TL;DR: A fake bank reference letter claims a bank has attested to a customer's account relationship when that bank did not issue the attestation, or issued a different one. In the Association of Certified Fraud Examiners' Occupational Fraud 2026 study of 2,402 cases, creating fraudulent physical documents was the most common concealment method, at 39%, and altering physical documents was next, at 33%. Visual review fails because letterhead is cheap to copy, while the relationship claim, the signatory, and the edit history are what move.
The Letter Claims a Relationship
A bank reference letter is a bank's written attestation that a named customer holds an account and that the relationship meets a stated standard. UK banks call the same instrument a banker's reference or a status enquiry. Trade and onboarding teams often call it a comfort letter. A bank statement is the ledger of transactions and balances. A proof of funds letter attests to a balance for a named transaction. The reference is an opinion about the relationship, and a genuine one often withholds the balance.
Real replies are narrow. Barclays describes a status enquiry as a confidential indication of a customer's finances, given for private use only, without any guarantee or responsibility, and only for accounts with at least six months of credit turnover. Commitment replies are coded: able to meet it, unlikely to enter into it, or going to have difficulty meeting it. The published path is a postal request with signed consent, a fee, and about seven working days. A letter that guarantees a dollar balance, assigns itself, or promises the funds will stay on deposit has left that instrument.
Fake letters arrive in two production classes. Edited-after-creation starts with a genuine letter and changes the name, date, account, or scope after the bank produced the file, so the letterhead stays authentic. Generated-from-scratch starts from a blank: a template, a lifted logo, or a page built to resemble bank correspondence. Creating fraudulent physical documents led the ACFE study at 39%, altering them followed at 33%, and creating or altering electronic documents appeared in 28% of cases. The altered real PDF walks through a logo check.
Onboarding teams collect the letter to show a business banks somewhere. Trade teams collect it before a first shipment or payment, often beside the invoice. The FATF and Egmont Group report on trade-based money laundering notes that financial institutions do not necessarily verify those documents, and that recycled documentation with few or no edits, including the date, is a signal where prior files are kept. The FFIEC BSA/AML manual treats counterfeit documents as a reason to look past a single page, and lists checking references with other financial institutions as a non-documentary method. The uploaded PDF is the document. The enquiry, on a channel the applicant did not supply, is the reference.
Tells That Still Work, and the Ones That Don't
Letterhead, seal sharpness, and a familiar font catch a letter assembled by someone who never held a real one. A phone number or email on the page is the applicant's callback. An answer shows someone picked up, which is separate from the bank having issued the letter.
The tells that survive connect the page to a record the applicant does not control. A status enquiry hedges, carries no guarantee, and stays inside the reply types that bank publishes. A page that warrants an unencumbered balance, offers itself as collateral, or reads as a transferable instrument has left the document type. The signatory has to be a person or unit that bank authorizes to issue references, checked on the bank's directory or published process, and the sending domain has to be the bank's. A personal mailbox on a formal page is the mismatch the FATF trade report already flags in supporting documents.
Relationship length is testable from a registry. Years of satisfactory conduct for a company formed last quarter fail on a calendar. A short, plausible tenure can still be invented, so the issuer callback is the test. File history is the other tell that survives a clean layout: issue date, creation time, and last modification should cohere, and a scan of a paper original is the benign case when they do not. Agreement with an applicant-supplied invoice is consistency inside one packet. Agreement with the bank's own record is confirmation.
None of these rows, alone, catches a name swap on a letter the bank issued to someone else. One file will not show the earlier copies.
How Detection Actually Works
Detection that holds up reads the file's story before it reads the page, through six classes of signal.
Production method asks how the bytes were made. A letter from a bank's correspondence system carries that pipeline. A file last saved in a desktop editor, converted from an image, or assembled generatively carries a different one. Edited-after-creation and generated-from-scratch are separate findings, since a genuine bank file may sit under a later save. Timestamp trail asks whether creation, modification, and upload cohere with the date on the letter. Scans add noise, so declining every re-save will decline clean files.
Issuer matching asks whether the claimed bank matches the file's structure and that bank's published process. A bank that issues references only through a central desk, on a coded form, after written consent, did not produce a free-form guarantee. Consistency then sets the letter against formation date, legal name, the rest of the KYB packet, and, where the bank will answer, the bank's own confirmation. Two applicant documents that agree have passed a weaker test than one document that agrees with the issuer.
Model artifacts ask whether generative tooling left traces a standard viewer does not show, including a screenshot or image-only PDF that has stripped the production story out. Recycled patterns ask whether this wording, signatory block, account identifier, or exact file has appeared on another applicant. That portfolio check is what KYB document fraud detection adds once one reviewer can no longer hold every prior letter.
What to Do With a Suspect Letter
A flagged letter is a hold, pending a check the applicant does not control. Clearing on letterhead lets the altered real file through. Ask the issuing bank a narrow question through a number or address on the bank's own site, a published status-enquiry desk, or an existing correspondent contact: did you issue a reference for this customer, on this date, with this scope. Leave the contact details printed on the letter unused.
A real bank may refuse. Barclays limits a status enquiry to the enquirer's private use and bars reliance by any other party without written consent, and some banks speak only to another financial institution. Refusal is a limit of the channel. A letter that claims a guarantee the bank's policy withholds is a finding, as is a customer who cannot get a fresh reply through the published process. When they disagree, name the letter, the field, and the failed record: a modification after the issue date, or a relationship that predates formation.
Keep the original. Leave the failed signal out of any message back to the applicant, and ask for a fresh letter through the bank's own channel or set the letter aside for the non-documentary checks the CIP already names. When the packet also holds a statement, an invoice, or a formation document, read each file alone and then against the others, as document fraud in banking does for the wider set. Check a document in the Watchdoc playground before the callback, so the x-ray is on file when the bank answers. The first file is free, and no email is required.
Where Sphinx Fits
Watchdoc scores the file and shows the x-ray: production method, timestamp trail, issuer matching, consistency, model artifacts, and recycled patterns. Published figures are a 94.3% correct verdict, 2.8x more forgeries caught, clean files cleared in under 28 seconds, 1 million documents processed, and $0.45 per document with no seats and no platform fee. The Watchdoc playground is the same check, free to try, including a 50-document free tier. The callback settles the bank's words. The x-ray settles the file.
Frequently Asked Questions
What is a bank reference letter?
A bank reference letter is a bank's written attestation that a customer holds an account and that the relationship meets a stated standard. Banks also call it a banker's reference, a status enquiry, or a comfort letter. It is an opinion about the relationship, often hedged and given without a guarantee, separate from a bank statement, a proof of funds letter, or a standby letter of credit.
How is a bank reference letter different from a bank statement?
A bank statement is a periodic ledger of transactions and balances from the bank's account system. A bank reference letter is a narrative or coded opinion about the relationship, and a genuine one often withholds the balance. Each file in the packet needs its own check.
How do you verify a bank reference letter?
Ask the issuing bank, through a channel the bank itself publishes, whether it issued this letter to this customer on this date with this scope. Leave the phone number and email on the letter unused. A refusal can mean the bank answers only other financial institutions, or that it requires signed consent, so compare the letter's claims with what that process allows.
Can a genuine bank letter still be fraudulent?
Yes. Edited-after-creation starts from a real letter and changes the customer, the date, or the scope after the bank produced it, and a real letter can be reused for a second applicant. Letterhead will pass both. File history and a direct question to the issuer separate them.
Does a bank comfort letter guarantee payment?
A reference or comfort letter attests to a relationship. Barclays states that a status enquiry is given without any guarantee or responsibility on the bank's part. A page that promises funds will remain on deposit, or that offers itself as collateral, is claiming a different instrument.
.png)
