Fraud Analysis

Fraud analysis looks for signs that a PDF was tampered with or forged. When a Fraud Analyzer node is included in your workflow, the workflow run response includes risk scoring, risk factors, and trust indicators.

Overview

Fraud analysis examines each uploaded document. Its individual signals are grouped into findings: risk factors that raise suspicion and trust factors that support authenticity.

Fraud analysis results appear in two places:

• Workflow run response: the fraud_analysis_result field at the root level of the GET workflow run response, alongside extraction_result
• Node webhook: the node-run.completed event for fraudAnalyzer nodes includes a summary with risk_level, risk_score, and signal_count

Workflow Run Response

When a workflow includes a Fraud Analyzer node, the GET workflow run response includes a root-level fraud_analysis_result field:

{
  "run_id": "wr_abc123xyz789",
  "status": "completed",
  "classification_result": { ... },
  "extraction_result": { ... },
  "fraud_analysis_result": {
    "status": "completed",
    "risk_level": "warning",
    "risk_score": 42.5,
    "risk_factors": [
      {
        "id": "content_tampering",
        "label": "Document Content Modified",
        "severity": "high",
        "details": "The document shows signs of post-creation editing...",
        "sources": ["forensic"]
      },
      {
        "id": "metadata_anomalies",
        "label": "Metadata Inconsistencies",
        "severity": "medium",
        "details": "The PDF metadata contains contradictory information...",
        "sources": ["forensic"]
      }
    ],
    "trust_factors": [
      {
        "id": "legitimate_producer",
        "label": "Known Bank Software",
        "passed": true,
        "details": "The document was generated by software commonly used by banks.",
        "sources": ["forensic"]
      }
    ]
  }
}

If no Fraud Analyzer node ran in the workflow, fraud_analysis_result is null.

When your organization limits fraud analysis to native PDFs or to bank statements (set up by Holofin on request), a document outside those filters is not analysed or billed for fraud. Its fraud_analysis_result is {"status": "skipped", "skip_reason": "not_native_pdf", "risk_level": null, "risk_score": null, "risk_factors": [], "trust_factors": []}, with skip_reason"not_native_pdf" (a scan, a photo or an image upload) or "not_bank_statement". Treat it as "not analysed", not as a clean document.

fraud_analysis_result Object

Risk Levels

Risk Factor Object

Pages redrawn by AI

The risk factor ai_page_redrawn (label « Page redrawn by AI », severity high) means a page looks redrawn by an AI image generator to change a figure, a name or a date.

What to do: do not rely on the figures of the flagged page, and ask for the document from its issuer.

Trust Factor Object

Node Webhook Payload

When a fraudAnalyzer node completes, a node-run.completed webhook is sent with a summary in the result field:

{
  "id": "whev_abc123def456",
  "event": "node-run.completed",
  "created_at": "2025-06-02T14:30:00Z",
  "data": {
    "object": {
      "run_id": "wr_xyz789ghi012",
      "workflow_id": "wf_abc123def456",
      "document_id": "doc_abc123def456",
      "node_id": "fraud_analyzer_1",
      "node_type": "fraudAnalyzer",
      "status": "COMPLETED",
      "timestamp": "2025-06-02T14:30:00Z",
      "result": {
        "analysis_id": "pda_abc123def456",
        "risk_level": "warning",
        "risk_score": 42.5,
        "signal_count": 5,
        "categories_triggered": ["tampering", "metadata_anomaly"],
        "signal_summary": {
          "tampering": 2,
          "metadata_anomaly": 3
        }
      }
    }
  }
}

The node webhook provides a quick summary. For the full risk and trust factors, use the fraud_analysis_result field in the workflow run response.