TL;DR: Fake document templates are editable PSD, DOCX, or PDF layouts of bank statements, pay stubs, utility bills, and corporate certificates sold as "novelty" items or through Telegram and dark-web storefronts. A file built from one has no issuance history, and the same skeleton reappears across unrelated applicants. When Dutch police and the FBI seized one fake-document marketplace, its servers held 636,847 user accounts and 915,655 generated documents. Visual review misses a competent fill; the file's production method, timestamps, and issuer fingerprint do not.
What a document template farm actually is
A document template farm is a storefront that sells editable layouts of real institutions' documents: bank statements, pay stubs, utility bills, and corporate paperwork such as certificates of incorporation. The buyer downloads a PSD, DOCX, or fillable PDF, types in a name and balance, exports, and submits.
In 2018 the FTC shut down three operators whose sites sold fake pay stubs, bank statements, tax forms, and utility bills for $19.95 to more than $150 each. The sites called the products "novelty" items and did not mark the documents as fake.
Distribution has moved to Telegram and crypto-paid marketplaces. In April 2026 the Dutch National Police reported what they found on the servers of a fake-document platform taken offline with the FBI the previous August: 636,847 registered users, 915,655 documents generated between May 2023 and August 2025, and turnover above 3 million euros in its final year.
Two properties of a template-made file follow from this business model. The file has no issuance history, because no bank renderer or payroll engine ever produced it. And because the template is sold to many buyers, the same skeleton shows up across applicants who have nothing to do with each other. Both are detectable; neither is visible on the rendered page.
Three production paths, one question
Three routes produce a fake financial document, and each leaves different evidence. An edited real document starts as a genuine export. The applicant changes a balance in a PDF editor and saves. The issuer's original fingerprint is often still present; what changes is the file's history: a later modification date, an appended revision, a font subset that appears only on the altered line. The guide to spotting a fake bank statement covers this path.
A template fill starts from a purchased layout. The page mimics the issuer. The file does not. Its Producer string, fonts, and object structure belong to the software the buyer used, not to the institution in the header.
A fully generated document is synthesized by a model, sometimes prompted with a template as a style reference, then wrapped in PDF bytes. FinCEN's November 2024 alert flagged generative AI being used to create falsified documents that circumvent customer identification, and the FBI's 2025 Internet Crime Report logged 22,364 AI-related complaints and nearly $893 million in losses. See detecting an AI-generated PDF for that path.
The frame that survives all three is whether the file was edited after creation, and whether its story matches the claimed issuer. A genuine statement is born once, by the bank's pipeline, and not touched again. An edited-real file is rewritten by the customer; a template fill or generated file is born by the wrong parent entirely. The question is not "does this look like a Chase statement" but "was this file produced the way Chase produces statements, and has it changed since." That framing is why generative AI document fraud raised the cost of skipping the detection program without changing what it checks.
Tells that still work, and the ones that don't
Visual tells catch cheap fills: a stale logo, a footer that does not match the statement period, running balances that do not reconcile. Worth a glance, not a control: a careful buyer fixes all of them, and the seller often ships correct branding and arithmetic already.
Structural tells are harder to fix from inside a design tool. Institutional pipelines emit a recognizable production method; a template fill exported from a consumer editor carries that editor's fingerprint instead. A PDF that claims a national bank and reports presentation software as its Producer has told on itself before anyone reads the balance.
Recurrence is the tell unique to templates. One suspicious file is an incident. The same skeleton or metadata pattern across dozens of applicants at different addresses is a product line, and no analyst reviewing one file at a time can see it.
What no longer works alone is looking. The AIForge-Doc benchmark from Duke and NYU researchers forged single numeric fields on real receipts with consumer AI inpainting tools and asked GPT-4o to find the edit. It scored an AUC of 0.509, chance level. The visible page is no longer where the evidence lives.
How detection actually works
Detection reconstructs the file's story and compares it to the story the page claims, six reads weighed together so one odd field cannot convict a clean re-save.
Issuer matching asks whether this file was made the way the named institution makes documents. Real issuers have stable issuance patterns: the same rendering engine, fonts, and page geometry every time. A template fill imitates the layout and misses the pipeline; known-good samples from the same issuer sharpen the comparison.
Template skeleton fingerprinting asks whether the file's underlying structure matches a layout already in circulation. The fingerprint is not the logo. It is the arrangement of objects, the field positions, the placeholder text and dummy merchant names a seller shipped as examples, all stable across fills because the seller built the layout once and sold it many times.
Recycled patterns extend that comparison across the applicant base. When the same skeleton or metadata profile appears under different names and addresses, the template becomes the unit of analysis. Recurrence also separates a template farm from legitimate shared layouts: a payroll provider's standard pay stub recurs across thousands of employers too, but with a production method that matches the provider and deposits that reconcile.
Production method and timestamp trail together answer the edited-after-creation question. A single-pass file with matching dates is consistent with a one-shot export. An institutional Producer followed by a consumer editor's revision is consistent with a real document rewritten. A consumer Producer with no institutional history is consistent with a template fill. Signing workflows also append revisions, so the trail is evidence, not a verdict.
Model artifacts cover the generated fills. When a buyer uses an inpainting model to write a new balance into a template or a real statement, that region carries computational residue a bank renderer would never leave, including image objects where the issuer would have emitted vector text. The check is strongest on raster regions and weakest on text typed by hand.
Consistency closes the loop. Running totals should sum, dates should order, withholding should match the stated gross. Buyers change only the numbers that matter to them, so a fill often gets the chrome right and the arithmetic almost right. The same order applies across document fraud detection in banking: structure and history first, pixels last.
What to do with a template-sourced file
Keep the original bytes; a screenshot or flattened print destroys the Producer string, revision chain, and object structure that carry most of the evidence. Escalate when the production method cannot be the issuer's, when the skeleton matches a known template or recurs across applicants, or when a generated fill shows up in an image layer. Route it to fraud or EDD with the evidence attached.
Break-test with a re-export. A genuine customer can download a second statement from their portal whose Producer and timestamps look like the first. A template buyer cannot; there is no portal behind the file. For a suspect pay stub, ask for the payroll provider's native export or a deposit record that reconciles to it.
When a template match is confirmed, treat it as a typology. Search the queue for the same skeleton, record the decision as production method plus evidence for the SAR narrative, and check a document against a known-good export from the same issuer in the same session.
Where Sphinx fits
Sphinx Watchdoc scores a file on arrival and shows the x-ray behind the score, including whether the file was edited after creation. Across more than 1 million documents processed, Sphinx reports a 94.3% correct verdict and 2.8x more forgeries caught. Pricing is $0.45 per document, no seats, no platform fee. The Watchdoc playground is free for a first file, no email required, with a 50-document free tier.
Frequently Asked Questions
What are fake document templates?
Fake document templates are editable PSD, DOCX, or PDF layouts that imitate real bank statements, pay stubs, utility bills, and corporate certificates, sold as novelty items or through Telegram and dark-web storefronts. A buyer fills in names and balances and exports a file that was never produced by the institution on the page.
How can you tell a document was made from a template?
Compare the file's production method to the claimed issuer. A template fill carries the Producer string, fonts, and object structure of a design tool rather than a bank's rendering pipeline, and it shares a skeleton with every other buyer's file, so the same layout recurs across unrelated applicants.
Is using a document template always fraud?
No. Small businesses issue invoices from templates, and payroll providers use one standard layout across thousands of employers. Legitimate shared layouts carry a production method that matches the provider and figures that reconcile. Fraud is the mismatch: a file that claims an issuer whose pipeline never touched it, or a real document edited after creation.
Why does a template-made document have no issuance history?
Genuine statements are produced once by the issuer's system and carry that system's fingerprint in the file's metadata and structure. A template fill is produced by the buyer's software, so there is no institutional origin to trace and no portal that can re-export it, which is why a fresh native download is an effective break-test.
Can visual review catch template-based fakes?
Not reliably. Current templates ship with correct branding and math. Research on AI-edited financial documents found GPT-4o scored at chance level when asked to spot altered fields. The dependable evidence is in production method, timestamps, and recurrence across submissions.
.png)
