals move funds through accounts opened in other people’s names, often register several accounts to one place.

Ask for a document only when the risk calls for it

Run the fast, low-friction check first, then request a document when database coverage is thin or a risk signal fires. Genuine customers finish quickly, which protects conversion, and reviewers spend their time on the applications that need a human decision.

How Shufti Handles Fake Proof of Address

Teams often buy forensic tooling, watch forged documents start failing, and then find their fraud losses sitting roughly where they were. The reason is that the losses were never coming from altered files. They were coming from real documents that named the wrong address.

Shufti address verification runs both checks in one decision. Forensic document analysis applies more than 500 Shufti-built detectors per document, covering metadata inspection, PDF modification tracing and generated-document detection. Address validation then queries global databases in real time to confirm the address is real and reachable by post. Layout-aware extraction reads the customer’s address instead of the issuer or branch address printed on the same page, so a genuine resident is not rejected because the system reads the wrong line.