How to choose document fraud detection software

Start from your documents, not from a feature list

Before comparing vendors, write down what you actually need: which documents arrive, through which channel, in what volume, and which decision depends on them. A lender checking statements on a loan application does not need the same thing as an accounts team receiving invoices. Be clear about the question too, because it points to the right kind of tool:

• Was the file altered or fabricated? That is the job of detection software, which analyzes the document itself.
• Is the content accurate? Only an outside source can say: an official service, the issuer, a cross-check. A document can be false without any edit, and our guide explains how to verify a document’s authenticity.
• Is this person who they claim to be? That is identity verification, a different type of tool.

Formats and languages

List the formats you really receive: original PDFs, scans, phone photos, screenshots. Ask what the tool can tell you about each one, since a photo does not hold the same information as an original PDF. Check how multi-page documents are handled, and the languages and scripts of your documents, especially for cross-border flows: a tool evaluated on one country’s invoices has not necessarily been evaluated on yours. Ask to see it working.

Ask for explanations, not just a score

A bare score gives your team nothing to decide on, and nothing to say to a customer, applicant or supplier who disputes it. Look at what an analyst actually sees:

• Where: is the anomaly located on the document?
• What: can a non-expert understand it from a comment?
• What next: does the result give a clear level for routing the file?
• Record: can the report be found later in a history?

There is a legal angle too. Under GDPR article 22, as France’s regulator CNIL sums it up, individuals have in principle the right not to be subject to a fully automated decision with legal or similarly significant effects. Where such a decision is allowed, they can still ask for human intervention and an explanation, and contest it. A tool that explains its findings and leaves the decision to your teams makes this easier to respect. Run your process past your data protection officer.

Be wary of accuracy claims. A percentage means little without its protocol: which documents, what share of fakes, which kinds of edits. And a clean result does not prove a document is genuine.

Use the free trial as a real test

Searching for a free trial is sensible, but a trial only helps if you run it like a test on your own documents. Before uploading anything, read what the vendor does with trial files. Then:

1. Build a representative sample

   Take genuine documents from each of your channels and, if you have them, fakes your teams have already identified. Have your data protection officer approve the use of these documents.

2. Add the hard cases

   Poor scans, crooked photos, re-saved PDFs, foreign documents: this is where tools differ.

3. Count false alarms

   These are alerts on genuine documents. They swamp your teams and penalize honest customers, so check whether the explanation makes them easy to dismiss.

4. Count what gets through

   On known fakes, note which ones are not flagged and what they have in common. That shows where to keep a manual check.

5. Have the decision-makers read the results

   Can a case handler understand a result unaided? How long does a file take, from upload to decision?

6. Compare with what you do today

   Judge a tool against your current process, not against an ideal. Note what it adds and what it does not replace.

Integration and API: what to look at

Depending on volumes, a web platform may be enough, or the analysis may need to sit inside your CRM, portal or case management tool. If the API matters, have your developers read its documentation before you sign, and check which plan includes it: a free trial of the product does not always include API access.

• Documentation: is it current, with examples, and readable before signing?
• Flow: how do you upload a file, follow the analysis and read the result? Is processing asynchronous, and is your system told when it ends?
• Authentication: how are API keys created, restricted and rotated?
• Usable output: does the response have a stable structure you can use to route a file automatically?
• Errors and limits: what happens with an unreadable file, a volume spike or a restart after an incident?
• Accounts and roles: do non-technical teams get an interface, and who sees which documents?

Data, GDPR and hosting

Fraud checks mean handling payslips, statements and sometimes health data. If you are subject to the GDPR, a vendor that processes them on your behalf is normally your processor, and it acts only on your instructions. Outside the EU, ask the same questions under your local law.

Reuse of your documents

Ask this first. According to CNIL, a processor may not reuse data for its own purposes on its own initiative. It needs your written approval, and a blanket approval given in advance is not enough: each intended use must pass a compatibility test. If the test fails, you must refuse; if it passes, you remain free to refuse. So check in writing whether your documents are used to train or improve models.

The contract

GDPR article 28 requires a contract. It covers documented instructions, security, your authorization for any other processor with a real chance to object, deletion or return of the data when the service ends, and audits. The processor stays liable for its sub-processors. CNIL’s sample clauses are a useful checklist, even if your contract is in English.

Hosting and security

CNIL advises against using a cloud service with no guarantee of where the data actually sits. Ask where files and results are stored, and who can reach them. A transfer outside the EU must rest on a GDPR transfer tool, such as an adequacy decision or standard contractual clauses. CNIL treats ISO/IEC 27001 and 27701 certifications as a first indication of reliability, and in France a host of health data must hold HDS certification. Your data protection officer will also check whether an impact assessment is needed (GDPR article 35).

Understanding the pricing model

Prices are hard to compare without a common unit. Rerun the numbers with your real volumes:

• Unit: the page, the document, the analysis or the API call? A twelve-page statement costs very different amounts depending on the answer.
• Model: pay-as-you-go suits low or irregular volumes, a subscription suits a steady flow, a quote suits integrated workflows.
• Overage: what is the price beyond the plan, and what happens to unused units?
• Commitment: what term, what notice, what billing period?
• What is included: API, number of user accounts, integration support.
• Indirect cost: integration, training and, above all, the time spent handling false alarms.

A criteria grid and the questions to ask a vendor

Score each criterion from 0 to 2 during the test, weight it by your priorities and decide in advance which ones are deal-breakers:

• Formats: all your formats are supported, and the vendor says what each allows.
• Languages: the tool has been tested on your languages and foreign documents.
• Results: clear verdict, located anomalies, an explanation a non-expert can read.
• Decision: it stays with your teams and can be justified.
• Trial: possible on your own documents, with a written rule for uploaded files.
• Integration: documented API, plus an interface for non-technical teams.
• Reuse: a written commitment on the use of your documents and their results.
• Contract: article 28 clauses, list of sub-processors, what happens to data at the end.
• Hosting: known location, controlled access, any transfers justified.
• Price: clear unit, simulation on your volumes, clear commitment.

Questions to ask

• Are my documents or their results used to train, test or improve your models, including during a trial?
• Where are files and results hosted, and who on your side can reach them?
• Who are your sub-processors, and how will I hear about a change?
• How long do you keep files, and how do I delete them?
• What exactly does an analyst see to understand a result?
• Which cases are beyond your tool’s reach?
• How do you measure performance, and on which documents?
• Which plan includes the API?
• What happens to my data when the contract ends?

A serious vendor can say what its tool does not do. If the answers are neither in the contract nor in the documentation, ask for them in writing.

How Docusan measures up to these criteria

We are hardly neutral here, so these are plain facts to check for yourself, along with what Docusan does not do.

• Formats and languages: PDF, PNG, JPEG and TIFF, for images, scans or PDFs in any language.
• Results: three verdicts (No detection, Warning, Alert) and anomalies located on the document. The decision stays with your teams.
• Trial: a free trial on your own documents before you commit.
• Integration: a platform with a reports history, and, with the Enterprise plan, an API with its documentation, customized detectors and dedicated infrastructure.
• Data: hosting in the European Union (Ireland), documents never used to train or improve the models, optional two-factor authentication (security and privacy).
• Pricing: Top-up, pages on demand with no subscription or commitment; Pro, a monthly or yearly subscription with unlimited user accounts; Enterprise, on quote and with a commitment, for over 1,000 documents a month, with the API, onboarding and technical scoping. The details are on the pricing page.

Its limits: Docusan analyzes the file and does not contact the issuer or government databases. It therefore cannot say whether an intact document tells the truth, and it complements checks at the source. The API is not part of the Top-up plan. For the rest of the grid, put the questions above to us, as you would to any vendor.