Forgery Detection and Document Fraud Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Fraud Investigators, Internal Auditors and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-FFC-019

Before you join: Participants should have basic experience reviewing business, financial, identity or operational documents and understand common approval, payment or record-retention processes.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Document fraud can enable payment diversion, false identity claims, procurement abuse, trade-based fraud and concealment of misconduct. A convincing document may contain only minor anomalies: an altered payee field, substituted passport photograph, copied signature, inconsistent PDF metadata or an invoice issued by a fictitious supplier. Staff responsible for review, investigation or approval need a disciplined way to identify warning signs, preserve evidence and decide when specialist examination is required.

This course develops practical forgery detection skills for paper, identity, financial and digital documents. Participants examine paper, inks, printing methods, handwriting, signatures, security features, PDFs, images and transaction records. They apply questioned-document examination principles, assess document provenance, maintain chain of custody and distinguish factual observations from conclusions that exceed the available evidence. The course also addresses cheque, invoice, bank-statement, trade-document and identity-document fraud.

Teaching combines focused instructor briefings with case analysis, document comparison tasks, group investigation work, evidence-handling simulations and reporting practice. Participants work through realistic cases involving altered payment instructions, forged approvals, counterfeit identity documents and manipulated electronic records. They leave with a document fraud examination toolkit containing triage, evidence, comparison, reporting and control-improvement materials that can be adapted to their own procedures.

The course is particularly suitable for fraud investigators, internal auditors, compliance teams, financial crime staff, security personnel and managers who approve or rely on high-risk documents. It is designed for professionals who need to make sound first-line assessments, commission specialist support appropriately and communicate findings clearly to management, legal advisers or investigative teams.

What you will be able to do

  • Classify document fraud typologies and prioritise cases using materiality and risk indicators
  • Examine paper, inks, printing processes and physical alterations using questioned-document methods
  • Assess handwriting and signatures using ACE-V reasoning, specimen selection and limitation statements
  • Authenticate identity documents using security features, issuer references and ICAO Doc 9303 checks
  • Inspect PDFs, images and metadata for indicators of digital manipulation
  • Trace inconsistencies across cheques, invoices, bank statements and trade documents
  • Produce evidence registers, comparison matrices and defensible document examination reports
  • Design document-fraud controls and escalation plans for payment, identity and approval processes

Benefits of attending

For you

  • Stronger judgement when assessing suspected altered or fabricated documents
  • Practical methods for detecting payment-instruction and invoice manipulation
  • Greater confidence challenging questionable identity and supporting records
  • Clearer evidence handling and documentation for investigations
  • Reusable reporting language that states findings and limitations accurately

For your organisation

  • Earlier detection of altered payment, procurement and identity documents
  • Better preservation of evidence for internal investigations and external referrals
  • Reduced exposure to invoice diversion, cheque fraud and false supplier records
  • More consistent escalation decisions between finance, compliance and security teams
  • Stronger document controls for approvals, issuer verification and record retention

Course modules

10 modules over 5 days

Participants can classify suspected document fraud and conduct an initial, risk-based triage.

  • Document fraud typologies: alteration, simulation, concealment and false attribution
  • Fraud triangle indicators linked to document creation and approval
  • Source-document lifecycle from issuance through retention, retrieval and destruction
  • Red flags distinguishing administrative error from deliberate document manipulation
  • Chain-of-custody principles for originals, copies, scans and electronic records
  • Initial triage questions establishing materiality, authority, timing and provenance

Participants can identify physical features and anomalies requiring further document examination.

  • Paper fibre, watermark, security thread and planchette examination
  • Oblique, transmitted and ultraviolet illumination for substrate anomalies
  • Magnification protocols for erasures, abrasions, overwriting and indented impressions
  • ESDA principles for recovering indented writing from questioned documents
  • Inks compared through line quality, fluorescence, solubility and sequence
  • Printing processes: offset, laser, inkjet, thermal and intaglio characteristics

Participants can recognise common signs of mechanical, chemical and entry-level document alteration.

  • Mechanical erasure signatures: disturbed fibres, surface sheen and residual strokes
  • Chemical eradication indicators: bleaching, halos, staining and paper weakening
  • Added-entry detection through baseline alignment, spacing, pressure and ink flow
  • Sequence-of-strokes analysis at intersections of handwriting, signatures and stamps
  • Altered cheque payee and amount fields examined systematically
  • Reconstruction limits documented when original evidence is unavailable

Participants can conduct structured preliminary comparisons of handwriting and signatures.

  • Questioned-document examination workflow for signatures, handwriting and initials
  • Class and individual characteristics in line, form, movement and proportion
  • Natural variation separated from disguise, tracing and simulation features
  • ACE-V reasoning applied to signature comparison and conclusion reporting
  • Specimen selection: contemporaneous, comparable, sufficient and properly authenticated
  • Limitations stated when copy quality or specimen quantity constrains conclusions

Participants can assess identity documents for security features, alterations and counterfeit indicators.

  • Passport and identity-card security features: MRZ, microprint, OVI and laminates
  • ICAO Doc 9303 checks for machine-readable travel documents
  • Portrait substitution, data-page alteration and laminate resealing indicators
  • Driver licence and residence permit authentication against issuer references
  • Specimen comparison using trusted databases and document-issuer guides
  • Escalation criteria for suspected counterfeit identity documents to specialist examination

Participants can identify indicators of manipulation in electronic documents and images.

  • PDF object structure, metadata, fonts and embedded-image inspection
  • Native-file versus rendered-copy evidence and preservation requirements
  • File-system timestamps interpreted with creation, modification and access limitations
  • Image forensics: resampling, cloning, compression artefacts and edge inconsistencies
  • Hash values and write-blocking procedures preserving digital-document integrity
  • OCR errors distinguished from intentional content alteration during evidential review

Participants can test financial and trade documents for inconsistencies and fabricated support.

  • Cheque fraud indicators: altered MICR lines, payees, amounts and endorsements
  • Invoice fraud tests: vendor identity, purchase order, pricing and bank details
  • Bank-statement anomalies: typography, transaction sequencing, balances and page continuity
  • Trade-document consistency across bills of lading, invoices and certificates
  • Beneficial-owner evidence assessed through corporate registries and supporting documents
  • Source-to-payment tracing identifies fabricated or substituted supporting records

Participants can plan a document fraud inquiry and maintain defensible evidence records.

  • Allegation assessment using the fraud examination methodology and issue matrix
  • Evidence register fields: identifier, source, custodian, condition and relevance
  • Chain-of-custody logs maintained from seizure through disclosure and return
  • Document comparison matrix links questioned features to evidential propositions
  • Interview preparation tests document provenance, access, approvals and explanations
  • Investigation plans set scope, milestones, escalation thresholds and legal liaison

Participants can communicate document examination findings with appropriate evidential boundaries.

  • Factual observations separated from opinions, assumptions and investigative inferences
  • Conclusion scales calibrated to evidence strength and examination limitations
  • Report structure: instructions, materials, methods, findings, limitations and exhibits
  • Annotated exhibits use callouts, scales, image provenance and version control
  • Disclosure schedules identify unused material, sensitive records and retention decisions
  • Expert-witness boundaries, admissibility considerations and cross-examination preparation for findings

Participants can strengthen document controls and prioritise practical fraud detection improvements.

  • Document-control design: maker-checker approvals, templates, retention and access
  • Secure issuance controls for cheques, certificates, identity credentials and seals
  • Exception monitoring rules for duplicate invoices, altered beneficiaries and unusual approvals
  • Supplier master-data verification and bank-detail change confirmation procedures
  • Incident response playbooks for suspected document fraud and evidence preservation
  • Personal application plan prioritises controls, referrals and reporting improvements

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Document fraud triage checklist
  2. Questioned-document examination worksheet
  3. Evidence register template
  4. Document comparison matrix
  5. Forgery findings report template
  6. Document-fraud control improvement plan

Who should attend

  • Fraud Investigators — assess suspected forged, altered and fabricated records
  • Internal Auditors — test document controls and investigate control failures
  • Financial Crime Analysts — identify fraudulent identity and payment documentation
  • Compliance Officers — assess documentary evidence supporting regulated decisions
  • Finance Managers — challenge invoices, bank-detail changes and approval records
  • Security and Risk Managers — establish escalation routes for document fraud incidents

Skills and tools covered

Questioned-document examinationForgery red-flag analysisIdentity document authenticationDigital document inspectionEvidence chain custodyFraud report writing

Tools and standards

Video Spectral Comparator, Electrostatic Detection Apparatus, ICAO Doc 9303, ASTM E444

How the course runs

Training methodology

The course uses short instructor briefings followed by guided examination of paper records, identity documents, financial documents and digital files. Participants analyse realistic fraud indicators, compare genuine and questioned features, build evidence registers and test investigative hypotheses in small groups. Simulations address triage, chain of custody, interview preparation and reporting decisions. Facilitated discussion links findings to payment controls, identity checks and escalation procedures. Each participant completes an application plan for improving document-fraud detection in their role.

Requirements and prerequisites

Participants should have basic experience reviewing business, financial, identity or operational documents and understand common approval, payment or record-retention processes. Familiarity with fraud risk, internal controls, audit work, compliance reviews or investigations is useful. Participants should be comfortable reading invoices, bank statements, contracts, identity records or electronic files. No prior forensic document examination qualification is required. The course does not require laboratory experience, handwriting expertise, specialist imaging equipment, programming skills or legal training. It teaches informed first-line examination and referral rather than laboratory-level expert analysis.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should be familiar with reviewing business, financial, identity or operational documents. No forensic science qualification, laboratory experience or handwriting expertise is required.

Bring examples of the document types you review, where organisational policy permits and sensitive information has been removed. A laptop is useful for digital-document inspection activities, particularly on live online delivery.

The course suits fraud investigators, internal auditors, financial crime analysts, compliance officers, finance managers and security personnel. It is useful for professionals who make first-line decisions about suspicious documents or supporting records.

General investigation courses focus on allegations, interviews, evidence and case management across many fraud types. This course concentrates on detecting alterations, counterfeit features, false signatures, document inconsistencies and digital manipulation.

Participants can introduce structured document triage, improve issuer and bank-detail verification, preserve original evidence and use clearer finding statements. The materials also support stronger escalation routes to specialist examiners, legal teams or law enforcement.

The course runs for five training days, each scheduled from 08:30 to 16:30 with about 6.5 contact hours. Time is allocated across ten modules covering examination methods, case work, evidence management, reporting and preventive controls.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.