Fake Bills of Lading and Certificate of Origin Fraud Detection

This article is provided for informational purposes only and does not constitute legal or regulatory advice. Legislative and regulatory references are accurate as of the publication date. Consult a qualified professional for guidance tailored to your situation.

Editorial disclosure: CheckFile provides document fraud detection solutions. Internal analyses and benchmarks cited in this article come from CheckFile platform data and are identified as such.

A fake bill of lading is a shipping document that looks genuine on its face but describes a cargo, vessel or voyage that never existed, or that misstates weight, value or origin to support a fraudulent payment claim. A forged certificate of origin runs the same play on country-of-origin claims, letting sanctioned or tariff-restricted goods cross the border under a false flag. Both are caught the same way — by cross-checking the document against independent third-party records (vessel tracking data, customs valuation history, chamber of commerce registries) rather than by reading the PDF in isolation.

What a bill of lading and a certificate of origin actually do

A bill of lading does three jobs at once: it is a receipt confirming goods were loaded aboard a named vessel, evidence of the contract of carriage between shipper and carrier, and — in its negotiable form — a document of title, meaning ownership of the cargo can change hands by endorsement before the shipment physically arrives. A certificate of origin (CO) is a distinct document, typically issued or stamped by a chamber of commerce or a government-designated certifying body, attesting to the country where the goods were produced, manufactured or substantially transformed. A bank financing the deal, the Canada Border Services Agency (CBSA) assessing duty owed, and a buyer claiming preferential tariff treatment under a free trade agreement each depend on these two documents independently corroborating the same shipment.

Under CUSMA and Canada's other free trade agreements, an importer claiming preferential tariff treatment must have the certification of origin in its possession at the time the claim is made and must produce it to the CBSA on request during a verification (CBSA, Certifying the origin of goods; CBSA, Memorandum D11-4-2 — Proof of Origin of Imported Goods). When that certification is fabricated rather than genuine, the importer or exporter, the bank financing the transaction and the CBSA officer who granted the tariff concession are all exposed — usually without anyone realizing it until a verification audit or a sanctions screen catches up with the shipment. Fraudulent certification by a Canadian exporter or producer is itself an offence under Canadian law, separate from any customs duty owed.

How trade document fraud works in practice

Trade-based money laundering (TBML) moves value through the trade system rather than through a bank account directly, and forged shipping paperwork is what makes the mechanism run. The FATF's report Trade-Based Money Laundering: Trends and Developments lays out the techniques compliance teams still encounter today: over- and under-invoicing, over- and under-shipment, multiple invoicing of the same cargo, and falsely described goods or shipments (FATF, Trade-Based Money Laundering: Trends and Developments). Canada is a FATF member and FINTRAC — the Financial Transactions and Reports Analysis Centre of Canada — draws on this same body of typologies when it builds sector-specific indicators for reporting entities.

In practice, this breaks down into a handful of recurring patterns. A phantom bill of lading references a container or vessel voyage that never took place, used to draw down a letter of credit or justify a cross-border payment against a shipment that doesn't exist. Over- or under-invoicing shifts value between counterparties by pricing goods well outside their normal range — a discrepancy that only surfaces once the invoice is checked against the declared weight, volume or unit count on the bill of lading and packing list. Falsified certificates of origin misstate where goods were actually made, either to sidestep anti-dumping duties tied to a specific country of manufacture or, more seriously, to disguise goods that actually originate in a sanctioned jurisdiction. Counterfeit chamber-of-commerce stamps and signatures — lifted from a genuine certificate and reused across unrelated shipments — are the common thread running through most of these schemes.

FINTRAC's published indicators for financial entities flag significantly amended letters of credit without reasonable justification, and unexplained changes to the named beneficiary or payment location, as red flags examiners are trained to escalate (FINTRAC, Money laundering and terrorist financing indicators — Financial entities). No single mismatched figure proves fraud on its own, but a pattern of inconsistencies across a counterparty's transaction history is what typically moves a file from routine review to formal escalation.

Why generative AI has raised the bar for document review

Generative AI tools now let a fraudster produce a bill of lading carrying a plausible carrier letterhead, a correctly formatted IMO vessel number and a chamber-of-commerce stamp that visually matches the genuine article — in minutes, where editing a scanned template used to take hours. Image generation and inpainting models can replicate embossed seals, watermarks and signature textures well enough to defeat a visual check performed by someone working through a stack of PDFs under time pressure. The tells that used to give away a forgery — mismatched fonts, a pixelated logo, an obviously pasted-in signature — are becoming less reliable as the tooling improves.

What generative AI cannot do is fabricate an entry in a vessel-tracking database, a chamber of commerce's own issuance log, or a carrier's internal booking system. A document can look flawless and still fail the moment it's checked against a source the fraudster doesn't control. That's why cross-referencing against independent third-party records remains the most durable control, with AI-generation signals functioning as a complement to existing controls rather than a replacement for them — a distinction worth keeping in mind when weighing any vendor's claims, including ours.

Detection signals compliance teams should check first

A small set of checks catches a disproportionate share of forged trade documents, and none of them require exotic tooling. Cross-document consistency comes first: does the cargo description, weight and value on the bill of lading match the commercial invoice, packing list and certificate of origin, field for field. Transit-time plausibility follows close behind — a bill of lading claiming a twelve-day Pacific crossing for a vessel whose typical schedule runs eighteen days deserves a second look. The vessel's IMO number should resolve to a real, active ship when checked against a public vessel-tracking source such as MarineTraffic or Equasis; a document citing a vessel that was scrapped, renamed or never existed under that IMO number is an immediate red flag. The chamber of commerce named on a certificate of origin should be traceable in an official registry — a stamp attributed to a chamber that can't be located, or that denies issuing the document when contacted, is close to conclusive. PDF metadata — the creation software, author fields, edit timestamps that don't line up with the claimed issue date — often survives casual tampering even when the visible content has been altered. Finally, stamps or signatures that appear pixel-for-pixel identical across documents purportedly issued by different companies, or on different dates, point to a template being recycled across multiple fraudulent filings.

Manual review alone catches a limited share of this activity: the ACFE's 2024 Report to the Nations found that internal controls detect only 37% of occupational fraud cases, with an average detection delay of 87 days — a lag most trade finance transactions, typically settled within weeks, cannot absorb before the funds have moved.

Fitting document verification into a KYB and Know Your Supplier workflow

Trade document checks work best sitting inside onboarding and ongoing monitoring, rather than being triggered only once suspicion is already raised. At onboarding, a supplier or counterparty's registered activity, jurisdiction and historical trade patterns should be established as a baseline — the Know Your Supplier discipline exists precisely to catch a mismatch between what a company claims to trade and what its filings and shipping history actually show. Ongoing monitoring then applies the same cross-document checks transaction by transaction, flagging deviations from that baseline instead of treating every shipment as a fresh, unconnected review.

For Canadian banks and other reporting entities financing trade, this sits within the broader customer due diligence obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), which FINTRAC enforces and which now carries an expanded administrative monetary penalties framework for non-compliant reporting entities (FINTRAC, Reporting suspicious transactions to FINTRAC). Where the true origin of goods is in question, Global Affairs Canada's guidance on export and import restrictions sets out the due diligence steps expected of Canadian importers and exporters before a payment or shipment proceeds, and CBSA's own verification and correction procedures apply once a declared origin is found not to hold up (Global Affairs Canada, Canadian sanctions — Export and import restrictions; CBSA, Memorandum D11-6-6 — Reason to Believe and Corrections to the Declaration of Origin). Several of the mechanics described above — phantom shipments, invoice manipulation, disguised beneficial ownership of the trading counterparty — map directly onto the broader money laundering typologies that Canadian reporting entities are required to screen against under their existing AML obligations. Firms handling Quebec-based counterparties should also note that trade documentation containing personal information falls under Quebec's Loi 25, which imposes stricter consent and breach-notification requirements than PIPEDA alone.

Our own review method rests on structural checks, metadata inspection and cross-document validation across several fields per document, rather than a read of any single PDF in isolation, with an additional layer of AI-generation signals, deployed according to client configuration, that complements these structural checks rather than replacing them. CheckFile's platform is built to handle verification across more than 3,200 document types and 32 jurisdictions, which in a trade context means bills of lading, certificates of origin, commercial invoices and packing lists can be checked against each other inside the same workflow used for standard KYC document verification in banking. Lenders and leasing providers evaluating where trade-document checks fit into a broader asset finance stack can look at CheckFile's leasing and financing solution. Document handling for trade files, which often carry commercially sensitive pricing and counterparty data, runs under the same controls described on our security page. For a broader view of how document checks fit across a compliance programme, our document compliance guide covers the wider set of obligations beyond trade finance specifically. Pricing for teams evaluating a trade-document workflow is set out on our plans page, and our team can walk through how CheckFile handles trade-specific document sets during onboarding.

What compliance teams actually ask about this

Compliance professionals on specialized trade finance and AML forums tend to ask narrower, more practical questions than the regulatory literature covers. A recurring one: how do you verify a bill of lading without calling the carrier on every single file, given the volume most trade finance desks push through. Another: is under-invoicing always a laundering signal, or can it reflect a legitimate transfer-pricing arrangement between related entities — the honest answer is that price alone is rarely conclusive, and it's the combination with other indicators (unusual routing, a counterparty with no verifiable trading history, payment structured to sit under a reporting threshold) that moves a file from anomaly to suspicious transaction. A third, increasingly common question centres on whether AI-generated forgeries can pass a visual check convincingly enough to fool an experienced document reviewer — the practitioner consensus is that they increasingly can, which is exactly why cross-referencing against external, fraudster-independent records has become the control that matters most.

Frequently Asked Questions

How can I verify a bill of lading is genuine without contacting the carrier every time?

Start by checking the vessel's IMO number and stated voyage against a public AIS tracking source such as MarineTraffic or Equasis, and compare the transit time against the carrier's known routing. If those checks hold up, cross-reference the cargo description and weight against the commercial invoice and packing list before escalating to a direct carrier confirmation, which should be reserved for files that fail the earlier checks or carry other risk indicators.

Is under-invoicing always a sign of money laundering?

No. Price alone can reflect a legitimate volume discount, a related-party transfer-pricing arrangement, or ordinary commercial negotiation, and treating every low invoice as suspicious would overwhelm a compliance team with false positives. It becomes a red flag when combined with other indicators — a counterparty with no verifiable trading history, routing that adds unexplained transit points, or payment structured to sit just under a reporting threshold.

Can generative AI produce a certificate of origin that passes a visual check?

Increasingly, yes. Current image generation and editing tools can replicate embossed stamps, watermarks and signature textures well enough to defeat a visual review carried out at normal processing speed. That's why verification against a source the fraudster doesn't control — the issuing chamber of commerce's own register, in the case of a certificate of origin — remains more reliable than inspecting the document's appearance alone.

Where should Canadian firms report suspected trade document fraud?

Suspicious activity connected to money laundering, including forged trade documents, should be reported to FINTRAC as a Suspicious Transaction Report (STR), consistent with the reporting obligation set out in FATF Recommendation 20 and in FINTRAC's own guidance for reporting entities (FINTRAC, Reporting suspicious transactions to FINTRAC). Where the fraud also involves a customs declaration, it should additionally be flagged to the CBSA, and evidence of a criminal offence can be referred to the RCMP.

Does checking a vessel's IMO number against AIS data actually catch fraud?

It catches a specific and common category: bills of lading referencing a voyage, vessel or shipping window that never happened. It won't catch a forgery built around a real vessel and a real, legitimate voyage used to cover a mispriced or misdescribed cargo, which is why the check needs to sit alongside invoice benchmarking and certificate-of-origin verification rather than standing in for them.

Forged bills of lading and certificates of origin are built to survive a quick visual check, not a cross-reference against records the person who forged them doesn't control. Building that cross-referencing into a KYB and trade finance workflow, rather than treating each document as a standalone review, is what turns an occasional catch into a repeatable control. If AI-generated forgeries are a growing concern in your onboarding or trade finance pipeline, our AI-generated document and deepfake detection capability is designed to sit alongside your existing checks — offering AI-generation signals as a complement to your existing controls, not a replacement for the cross-document and third-party verification described above.