Inscribe just flipped a ranking we have been watching for years. For the first time, utility bills overtook bank statements as the most common AI-generated document hitting financial institutions. Utility bills landed at 21.3% of AI-generated fakes. Bank statements at 17.6%. Payslips at 17.5%. The document your compliance team probably treats as paperwork is now the most weaponized one in the fraudster toolkit.
And here is the uncomfortable part. Most onboarding teams run a dozen checks on a payslip and a full reconciliation on a bank statement, then accept a proof of address that a motivated teenager could forge in ten minutes. At VerifyPDF, we see the damage every day. This post explains why fake utility bills became the soft underbelly of onboarding, and what actually closes the gap.
Why utility bills jumped to the top of the fraudster playbook
Fake utility bill fraud did not surge because criminals got smarter. It surged because utility bills are the easiest win on the compliance checklist.
Think about a bank statement for a second. It has to balance. Transactions settle on business days. Reference numbers follow patterns. A fraudster who edits one line in a bank PDF then has to reconcile every running balance underneath it. Miss one number and a halfway decent automated check catches it.
A utility bill has none of that. Name, address, meter reading, total, due date. That is it. Nothing has to match anything else in the document. There is no internal math the fraudster has to respect. That is what makes it the softest target in the entire onboarding stack.
Layer in generative AI and the barrier collapses further. Tools that used to require a paid PDF editor and some design chops now spit out a complete utility bill from a one-line prompt. Inscribe’s analysis of the next wave of AI document fraud shows utility bills as the fastest-growing category of AI-generated fakes, outpacing the rising threat of fake bank statements that dominated earlier years.
Forging a utility bill takes roughly ten minutes
I am not publishing a manual here, but the process is not exactly a secret. Any search engine will walk you through it.
The workflow we see most often goes like this:
- Find a template. Fraudsters download a real electricity or water bill, often one of their own. Some buy bundles on Telegram and TikTok for under $50.
- Open it in a PDF editor. Free tools work. So do the $20/month ones. Fonts stay embedded, so the visual match is perfect.
- Edit the name, address and date. Sometimes the meter reading too, if the fraudster cares about realism. Most do not.
- Export and submit. The new PDF looks identical to the original because, structurally, it almost is.
Simple, right? That is exactly the problem.
It gets worse. Entire template farms on social media now sell ready-made utility bill generators as a subscription service. The fraudster does not even need a PDF editor anymore. Type in the address. Click download. Done.
Why your proof of address gets less scrutiny than it should
Compliance teams have a hierarchy in their heads, whether they admit it or not. ID documents get the most attention because regulators audit them. Income documents get scrutiny because a bad loan decision is expensive. Bank statements get checked because fraudsters have been faking them for years.
Proof of address? It is the box you tick at the end. In a lot of KYC workflows, it does not even go through the same review pipeline as the rest of the file.
When was the last time your onboarding team flagged a utility bill? In our experience, the answer at most financial institutions is “almost never”. Not because the documents are real. Because nobody is seriously looking. That gap is what fraudsters exploit, and they are not subtle about it.
The regulatory context does not help. FATF Recommendation 10 tells obliged entities to verify customer identity and address using “reliable, independent source documents”. It does not tell them how. So most firms accept whatever the customer uploads, run a surface-level OCR check and move on.
Where fake utility bills actually cause real losses
Fake utility bills are not abstract compliance theatre. They unlock real fraud, and the losses compound fast.
- Account opening. Neobanks, crypto exchanges and iGaming operators all require proof of address for KYC. A fake utility bill opens the door to an account that can then be used for money laundering or first-party fraud.
- Consumer lending. The Amsterdam cases we wrote about in how criminals in Amsterdam committed loan fraud relied on fake utility bills to establish residence at addresses the fraudsters never lived at, so collection letters would never reach them.
- Insurance claims. Address verification is how insurers confirm policy eligibility and premium tiers. A fake bill can shift someone from a high-premium postal code to a low-premium one, or let a fraudster claim on a property they do not own.
- Government benefits. Housing subsidies, tax credits and unemployment benefits in several European countries accept utility bills as proof of residence.
In every one of these cases, the loss is never caught on the utility bill itself. It is caught later, after the fraudster has already cashed out. By then the document has done its job.
The red flags the untrained eye misses
This is where document forensics earns its name. A visual inspection of a fake utility bill will almost never catch it. The forgery is in the bytes of the PDF, not the pixels on screen.
Things we cross-reference when flagging a suspicious utility bill:
- Metadata inconsistencies: the PDF creation tool, edit history and producer strings
- Font subset anomalies: when edited text is rendered with a slightly different font subset than the surrounding body
- Object stream layering: signs that text has been added on top of the original content layer
- Consumption values that do not match the season, the address’s dwelling type or the provider’s typical billing patterns
- Same-template similarity across multiple applicants, a dead giveaway for template farm output
Most of these signals are invisible to human reviewers. We cover the broader detection gap in our post on why 90% of fake documents are invisible to the human eye. Utility bills are the extreme case of that rule.
What actually stops fake utility bill fraud
The fix is not to stare harder at the document. It is to stop treating proof of address as a second-tier check.
Here is what we recommend to every onboarding team we work with:
- Run every utility bill through automated document forensics. A proper utility bill verification check examines the PDF structure, not just the text. VerifyPDF returns a risk rating in under 5 seconds.
- Cross-reference the address with other submitted documents. The address on the utility bill should match the ID, the bank statement and the payslip. When it does not, that is your flag.
- Never accept scans or screenshots of utility bills. If someone prints a bill and scans it back in, all the forensic signals disappear. That alone should be a red flag.
- Validate the provider. Does the logo match the current branding? Is the billing format consistent with what that provider actually sends? We keep a library of over 90 countries’ utility bill specifications for exactly this reason.
This is the kind of check that used to require a trained fraud analyst and half an hour per document. Automated document forensics now does it in seconds, at scale, on every single application.
The soft underbelly will not heal itself
Fake utility bill fraud is not going away. The tools to make them are getting better, the template farms are getting cheaper and AI is closing whatever small gap used to exist between an amateur forgery and a professional one. The 21.3% number in Inscribe’s data is not a peak. It is a floor.
So who catches this wave? The lenders, neobanks and insurers that treat proof of address with the same rigor as income verification. The ones that keep ticking the box will not. VerifyPDF exists to close that gap for the first group. The second group is who keeps us in business.