A self-employed applicant wants a mortgage. A small business owner wants a working-capital loan. A new client wants their tax return filed. In all three cases somebody hands over a tax document as proof of income or turnover. And in all three cases the person receiving it quietly assumes the hard part, the maths, was already done by a tax authority. So the document gets read, not checked. Fake tax return verification barely happens at all.
That assumption is exactly what fraudsters count on. At VerifyPDF we keep seeing the same thing: tax returns and VAT filings are among the most trusted financial documents in circulation and among the easiest to fake convincingly. Why? Because almost nobody on the receiving end knows what a real one is supposed to look like under the hood.
Here is what I want to walk through: what fraudsters get wrong, why national tax forms make this harder than it sounds and why cross-referencing against the issuing authority beats squinting at the PDF every single time.
Why fake tax returns and VAT filings are worth so much to fraudsters
A tax document carries borrowed authority. When a lender sees a UK SA302 or a German Steuerbescheid, the reasoning underneath is “a government computed this, so the numbers are real.” That trust is the whole point of the forgery.
Inflate the income line on a self-assessment calculation and you have just manufactured affordability for a mortgage you could never service. Fabricate a VAT return showing healthy quarterly turnover and you have invented a trading history for an SME loan that funds nothing real.
The scale here is not small. The European Commission’s 2025 VAT Gap report put the EU VAT compliance gap at roughly €128 billion for 2023, reversing years of progress. A good chunk of that is plain fraud built on fabricated invoices and filings.
On the enforcement side, the European Public Prosecutor’s Office ran an operation codenamed Midas that uncovered an estimated €195 million in VAT fraud across 17 countries. These are not edge cases. Fraudulent paperwork is an industrial input to financial crime in Europe.
And here is the part that should worry any lender or accounting firm: the same documents that feed those tax-fraud schemes also land in your income-verification pipeline. A fabricated VAT return is just as useful for cheating the tax office as it is for cheating a bank. The fraudster does not care which door it walks through.
What national tax forms look like, and what fraudsters get wrong
There is no single “tax return” to forge. Every country has its own forms, its own layout conventions and its own reference numbers. That variety is the fraudster’s biggest weakness, if you know what to look for.
Take a few European examples:
-
UK: the SA302 and tax year overview. Self-employed mortgage applicants in the UK are asked for an SA302 tax calculation plus a matching tax year overview, usually for the last two or three years. Both are standard mortgage evidence for the self-employed, and lenders ask for the pair precisely so the figures on one can be checked against the other. Fraudsters love to inflate the income on the SA302 and forget there is a second document that is supposed to agree with it. A mismatch between the two is one of the cleanest red flags in self-employed lending.
-
Netherlands: the aangifte and jaaropgaaf. A Dutch income-tax return (aangifte) and the annual employer statement (jaaropgaaf) follow rigid formatting and reference conventions. Forgers working off a screenshot or a years-old template routinely get the layout subtly wrong, miss the Belastingdienst styling or produce figures that do not line up with the supporting payslips.
-
Germany: the Steuerbescheid. A German tax assessment notice (Steuerbescheid) is issued by the Finanzamt with a specific structure, tax numbers and calculation breakdown. To anyone who has never seen a real one, a fake looks authoritative. To the metadata, a fake built in a PDF editor looks like exactly that.
So what is the common thread? Fraudsters work from the visible surface of a document and ignore everything underneath. They copy the logo and the broad layout, they change the numbers that matter to them and they bet nobody will check how the fields relate to each other or where the file has been. The people who get fooled are doing the same thing in reverse, judging the document purely on how it looks.
This is the same lesson we drew out in our practical guide for accountants: a tax document from a jurisdiction you do not work in every day is almost impossible to validate by eye. And criminals know it.
The structural signals a forged filing gets wrong
Visual inspection has a ceiling, and it is lower than most people think. But there are structural tells that hold up far better than “does the logo look right.”
Start with internal consistency. Real tax documents are full of figures that have to agree with each other. Gross income minus allowances equals taxable income. Tax due on the calculation equals tax due on the summary. VAT charged minus VAT reclaimed equals the net figure remitted.
A fraudster editing a single number to hit a target income almost never pushes that change through every dependent field. Doing it by hand is tedious and easy to botch. Recompute the arithmetic and the forgery often falls apart on its own.
Watch for figures that are too clean. Genuine tax calculations are messy. They carry odd pence, fractional percentages and awkward remainders from real income and real tax tables. A return where everything lands on round thousands, or where margins stay suspiciously identical quarter after quarter, is behaving like a spreadsheet, not a business.
Check that the dates make sense. A tax year overview for a period that had not closed when the file was supposedly issued. A filing reference that predates the return. An assessment dated on a weekend or a public holiday. These are the logical contradictions a hurried forger leaves behind.
And then there is the layer no amount of visual polish can fake convincingly: the document’s own metadata. We have written before about why manual checks alone hit a wall on exactly this point.
What the PDF metadata gives away
A PDF is not just an image of a document. It is a container that records how it was made, and that history is where forgeries leak.
A legitimate tax document is generated by a government system or by recognised tax software, and the file’s producer and creator fields reflect that. When the producer field instead names a photo editor, a generic design tool or a PDF manipulation utility, that is a loud signal. Someone touched the file after it left the authority, or it never came from the authority at all.
Timestamps that contradict the document’s stated period are another giveaway. So is a document that claims to be a single official issue but shows multiple incremental saves, layered edits or fonts that do not belong to the issuing body’s house style.
This is also why we keep telling people to stop accepting screenshots and photos of financial documents. A screenshot of a tax return has no producer field, no creation history, no embedded structure. It strips out the exact forensic layer that makes verification possible and hands you a picture you can only judge by eye.
Insist on the original digital PDF, the one that came out of the tax authority’s portal or the accountant’s software, and you keep the evidence you need.
Why AI-generated fakes broke visual inspection for good
It used to take some skill to forge a tax return well. Not anymore.
Generative AI tools can now produce a clean, well-aligned, plausible-looking financial document in seconds, with consistent fonts and no smudges. The fraud-prevention industry has watched this curve bend sharply. Surveys in 2025 reported that a majority of fraud professionals now see AI in the schemes they investigate, with deepfakes and synthetic documents cited as fast-growing tactics.
Specialist detection vendors reported AI-generated document fraud climbing several-fold over a single year. It is still a minority of total fraud, sure. But the trajectory is the thing to watch, not today’s headline percentage.
So what does AI generation actually change? It removes the visual mistakes that used to give forgers away. The fonts are right, the alignment is right, the layout is convincing. What it does not fix is the structural and metadata layer. An AI-generated tax return still has to live inside a PDF, it still carries the fingerprints of the tool that made it and it still struggles to keep every interdependent figure consistent across a multi-page filing. The eyeball test is dead. The forensic test is not.
Why cross-referencing the source beats inspecting the document
Here is the uncomfortable truth underneath all of this: the most reliable way to confirm a tax document is real is to not rely on the document at all.
Whenever the issuing authority offers a way to verify directly, use it. In the UK, the SA302 plus tax year overview pairing exists precisely so a lender can check two HMRC outputs against each other rather than trusting one figure in isolation. Where authorities or payroll sources expose verification at source, pulling data directly from the source sidesteps the forgery problem entirely, because the fraudster never gets to hand you the artifact in the first place.
When source verification is not available, and for a lot of cross-border and self-employed cases it simply is not, document forensics is the next best thing. Instead of asking “does this look right,” forensics asks whether the file is internally consistent, whether it was produced by the kind of system that should have produced it and whether its history matches its claims. That is a question a forger cannot talk their way around.
Building fake tax return verification into your workflow
You do not need to turn your loan officers or your accountants into document examiners. You need one automated step at intake, the same way you scan an email attachment before opening it. Simple, right?
This is what VerifyPDF does. A tax return or VAT filing goes in, and within seconds you get back a risk rating that weighs the metadata, the structural consistency and the signals a human reviewer cannot see. It works across documents from more than 90 countries, so nobody has to know what every national form looks like.
A high-risk result does not auto-reject the applicant. It tells you to have a conversation. Maybe they exported the PDF through a third-party tool and there is an innocent explanation. Maybe there is not. Either way you have a timestamped record that you checked, which matters more and more as European AML obligations tighten for lenders and accounting firms alike.
And the economics are not close. Verification costs a few cents and a few seconds per document. A single fabricated tax return that funds a loan you should never have written, or a forged VAT filing that drags your firm into someone else’s tax-fraud case, costs orders of magnitude more.
So the real question is not whether your applicants and clients can send you fake tax returns. Some of them can, and the AI tools to do it convincingly are now a free download. The question is whether you would know. Try a free document check to see what your incoming filings look like under the hood, or get in touch to build verification into your intake pipeline before a forged return slips through.