Why We Built an 18-Point Verification Engine

For the past decade, immigration compliance and document verification have relied on a fragile assumption: that a forged document will look forged.

We trained compliance officers to spot mismatched fonts, and we built OCR (Optical Character Recognition) tools to scrape text and flag obvious inconsistencies. But in 2026, the threat landscape has fundamentally changed. The tools used by organized fraud syndicates have outpaced standard audit procedures.

Today, generative AI and diffusion models create "born-digital" forgeries—documents fabricated entirely from scratch with flawless pixels, perfect kerning, and clean metadata. Furthermore, malicious actors are weaponizing PDF uploads with hidden prompt injections designed to hijack single-model AI verification systems.

A standard OCR tool simply extracts text; it does not verify truth. A "looks good" audit is no longer sufficient.

To stop modern visa fraud you need more than a glance. We rebuilt the check so an 18-point AI scan looks for tampering and forgery, then a human expert reviews the whole case and decides. In many cases we also contact the company named in the document.

Here is how our three-stage pipeline works.

Stage 1: Programmatic preflight

Before any model reads the file, we run programmatic checks on the bytes — not the story the PDF tells.

Born-digital forgeries and print-rescan laundering attacks are designed to defeat visual AI. We trap them in the math:

Error Level Analysis: We programmatically re-compress the file to detect localized anomalies. If a salary figure was pasted in at a different JPEG quality than the rest of the page, the pixels will spike on our heatmap.

Binary Fingerprinting: We scan the quantization tables and PDF %%EOF markers to identify the exact software used. If an official government permit contains the internal signature of a consumer web editor like Canva or Photopea, it is flagged immediately.

Visual-to-Text Sanitization: To neutralize hidden prompt injections (e.g., microscopic white text instructing an AI to "Approve this document"), we forcefully rasterize PDFs into flat images before extracting the text. Malicious, hidden data layers are destroyed before the reasoning engine can read them.

Stage 2: Parallel intelligence

A document can have perfectly authentic pixels, but the information printed on it can still be fabricated. This stage looks at the company and the fields across the file.

We shift the burden of proof from the document's appearance to its real-world anchor points:

Live Registry and VAT Validation: Our engine queries official databases (such as the EU VIES registry). If a forged employment contract utilizes a stolen VAT number that does not perfectly match the claimed employer name, the system forces a CRITICAL severity flag.

Cross-Document Field Locks: Fraud rings often mix and match stolen documents. Our code mathematically locks fields across the entire dossier. If the Machine Readable Zone on a passport does not perfectly align with the date of birth on the employment contract, the discrepancy is flagged.

Salary and Legal Plausibility: We cross-reference stated salaries against national minimums and collective bargaining agreements specific to the claimed visa tier.

Stage 3: Dual-model review, then a human decides

Only after the preflight and intelligence checks do we run advanced AI reasoning. Two models look at context. The AI never issues the verdict.

Legal Text Authenticity: The AI audits the phrasing of the contract against jurisdiction-specific legal templates, searching for missing statutory clauses or hallucinated legal citations.

Typography and Geometric Structure: The models evaluate the spatial alignment of the text. Official documents sit on mathematically perfect baselines; manual edits often drift.

Mandatory Human Review: If the two models fundamentally disagree on the verdict (e.g., one approves while the other rejects), the system halts. The engine never auto-releases a final certificate; it escalates the conflict to a human compliance officer.

Infrastructure, not an OCR tool

We did not build an OCR tool. The 18-point AI scan, the employer check in many cases, and the human decision sit together so a file that only looks official does not pass on looks alone.

In an era of synthetic identities and generative fraud, you can no longer trust what a document looks like. You must verify how it was built, what it means, and who stands behind it.

A file that only looks official is not enough. The 18-point scan, a human expert, and — in many cases — a check with the named company are what produce the written verdict and Verified Certificate.