{"slug": "ocr-accuracy-100-fraud-100-ai-vs-template-based-fraud", "title": "OCR accuracy: 100% & Fraud: 100 % – AI vs. template based fraud", "summary": "AppZen's expense-audit platform caught 1,471 AI-generated fake receipts submitted by 745 employees across 174 companies over the 12 months to 15 May 2026, claiming $148,143. The average claim was $101, with half asking for $32 or less, down from $182 for template-based fakes. AppZen co-founder and CTO Kunal Verma said AI flipped the game from one big fake to many tiny ones that escape review.", "body_md": "## On This Page\n\n[The fake receipts got smaller](#the-fake-receipts-got-smaller)[The 70.8% is fifteen days](#the-708-is-fifteen-days)[A clean forgery has nothing wrong with its characters](#a-clean-forgery-has-nothing-wrong-with-its-characters)[A forger controls scan quality; an applicant does not](#a-forger-controls-scan-quality-an-applicant-does-not)[Detection accuracy comes from the vendors selling detection](#detection-accuracy-comes-from-the-vendors-selling-detection)[Flattening the file beats the forensics](#flattening-the-file-beats-the-forensics)[Document fraud fell 13% while generated media rose](#document-fraud-fell-13-while-generated-media-rose)[The second attempt removed the watermark](#the-second-attempt-removed-the-watermark)[What this means if you are buying](#what-this-means-if-you-are-buying)[Caveats](#caveats)\n\n## The fake receipts got smaller\n\nIn March 2025, AppZen's expense-audit platform flagged no AI-generated receipts at all. Over the twelve months to 15 May 2026 it caught [1,471 of them, submitted by 745 employees across 174 companies](https://www.forbes.com/sites/jamesbroughel/2026/06/28/ai-generated-fake-receipts-are-changing-expense-fraud/), claiming $148,143 between them. Those are amounts employees asked for, not amounts any employer paid.\n\n*Generated for this article from one prompt, using Nano Banana 2. The restaurant is invented, the creases are synthetic, and the figures reconcile. What it gets wrong is discussed below.*\n\nThis is internal fraud. The submitter is an employee billing their own company, working against a reimbursement policy they can read, with a job at stake if the claim is refused. An applicant sending a bank statement to a lender stands in none of those positions.\n\nHalf of those receipts asked for $32 or less. The average is $101, three times the median, because a handful of large claims pull it there: one employee at an Australian telecom company submitted eleven receipts worth $12,900 between them. Strip those out and the shape of the thing is a $32 lunch. The template-based fakes they displaced, bought from lost-receipt websites for five or ten dollars, averaged $182. A tool capable of producing a plausible receipt for any amount at all arrived, and the typical claim got smaller.\n\nThat is the number that matters for anyone setting a review threshold, and it is the one least likely to be quoted. A $32 claim sits under the limit where most finance departments route an expense to a person. AppZen co-founder and CTO Kunal Verma reads the shift as deliberate: \"AI basically flipped the game from one fake big enough to be worth the risk to a pile of tiny ones nobody bothers to review.\" Cheap generation would also make small-dollar fraud worth attempting on its own, with no threshold anywhere. Either way, the receipt that gets through is not the expensive one. It is the one nobody opens.\n\n## The 70.8% is fifteen days\n\nThe number that carried this story is a monthly share, and the month it describes ran from 1 to 15 May 2026.\n\nThe series behind [that 70.8%](https://www.pymnts.com/news/artificial-intelligence/2026/ai-generated-fake-receipts-now-make-up-71percent-of-expense-fraud/) is not a climb. It reaches 42% in July 2025, falls back to 6% by January 2026, and recovers through the spring. The monthly breakdown was calculated from AppZen's data by James Broughel, whose Forbes contributor piece published it; he draws the final segment as a dashed line and marks the point with an asterisk. Four months before AI-generated receipts were being called the dominant form of expense fraud, they were one flag in sixteen.\n\nFifteen days at the end of a volatile series is the thinnest window in the dataset. It is also the highest reading in it, which is why it travelled.\n\nThe direction is real regardless. Template fakes fell to roughly 29% of flags over the same period, and the twelve-month totals do not depend on where the last point lands. What the half-month number cannot support is the claim that a takeover has already happened.\n\n## A clean forgery has nothing wrong with its characters\n\nAutomated document pipelines gate on a confidence score, and the platform documentation is consistent about what that number represents.\n\nAWS Textract defines it as \"a number between 0 and 100 that indicates the probability that a given prediction is correct\". Azure AI Document Intelligence gives \"an estimated probability between 0 and 1 that the prediction is correct\", adding that a value of 0.95 means the prediction is \"likely correct 19 out of 20 times\". [Google](../../vendors/google/) Document AI describes \"how strongly your model associates each entity with the predicted value\". [Hyperscience](../../vendors/hyperscience/) is blunter, calling its machine confidence \"an internal non-configurable number\" and warning that \"if a field is transcribed with 0.96 confidence, this does not mean that the model is 96% sure that the data was transcribed correctly\". [Rossum](../../vendors/rossum/) goes furthest toward a real guarantee, stating it calibrates scores \"to correspond to the probability of a given value being right\", while conceding calibration is \"still an unsolved problem in Artificial Intelligence\".\n\nAll five answer the same question: did the machine read the characters correctly. Across the documentation for those five and for ABBYY Vantage, Nanonets, Instabase, Mistral OCR, Reducto and Docling, the words fraud, tampering and authenticity do not appear where confidence is defined.\n\nA recent framework paper, [RaV-IDP](https://arxiv.org/abs/2604.23644), states the mechanism in one line: \"Model-internal confidence scores measure inference certainty, not correspondence to the document.\" A forged bank statement generated cleanly in a PDF library has nothing wrong with its characters. [Data extraction](../../capabilities/data-extraction/) returns a high score on it, and the routing rule reads that score.\n\n## A forger controls scan quality; an applicant does not\n\nA generated PDF is clean by construction. A genuine document has been folded, faxed, photographed on a kitchen table and scanned at an angle. Whether that difference makes the forgery score higher than the real thing is not a question the public benchmarks answer.\n\nClean is not the forger's only setting, either. The receipt above arrived creased and slightly grubby because it was asked to, which is the point: the wear on a real document is whatever happened to it, and the wear on a generated one is a parameter.\n\nSearching the benchmark literature and the vendor documentation turns up no such comparison. Reading fidelity is benchmarked in enormous detail, down to per-field accuracy on handwriting and sparse tables, as [June's leaderboard coverage](../../news/the-76-percent-wall/) set out, and noisy-scan corpora for form understanding have existed for years. What the public leaderboards score is whether the machine read a degraded document correctly, not how its confidence on that document compares with its confidence on a clean forgery.\n\nClean input extracts more cleanly than dirty input, and a forger controls input quality completely while an honest applicant does not. How large that advantage gets is what the published benchmarks leave open, and it is the difference between a rounding error and the main effect in pipelines that approve credit applications and expense claims.\n\n## Detection accuracy comes from the vendors selling detection\n\nGeneration has been tested under controlled conditions. The detection firm AI or Not tested 16 image models across 14 vendors in 75 attempts and reported a [92% success rate at producing realistic synthetic government identity documents](https://www.biometricupdate.com/202606/16-major-ai-image-models-found-vulnerable-to-synthetic-id-generation) in June 2026. The more useful finding in that study is about refusals. Every one of the 16 models produced synthetic IDs when the request was reframed as a Know Your Customer review, a compliance evaluation or a security audit, including models that had declined the same request asked directly.\n\nOn the detection side the numbers on offer are the vendors' own. [Resistant AI](../../vendors/resistant-ai/) states 99.2% accuracy on its product page with no test set, document mix or definition of correctness. Veryfi claims 99.7% fraud detection accuracy alongside a false-positive rate below 0.3%, both set in a comparison table against an unsourced industry average. [Ocrolus](../../vendors/ocrolus/) heads a callout in its Detect documentation \"Watch out for false positives!\", telling customers that \"some flagged documents may have legitimate explanations\" and to review flagged activity manually, without attaching a number to it.\n\nThe false-positive rate is what prices the product, because every genuine document wrongly flagged becomes manual review work. Of the three, only Veryfi publishes one, inside its own marketing comparison. No independent benchmark of financial-document fraud detection turned up for any of them.\n\n## Flattening the file beats the forensics\n\nThe forensic checks that do work mostly ignore the content. PDF incremental-update history records every save the file has been through and is hard to strip without rebuilding the document. Font subsetting is predictable for a given issuer's generator, so overlaid text tends to break the pattern. Metadata and producer strings betray the wrong editing tool. Error Level Analysis finds re-compression seams where a region was pasted in.\n\nEach has a known defeat, and the defeats are cheaper than the checks. Flattening the document to an image destroys the update history and the font structure. Screenshotting an AI-generated document creates a new file carrying no trace of what produced it. Error Level Analysis is a JPEG technique that degrades on other formats and finds little in a file that was never a photograph of anything.\n\nC2PA provenance metadata is the case worth watching, because it sometimes works. OpenAI writes content credentials into images its tools generate, and AppZen reports cases where that record identified a receipt as generated. The record does not survive editing, recompression or a screenshot, and a document that carries no credential is not thereby genuine. A visible watermark has a shorter life still, as the pair of receipts further down demonstrates.\n\nArithmetic reconciliation looks like the durable exception, since a forger who edits one number breaks the running balance. That holds against an editor and not against a generator. Resistant AI's own blog post on [AI bank statement generators](https://resistant.ai/blog/ai-bank-statement-generator), published 18 May 2026 and updated a week later, describes a generated statement plainly: \"It can include the required fields. It can use plausible dates. It can make the totals add up.\" A generator builds the statement around the intended total, so the balance reconciles by construction.\n\nThe receipt at the top of this article behaves that way. Its eight line items sum to €266.67, VAT at 20% lands on that figure exactly, and the total comes out at a round €320, held there by a Negroni priced at €10.67. Arithmetic reconciliation passes it without complaint. What the receipt gets wrong sits one layer up: French restaurants charge 10% VAT on food and 20% on alcohol, and this bill applies a single 20% line to the whole table. The check that catches it is not a sum but a rule about the jurisdiction, the merchant category and what was ordered, which is a different and more expensive thing to build. It also has to be built once per country.\n\n## Document fraud fell 13% while generated media rose\n\nVeriff's [2026 identity fraud report](https://www.veriff.com/fraud/fraud-report-2026) found document fraud down 13% year over year, even as digitally presented media was \"300% more likely to be either entirely AI-generated or otherwise altered\" than the year before, and it describes AI-driven fraud as still a small fraction of the total. Substitution between channels fits that pair of numbers. So does a new wave arriving on top of an old one that was falling for unrelated reasons, and the report gives a net fraud rate of 4.18% for 2025 without a prior-year total to separate the two.\n\nMuch of the alarming material in circulation is percentage growth measured from a near-zero base, which produces impressive multiples and says little about exposure. Most of it is published by firms selling detection. Resistant AI's 9.08% high-risk rate is measured on the traffic arriving at companies that had already bought fraud detection.\n\nThe forged and doctored documents that fell 13% are the class human reviewers were trained to catch. The digitally generated files that rose are the class an extraction confidence score does not look at, and they are arriving as those scores take over the reviewing. What Veriff counts is attempts, and an attempt tells you nothing about which gate it cleared.\n\n## The second attempt removed the watermark\n\nThe two receipts below came from the same image model, three minutes apart, from a prompt each. Neither was edited afterwards.\n\n*First attempt. It carries two marks of its origin: the generator's sparkle glyph in the lower right, and a line the model wrote about its own output, reading \"DO NOT TRUST this reciept\" with receipt misspelled.*\n\n*Second attempt. The warning line has become the chain's real survey copy, and the glyph is gone.*\n\nNothing was stripped and no metadata was touched. The prompt was run a second time, and the marks that would have identified the first image were not reproduced in the second. Whatever provenance signalling is worth in the abstract, the effort required to get past this instance of it was one more attempt.\n\nThe arithmetic holds throughout. Two burgers at $6.89, a fry at $3.99 and two sodas at $2.29 sum to $22.35, tax brings it to $24.14, and $40.00 tendered leaves $15.86 in change. A reconciliation check has nothing to complain about, and neither does a reviewer glancing at a photograph of a creased receipt on a table.\n\nThe tell is where it usually is, outside the document. The tax line works out to 8.0% of the sub-total, and whether that is the rate actually charged in Midland, Texas is a question about the world rather than about the file. So is whether store TX-1744 exists at the address printed on it, and whether that store was open at 3:48 that afternoon. Each of those is answerable, and none of them is answerable by reading the receipt more carefully.\n\n## What this means if you are buying\n\n**Ask for the false-positive rate in writing.** An accuracy figure without it cannot be priced. Where a vendor does publish one, the follow-up questions are which test set produced it and what document mix that set contained.\n\n**Measure it on your own traffic.** No category benchmark turned up in this research, and vendor accuracy figures are drawn from customer populations that are not yours. A pilot on real intake is the only evidence available.\n\n**Treat authenticity as a separate purchase from extraction.** Every authenticity product found in this research is a distinct SKU, add-on or partner integration layered on an IDP platform. None of the eleven confidence scores surveyed includes it, and no amount of extraction accuracy substitutes for it.\n\n**Check what your straight-through rate is actually straight through.** The automation rate a platform reports is a statement about reading confidence. It is not a statement about how many unverified documents reached a decision.\n\n**Ask what the check reconciles against.** Totals that add up prove a document is internally consistent, and a generator delivers that for free. The checks that bite compare the document to something outside it: the merchant, the card record, the employee's own history, the tax rate that applies to that category in that country.\n\n**Look at where your own approval threshold sits.** A published threshold tells an insider what to claim, and half the AI-generated claims in the expense data came in at $32 or less, which is below where most review lines sit. Sampling under the line costs less than lowering it.\n\n**Prefer not reading the document at all.** Where the data can come from the issuer instead of the applicant, through a bank API or a signed feed, the authenticity question disappears rather than getting solved. C2PA content credentials have essentially no footprint on bank statements, payslips and invoices, and a screenshot of a signed document is an unsigned document.\n\n**Note the compliance clock, and note that it moved.** The EU AI Act classes credit scoring as high risk and requires human oversight able to override the automated output, which turns what the automation actually verified into a compliance question. That obligation was due to apply from 2 August 2026. Under the Commission's digital omnibus it is being deferred to 2 December 2027 for standalone Annex III systems, credit scoring among them, and the deferral binds only once published in the Official Journal, which had not happened at the time of writing.\n\n## Caveats\n\nThe AppZen figures describe employee expense reimbursement fraud: workers billing their own employer, caught by one vendor's audit platform. Nothing here measures forged documents submitted to lenders, insurers or onboarding checks, and carrying the mechanism across to those flows is an argument from how the pipelines work rather than an observation of them. The figures are detected submissions in that customer base rather than all expense fraud, the 70.8% is a share of flagged fraudulent receipts rather than of all receipts, and the $148,143 is claimed rather than paid. AppZen is the sole source for all of it and sells the detection; the monthly series and the two Verma quotations come from a Forbes contributor column, which is self-published under a lighter editorial standard than staff reporting, and the intermediate months in the chart above are read off that column's figure to about a point. The documentation survey establishes that eleven platforms do not claim to check authenticity where they define confidence, which is weaker than establishing that none of them does anything about it internally, and five of the eleven are quoted directly while the other six were checked for the absence of that language. Why the claim values fell is inferred from the amounts, since no published figure records what approval thresholds those 174 companies actually used, and the $182 comparison figure for template fakes is a mean with no median published beside it. The central claim that forgeries extract more confidently than genuine degraded documents is argued from mechanism here rather than measured, and no measurement of it turned up in this research. The receipts shown here were generated by us for this article and are fabrications: the Paris restaurant does not exist, and the Five Guys store, address, telephone number and named employee were produced by the model rather than taken from anywhere. They are three artefacts from one image model on one afternoon, which shows what that model does and not what a detector would do with the result. Reading the Paris receipt's VAT line as an error is our own, resting on the French rate structure of 10% on restaurant food and 20% on alcohol. The 8.0% implied by the Texas receipt was not checked against the rate Midland actually levies, which is the point being made about it rather than an oversight. Veriff, Resistant AI, AppZen, Ocrolus and Veryfi all sell into this problem, and their numbers are cited as vendor statements throughout rather than as independent findings.\n\nA confidence score is a claim about characters. Every pipeline that routes on one is settling a question of authenticity with an instrument built to measure reading.\n\n*Sources cited in this post: Forbes on AI-generated receipts and expense fraud; PYMNTS on the AppZen expense-fraud figures; RaV-IDP framework paper; Biometric Update on the AI or Not synthetic-ID study; Resistant AI on AI bank statement generators; Veriff Identity Fraud Report 2026. Confidence-score definitions are quoted from the public developer documentation for AWS Textract, Azure AI Document Intelligence, Google Document AI, Hyperscience and Rossum; ABBYY Vantage, Nanonets, Instabase, Mistral OCR, Reducto and Docling were checked for the absence of authenticity language where confidence is defined. Cross-references to our own coverage: the 76% wall, Resistant AI vendor profile, Ocrolus vendor profile, data extraction, and independent vendor profiles. We do not sell IDP software. We are not paid by any vendor mentioned in this post.*", "url": "https://wpnews.pro/news/ocr-accuracy-100-fraud-100-ai-vs-template-based-fraud", "canonical_source": "https://idp-software.com/news/the-100-dollar-forgery/", "published_at": "2026-07-27 19:00:00+00:00", "updated_at": "2026-07-27 19:23:06.303929+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-products", "ai-tools"], "entities": ["AppZen", "Kunal Verma", "James Broughel", "Forbes", "Nano Banana 2"], "alternates": {"html": "https://wpnews.pro/news/ocr-accuracy-100-fraud-100-ai-vs-template-based-fraud", "markdown": "https://wpnews.pro/news/ocr-accuracy-100-fraud-100-ai-vs-template-based-fraud.md", "text": "https://wpnews.pro/news/ocr-accuracy-100-fraud-100-ai-vs-template-based-fraud.txt", "jsonld": "https://wpnews.pro/news/ocr-accuracy-100-fraud-100-ai-vs-template-based-fraud.jsonld"}}