TL;DR: A fake proof of funds letter is either a genuine bank letter edited after issue to change the balance, date, or name, or a document built on lifted letterhead for an account that does not exist. It shows up in mortgage pre-approval, business acquisitions, investor visa filings, escrow, and crypto OTC onboarding. Cotality's Q2 2026 Mortgage Application Fraud Risk Index found indications of fraud in about 1 in 119 applications. Visual review fails because a competent forgery uses the bank's real template; the letter is only as good as a confirmation from the bank through a channel the letter did not supply.
A Proof of Funds Letter Is the Bank's Statement, Not the Customer's
A proof of funds letter, also called a bank verification or balance confirmation letter, is a short document in which a financial institution states that a named customer held a given balance on a given date. Real ones are issued on request, identify the issuing department and a signatory, and say nothing about whether the funds will be there tomorrow. That third-party status is what makes the letter useful to a lender, an escrow agent, or a visa adjudicator, and it is what a forger borrows.
In June 2026, a forged "proof of account" letter showing $692,678.93 in a U.S. Bank account was used to buy three vehicles and bring an Ohio home purchase to the brink of closing before a title company noticed a wire that never arrived. The account did not exist, the bank did not use that letterhead, and the manager's signature was forged, according to the Scioto County Daily News.
Four production paths cover most fakes. Letterhead lifts take a bank's logo and footer from a real letter and type a new body underneath. Edited PDFs start with a genuine letter and change the balance, the as-of date, or the account holder's name, leaving everything else authentic. Generated letters come from a template or a language model given the bank's name and a target amount. Recycled letters are real documents reused after the funds have moved. The first three are forgeries; the fourth is a genuine document being misused, so the review has to reach the bank, not stop at the file.
Why Lenders and Escrow Agents Keep Seeing Them
Asset documentation is required where fraud opportunity is highest. Cotality's Q2 2026 Mortgage Application Fraud Risk Index found indications of fraud in an estimated 1 in 119 applications, and Cotality's Matt Seguin noted that purchase loans, now 72 percent of volume, require the income and asset documents that streamlined refinances skip.
The FBI's 2025 Internet Crime Report recorded 12,368 real estate fraud complaints and $275.1 million in losses. Most of that is closing-wire fraud, but the two travel together: a fake proof of funds gets a buyer into the transaction and impersonated wiring instructions get the money out. The same document appears in business acquisitions as a stand-in for a financing commitment, in EB-5 and golden visa filings as support for lawful source of funds, and at crypto OTC desks onboarding a counterparty who wants to trade size before settling. A May 2026 DFSA alert describes forged letters asserting that up to $200 million sat in a UAE bank pending a fee; the funds were fictional and the letters were the whole scheme.
Tells That Still Work, and the Ones That Don't
Logo, font, and layout tell a reviewer nothing, because every bank's template becomes public the first time a customer forwards a letter. The tells that survive connect the letter to something outside itself.
Issuing practice comes first. Many large banks do not issue narrative proof of funds letters at all and direct customers to a statement or a balance confirmation from a specific department, so a letter signed by a "branch manager" from a personal email is a mismatch before anyone reads the balance. Verifications addressed to a named recipient's attention, completed the same day they were ordered, or dated on a weekend sit on Fannie Mae's published red flag list, alongside squeezed numbers and mixed type styles. Those visual tells catch amateur edits, not a letter rebuilt cleanly in the bank's own template.
Language is second. The ICC's Financial Investigation Bureau flagged a circulating $200 billion Bank of China letter partly on wording: it described the money as "clean, cleared, unencumbered, legally and of non criminal origin," a phrase bankers do not write and fraud templates recycle. "Blocked" funds and SWIFT message types in a customer-facing letter belong to the same advance-fee genre.
File consistency is third. A balance that exactly matches the down payment and deposits that landed days before the letter date point the same way. A bank statement for the same account is usually more revealing than the letter, because it has many more fields that must agree.
Verify the Issuer, Never the Number on the Letter
The only test that settles a proof of funds letter is confirmation from the issuing bank through a channel the applicant did not provide. The contact details printed on the letter came from the person whose funds are in question; if the letter is forged, so are they. The U.S. Secret Service's real estate scam advisory gives the same instruction for title companies: find a known number on a trusted website and call it. For a bank letter, that means the published verification line, the branch locator on the bank's own domain, or an existing relationship manager, then asking whether the bank issued this letter, to this customer, with this balance, on this date.
Banks will usually confirm that they issued a letter, but many will not confirm a balance to a third party without the customer's authorization, so build that authorization into intake. An emailed confirmation from a domain resembling the bank's is not a confirmation.
How Detection Actually Works on the File
Reading the file first decides which letters deserve the phone call to the bank. Six classes of signal cover edited-after-issue, generated-from-scratch, and recycled letters; they describe what to look for, not how to defeat a check.
Production method asks how the bytes were made. A letter exported from a bank's document platform carries that platform's fingerprint; one that left a desktop PDF editor or a generative pipeline carries a different one. Edited-after-creation is a distinct finding from generated-from-scratch, because a genuine issuer file may sit under a later save, and the case note should say which fields moved. Timestamp trail asks whether creation and modification dates cohere with the date on the letter and the date it was submitted; a letter dated in March and modified the day before an offer deadline needs an explanation, though re-saves create noise, so the trail is evidence to weigh rather than an auto-reject.
Issuer matching asks whether the claimed producer matches the bank on the letterhead, and whether that bank issues letters in this form at all. Consistency is the underwriting check: balance against statements, account holder against identity documents, signatory against the bank's directory. Model artifacts asks whether generative tooling left traces a viewer does not show, including the structural absences of screenshots and image-only PDFs; detecting an AI-generated PDF is a file question before it is a content question. Recycled patterns asks whether this template or signatory block has appeared before across the portfolio; a reviewer looking at one file never sees the fifth copy. Loan document fraud detection follows the same order: establish what the file is, then decide what it proves.
What to Do With a Suspect Letter
A flagged letter is a hold, not yet a decline. Production and timestamp anomalies justify asking for a fresh letter issued directly to the institution; issuer mismatches and language tells go straight to bank verification through published channels. A confirmed forgery is a fraud referral: record which letter, which field, and which independent record it failed to match, in the form a SAR narrative will need. "The letter looked off" is not a basis. "The bank confirmed it did not issue this letter" is.
Recycled genuine letters pass file forensics because the document is authentic; the question is whether the funds are still there, which only a current confirmation answers. Set a maximum letter age in policy and treat anything older as unverified.
Break-test the control. Check a document in the Watchdoc playground with a letter you trust and one you doubt, and compare the x-ray to what the reviewer recorded. The first file is free, no email required.
Where Sphinx Fits
Sphinx scores the letter the way a forensic reviewer would, then shows the evidence. Watchdoc runs six checks, production method, timestamp trail, issuer matching, consistency, model artifacts, and recycled patterns, and returns a verdict with the manipulation highlighted. Published figures: 94.3% correct verdict, 2.8x more forgeries caught, clean files clearing in under 28 seconds, 1 million documents processed, $0.45 per document with no seats and no platform fee. The Watchdoc playground is the same x-ray, free to try, and built for edited-after-creation as well as generated fakes. For the wider control set, see how banks detect fake documents and the companion lander on fake financial statements.
Frequently Asked Questions
What is a fake proof of funds letter?
A fake proof of funds letter is a document that claims a bank has confirmed a customer's balance when the bank did not. It can be a genuine letter edited after issue, a letter built on lifted letterhead for an account that does not exist, an AI-generated letter in a bank's style, or a real letter reused after the funds have left.
How do you verify a proof of funds letter with the bank?
Contact the issuing bank through a channel the applicant did not supply: the verification number on the bank's own website, the branch locator, or an existing relationship manager. Ask whether the bank issued this letter to this customer with this balance on this date. Never rely on the contact details printed on the letter.
Can a legitimate proof of funds letter be a PDF?
Yes. Most legitimate proof of funds letters are delivered as PDFs, and the format alone does not indicate fraud. What matters is whether the file's production method, timestamps, and issuer match a letter the bank actually generated; screenshots and image-only PDFs strip out that evidence and should be treated as unverified.
What are the red flags on a proof of funds letter?
Common red flags include a bank that does not issue narrative letters, a letter addressed to a specific recipient or dated on a weekend, a balance that exactly matches the required amount, phrases such as "clean, cleared, and unencumbered," and a balance the accompanying statements do not support. File-level signals such as post-issue modification dates matter more than logo quality.
.png)
