To verify a bank statement, reviewers combine three layers of scrutiny: visual and arithmetic checks on the document itself, a formal Verification of Deposit sent directly to the issuing bank, and, increasingly, a live digital connection that pulls account data straight from the bank’s servers. The first layer catches most amateur forgeries. The second and third confirm the numbers with the bank, leaving the applicant no chance to alter what the lender sees.
Checks You Can Run on the Document Itself
Visual and Formatting
The first pass is a careful look at the PDF. When someone edits a digit or a name in a bank statement, the altered text often sits at a slightly different font size or in a subtly different typeface than the surrounding text. Columns fall out of alignment. Line spacing goes uneven. A character or two tilts. Any of these can prompt a reviewer to escalate the file to a fraud team.
The Math
The simplest and most effective test is arithmetic. Take the starting balance, add every deposit shown in the transaction history, subtract every withdrawal and fee, and compare the result to the printed ending balance. If the two numbers don’t match, the statement has almost certainly been altered. Many forgeries fail here because whoever changed the individual line items forgot to reconcile the totals. This one calculation catches a large share of fakes before any outside verification begins.
File Metadata
Every PDF carries embedded fields that most people never see: the software that created it, the creation date, and the date it was last modified. A statement that claims to come from a major bank but was created in consumer photo-editing software is an immediate red flag. Sophisticated forgers can scrub metadata, but most amateurs leave traces — mismatched creation and modification dates, or an unexpected program listed in the “Creator” field.
Verification of Deposit
When a lender needs confirmation from the source, it uses a Verification of Deposit, or VOD. For conventional mortgages, the process begins with Fannie Mae Form 1006, which the applicant signs to authorize the bank to release account information.1Fannie Mae. Verification of Deposit Form 1006 Without that signed authorization, the bank cannot legally share anything.
Once the lender has consent, it sends the form directly to the bank rather than routing it through the applicant. A bank official pulls internal records and reports back with the current balance, the account’s activity over the previous two months, the date the account was opened, and whether the account is in good standing.2Fannie Mae. Verification of Deposits and Assets Because the answer travels bank-to-lender, the applicant never touches it.
How Recent the Statement Has to Be
Fannie Mae imposes age limits on any bank statement used in a mortgage file. A purchase application requires the most recent 60 days of activity. A refinance requires 30 days. If the most recent statement is dated more than 45 days before the loan application date, the lender must request an updated, bank-generated document showing at least the last four digits of the account number, the current balance, and the date.2Fannie Mae. Verification of Deposits and Assets These freshness rules make it harder to recycle an older forged statement or reuse one someone else prepared.
Direct Digital Verification
Many lenders now skip paper statements entirely by using digital aggregation services such as Plaid, Finicity, or Yodlee. The applicant logs into their bank through a secure interface hosted by the aggregator, and the lender receives read-only access to account data held on the bank’s own servers. The lender never sees the applicant’s login credentials, and the applicant never handles a PDF that could be edited.
Because the data flows server-to-server from the bank to the lender, there is no document to forge. The lender gets a verified report showing real-time balances, transaction history, and account details for the period requested. Fannie Mae accepts these third-party digital verifications as long as the borrower gave proper authorization and the data comes directly from the financial institution.2Fannie Mae. Verification of Deposits and Assets For lenders that use it, this method effectively removes document forgery from the equation.
What Happens When a Statement Fails Verification
A failed verification does more than sink the application. Under the Bank Secrecy Act, banks must file a Suspicious Activity Report (SAR) with the Financial Crimes Enforcement Network (FinCEN) for any transaction involving at least $5,000 where the bank knows, suspects, or has reason to suspect the transaction involves illegal activity, is designed to evade reporting requirements, or has no apparent lawful purpose.3eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions A mortgage application backed by a fabricated statement easily crosses that threshold.
SAR filings are confidential. The bank cannot tell the applicant a report went in. Once the filing reaches FinCEN, though, it becomes available to federal law enforcement agencies investigating financial crimes. The application is denied, and a federal investigation can begin without the applicant knowing.
The exposure from there is not only reputational. Submitting a falsified bank statement to a federally insured lender can be prosecuted under several federal statutes, including 18 U.S.C. § 1014, which carries a fine of up to $1,000,000 and up to 30 years in prison,4Office of the Law Revision Counsel. 18 USC 1014 – Loan and Credit Applications Generally and the government can also pursue civil penalties under FIRREA of up to $1,000,000 per violation, or more where a gain or loss can be measured.5Office of the Law Revision Counsel. 12 USC 1833a – Civil Penalties
The Short Answer for Anyone Reviewing a Statement
If you are on the receiving end of a bank statement and want to know whether to trust it, work through the layers in order. Run the arithmetic first; a mismatch between the transaction ledger and the ending balance is often all the proof you need. Check the file’s metadata for signs of consumer editing software or inconsistent dates. If the stakes justify it, get the applicant to sign a Verification of Deposit and send it to the bank yourself, or ask them to connect the account through a digital aggregator. Each step narrows the room for a fake to survive, and the digital connection closes it entirely.