TL;DR: A fake brokerage statement is a PDF or image offered as proof of assets that misstates positions, cash, or market value. The FBI's 2025 Internet Crime Report logged $8,648,617,756 in investment-fraud losses across 72,984 complaints, including cryptocurrency investment scams in which victims were shown fake profits. Visual review still catches a crooked logo, while competent fakes show up in file history and in whether the stated total can be derived from the positions and cash.
What a fake brokerage statement actually is
A fake brokerage statement claims to be a carrying firm's account statement but was changed after the firm produced it, or was never produced by a firm at all. Lenders use it as proof of assets for a down payment or reserves. Private-wealth desks use it to corroborate investable assets at onboarding. A fake bank statement can inflate a deposit balance. A brokerage statement can invent a portfolio.
Edited-after-creation starts with a real export. Someone opens a genuine PDF and changes a field the reviewer will rely on, then saves. The fields that move a credit or onboarding decision are market value, cash, the account number, the statement period, the account holder, and a position line. The tell is the later revision.
Generated-from-scratch never passed through a carrying firm's statement job. Template kits and generative models assemble a firm name, a list of positions, and a total that can already agree, because the arithmetic was done before export. The tell is the missing production chain. The FBI's 2025 Internet Crime Report recorded $8,648,617,756 in investment-fraud losses and 72,984 investment complaints. Cryptocurrency investment fraud alone was $7.2 billion, and victims of those scams were shown fake profits on platforms that were not real accounts. Those figures are scam losses reported to IC3.
Fannie Mae's Selling Guide accepts an investment portfolio statement when it identifies the institution and the borrower, shows at least the last four digits of the account number, covers the period, lists all purchase and sale transactions, and shows the ending balance. Purchases need the most recent two months, or the most recent quarter if the account reports quarterly. Refinances need one month, or the most recent quarter.
FINRA Rule 2231 requires a quarterly account statement when the account held a securities position, a money balance, or activity, with opening and closing balances on the front and the introducing and carrying firms identified. Assets the member does not carry must be separated, labeled as a courtesy, and disclosed as valued from the customer or another external source that may sit outside SIPC coverage. A quarterly period is normal under the rule, so period length alone is not a red flag. A hunt for smudged numbers misses a generated file. A hunt for AI-looking pages misses one edited market-value field on a real statement.
Tells that still work (and the ones that don't)
Practical red flags still catch amateur work. They do not certify a competent fake as genuine.
Position math still matters. The stated market value should be supportable by the position lines and the cash on the same page. A total that cannot be derived from the lines is a reason to stop. A generated file totaled before export will pass, so arithmetic alone is not a verdict. The account holder should match the applicant, the account mask should stay stable, and the period should cover what the program requires. A ticker, share quantity, or quoted value that could not have appeared on that statement date is a consistency failure.
Courtesy holdings are the tell a bank-statement review never sees. A real statement may list assets the firm does not carry, set apart, with a disclosure that the customer supplied the valuation and that SIPC coverage may not apply. Rolling those holdings into the carried total presents outside assets as if the broker holds them. Visual seams still matter when they show up: mixed type in a value column, a logo that does not match the body, compression around one figure. A familiar layout is not proof the firm issued the file.
File history is what the screen cannot see. A genuine export is usually created once, then downloaded. A later change in market value, cash, or a position field is edited-after-creation. A design-tool creator string, or a page rasterized and re-wrapped as a PDF, is generated or laundered. Cotality's 2025 Mortgage Fraud Report estimated that 0.86% of mortgage applications in the second quarter of 2025, about 1 in 116, showed indications of fraud, with the national index up 6.1% from a year earlier. That is application-level risk, not a brokerage-statement forgery rate. Document fraud in banking covers identity documents and whole packages.
How detection actually works
Detection reads the file the way an examiner reads a statement: what produced it, when, for which account, and whether the positions, the cash, and the object graph agree. Six checks describe that story.
Production method separates a portal export, an office edit of a real file, a template kit, and a generative render. A higher market value on last quarter's real statement is usually edited after creation. Timestamp trail checks creation time, modification time, and object revisions against a download-and-submit path. A rewrite after export in market value, cash, or a position field is the edited-after-creation case. Generated files often have a single birth and no firm trail.
Issuer matching tests whether the page behaves like that firm's statement: column order, the carrying-firm name, the SIPC line, account masking, and the split between carried and courtesy assets. A generated file can copy an older layout and still miss the current template. An edited real file usually passes, so issuer matching alone is not a verdict. Consistency is the account holder, the mask, the period, the trades, and whether positions plus cash support the stated market value. It catches a one-cell edit and misses a generated statement calculated before export.
Model artifacts look for generative residue as a class of signal, not a watermark to circle by eye. Recycled patterns look across files for the same position block or account mask on unrelated applications. Document fraud statistics describe that reuse. A market-value field rewritten after creation, on a page that also fails consistency, is a case. A normal re-save of an untouched download is noise.
What to do with a suspect file
Do not coach the applicant on how to resubmit a cleaner PDF. Treat the file as evidence, follow written policy, and keep the original upload. If the submission was a photo of a brokerage app, ask for the native statement PDF and compare the two.
Check the account holder, the account mask, the period, purchases and sales, and whether the lines and cash support the stated market value. Courtesy holdings should stay separated from assets the firm carries. If those fail, the file is already a decline-or-escalate candidate. Then break-test the bytes. Analysts can check a document in the Watchdoc playground on the original upload and attach the x-ray to the case. The playground is free for a first file, with a 50-document free tier and no email required on that public tier.
Disposition follows policy: condition, decline, or escalate. Verification with the carrying firm, or with an asset-verification vendor the lender has already approved, remains the ground truth for the account. File a SAR when the facts support suspicious activity, record the class of signal, and do not tell the applicant which check failed. In a credit file these pages sit inside loan document fraud detection.
Where Sphinx fits
Sphinx Watchdoc scores the statement, shows the x-ray, and returns a verdict with evidence. Production runs have posted a 94.3% correct verdict, 2.8x more forgeries caught versus the prior review path, and under 28 seconds to clear clean files, across more than 1 million documents processed. Live scanning is $0.45 per document, with no seats and no platform fee. The Watchdoc playground runs the same check on a sample file. Sphinx does not replace a call to the carrying firm or a third-party asset verification. It reads the file so a visual pass is not the last line on a balance the statement can invent.
Frequently Asked Questions
How can you tell if a brokerage statement is fake?
Check the account holder, the account number, the statement period, and whether the position lines and cash support the stated market value, then read the file history. Edited-after-creation shows up as changes after the original export, often in market value or cash. A generated file has no carrying-firm production chain, and a tidy logo is not proof the firm issued the page.
How is a fake brokerage statement different from a fake bank statement?
A bank statement shows deposits, withdrawals, and a cash balance. A brokerage statement shows securities positions, cash at the broker, purchases and sales, and market value. Inventing a portfolio can qualify mortgage reserves or a wealth relationship that a checking balance alone would not.
What must an investment portfolio statement show for a mortgage?
Fannie Mae accepts an investment portfolio statement that names the institution and the borrower, shows at least the last four digits of the account number, covers the period, lists every purchase and sale, and shows the ending balance. Purchases generally need two months, or the latest quarter if the account reports quarterly. Refinances need one month, or the latest quarter.
Do screenshots of a brokerage account hide a fake balance?
A screenshot or photo of a brokerage app drops creation stamps, incremental PDF history, and many producer strings. Ask for the native PDF and compare it with the image. The image can still fail when the lines do not support the stated total, but it no longer shows whether a real statement was edited after creation.
Should a suspect brokerage statement be rejected automatically?
Follow written credit and onboarding policy. A failed forensic check is a reason to condition, decline, or escalate, and to keep the original file. Consider a SAR when the facts support suspicious activity, and do not tell the applicant which signal failed.
.png)
