Edited statements usually break in three places: metadata, math, and layout. A fraud API should check all three and explain itself with a signal list — not a black-box number.
Metadata inspection looks at PDF creator/producer (Canva, Photoshop, and online editors are red flags), creation vs modification dates (mod-before-creation means tampering), and stripped metadata (no creator at all).
Balance-chain validation recomputes the running balance row-by-row from the opening balance and flags every mismatch with its deviation. Clean statements reconcile across all rows; edited ones break exactly where the numbers were changed.
Font and layout checks count distinct fonts across pages — mixed fonts suggest copy-paste edits. Round-number and date-order anomalies add the final layer.
The output is an aggregate 0–100 fraud score (plus a trust score) with a clean / review / suspicious verdict and every triggered signal. Route clean straight through, review the middle, and kick suspicious to manual underwriting.