Font Forensics: Spotting Forged Documents by Typography in Canada

Font forensics detects a forged document by examining whether every character on the page shares the same typeface, weight, spacing, and vintage as the rest of the file — inconsistencies that betray where text has been added, replaced, or backdated. Unlike error level analysis, which reads pixel-level compression artefacts in JPEG scans, or metadata forensics, which inspects a file's hidden production history, typography forensics works on the visible letterforms themselves. It catches a category of forgery the other two methods routinely miss: a well-executed edit made in native text where metadata has been carefully scrubbed.

A single mismatched font can undo an entire legal case. In the 2017 Pakistani Panama Papers proceedings, a document dated February 2006 was typed in Calibri — a font Microsoft did not make commercially available until January 2007 — a discrepancy documented by Al Jazeera's #Fontgate coverage that became central evidence before Pakistan's Joint Investigation Team and Supreme Court.

What Font Forensics Is

Font forensics is the forensic examination of typographic properties — typeface identity, character weight, kerning, baseline alignment, and stroke geometry — to determine whether all the text in a document was produced by the same process at the same time. The methodology sits within the broader discipline of forensic document examination formalised by the Scientific Working Group for Forensic Document Examination (SWGDOC) and supported by ASTM International standards for questioned-document analysis, as summarised in this overview of forensic document examiner practice — standards used internationally, including by Canadian forensic document examiners.

A genuine document — a pay stub generated by payroll software, a bank statement rendered by a core banking system, an identity card printed by a national or provincial issuing authority — uses one font, or a fixed set of fonts, applied with mechanical consistency across every field. Compliance teams reviewing Canadian rental references, pay stubs, and bank statements can treat any deviation from that consistency as a signal worth escalating, not proof of fraud on its own.

Typeface inconsistency is detectable independently of image compression or file metadata, making it a distinct third pillar of document forensics. Complementary techniques include error level analysis for JPEG scans and PDF metadata tampering checks; together the three cover the visual, structural, and hidden layers of a document.

The Five Typographic Red Flags Fraud Teams Should Check

Five recurring signatures separate a genuine document from a manually edited one, and each is checkable without specialist software.

Font substitution occurs when an edited field uses a typeface that is visually close to, but not identical with, the surrounding text — for example Arial swapped for Helvetica, or Calibri for Carlito. The two fonts render almost indistinguishably at a glance but diverge in the shape of specific characters, most reliably the lowercase "a", "g", "t", and the numeral "1".

Inconsistent kerning and spacing shows up as uneven gaps between characters or words in the altered region, because manual text insertion rarely reproduces the original layout engine's automatic spacing rules. A genuine field produced by the same rendering engine keeps uniform inter-character spacing across the whole document.

Mismatched font weight appears when inserted characters are marginally bolder, lighter, or thinner than neighbouring text — often invisible on screen but obvious once a region is zoomed to 400% or more. This frequently results from copying characters from a different source document or font file version.

Anachronistic fonts are typefaces that did not exist, or were not in commercial release, at the date the document claims to have been created — the exact flaw that undid the Calibri-dated 2006 filing in the Pakistani case. Any document purporting to predate its font's public release date is provably falsified on that basis alone.

Character-shape irregularity covers subtle deviations in stroke width, curve geometry, or baseline position within a single character, which occur when a fraudster cuts and pastes an individual glyph from another document rather than retyping the whole field. Academic work on this problem includes a Conditional Random Field model for font forgery detection, presented at ICDAR 2015, which classifies each character's likely typeface against its neighbours to flag statistically anomalous glyphs.

How Do You Tell If a Font Has Been Substituted in a Scanned Document

Compare the same character across multiple instances in the document, focusing on letters with distinctive counters and terminals such as "a", "g", "y", and "1". If the shape, weight, or slant of that character differs meaningfully between two occurrences that should be identical, the field has very likely been produced by a different font or a different rendering pass than the rest of the page.

Zooming to at least 400% resolves most font-substitution cases that are invisible at normal reading size. Free tools such as font-identification services (WhatTheFont, Font Squirrel's matcherator) can narrow an unknown typeface down to a shortlist, after which cross-referencing the font's public release date against the document's claimed date — as in the Calibri case — settles the question definitively.

Can Font Analysis Prove a Document Was Backdated

Font analysis can prove a document was backdated only when the identified typeface's public release date postdates the document's claimed creation date — a release-date mismatch stands on its own as conclusive evidence, independent of any other signal. Most other typographic red flags (substitution, kerning, weight) indicate a field was altered but do not by themselves date the alteration.

Font-release-date evidence is strongest when corroborated with the font vendor or an independent typeface historian, as Pakistan's investigators did by contacting Calibri's designer, Lucas de Groot, who confirmed the font's 2007 release predated the document's 2006 claim. In Canada, making a false document with intent that it be acted on as genuine is forgery under section 366 of the Criminal Code, with section 367 setting punishment and section 368 addressing the separate offence of using or acting on a forged document. A confirmed anachronistic-font finding is the kind of concrete, checkable fact that supports a forgery determination under this framework.

Suspect documents can be referred to the RCMP's National Forensic Laboratory Services, which examines questioned documents from sites in Ottawa, Edmonton, and Surrey. Ontario and Quebec run their own provincial forensic labs outside this system; Quebec compliance teams should also account for Quebec's civil law framework and Bill 25 privacy obligations, covered in depth in CheckFile's dedicated Quebec-focused article.

Font Forensics Versus ELA Versus Metadata Analysis

Each forensic technique targets a different layer of a document, and forgeries that survive one check often fail another.

No single technique catches every forgery, which is why cross-document, multi-layer review consistently outperforms any one method in isolation. According to the ACFE 2024 Report to the Nations, only 37% of occupational fraud is detected through manual or tip-based methods, with an average detection delay of 87 days — a gap combining structural, visual, and typographic checks is designed to close.

Typographic Red Flags by Document Type

Different document types carry different typeface risk profiles, since each is normally produced by a specific, limited set of software and fonts.

Why This Matters for Canadian Compliance Teams

Canadian lenders, property managers, and KYC teams increasingly encounter forged pay stubs, rental references, and proof-of-address documents where the fraudster has edited native text rather than a scanned image, making ELA ineffective and metadata scrubbing straightforward. Font forensics catches this gap by examining the visible letterforms the edit tool could not fully hide.

This matters most where regulatory obligations attach to the underlying decision: reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act must apply due diligence supervised by FINTRAC, and a forged income or identity document accepted at onboarding undermines that due diligence at its source. Teams handling suspect income documentation, such as pay stubs alongside CRA tax slips, benefit from the same disciplined check: zoom, compare repeated characters, check font-release dates for anachronisms. CheckFile's own approach reflects this layering, applied across the 3,200+ document types, 24 OCR languages, and 32 jurisdictions the platform supports.

Where Font Forensics Fits in a Verification Workflow

Font forensics works best as one check within a layered verification pipeline, because typographic anomalies are strong corroborating evidence but rarely sufficient proof alone. Lenders assessing equipment financing and leasing applications and banks running KYC onboarding both handle high volumes of pay stubs, invoices, and identity documents where a single typography anomaly should trigger secondary review, not automatic rejection. Context-aware scoring that distinguishes legitimate variation from an actual fraud signal is what keeps false positives manageable at scale.

Platform detail on how CheckFile structures this layered review, including its security and compliance posture, is on the security page; current plans are on the pricing page. For a broader walkthrough beyond typography, see the practical guide to document verification.

Font, metadata, and pixel-level forensics all target manually edited or copy-pasted content. A separate and growing risk is documents generated wholesale by AI — a threat requiring different signals entirely. CheckFile's AI and synthetic-document detection adds a signals layer for AI-generated content as a complement to existing structural and metadata controls; no solution, including this one, achieves 100% detection, and the goal is an auditable bundle of signals rather than a single binary score.

Frequently Asked Questions

What is font forensics in document fraud detection?

Font forensics is the examination of typeface identity, character weight, kerning, and letterform geometry to determine whether all text in a document was produced consistently by the same process. It is distinct from error level analysis, which examines JPEG pixel compression, and from metadata forensics, which examines a file's hidden production history.

Can font analysis alone prove a document is forged?

Font analysis can prove forgery conclusively only in the specific case of an anachronistic font — where the identified typeface's public release date postdates the document's claimed creation date, as in the 2017 Calibri case in Pakistan. Other typographic red flags, such as substitution or kerning inconsistency, are strong indicators that warrant further review rather than standalone proof.

How is font forensics different from error level analysis (ELA)?

Font forensics examines the visible letterforms of text — typeface, weight, spacing, shape — while ELA examines pixel-level JPEG compression artefacts invisible to the naked eye. Font forensics works on any rendered document, whereas ELA only works on JPEG scans and photographs.

What does the Criminal Code say about forged documents in Canada?

Section 366 of the Criminal Code of Canada defines forgery as making a false document, knowing it to be false, with intent that it be acted on as genuine; section 367 sets punishment, and section 368 creates the separate offence of using or acting on a document known to be forged. A confirmed anachronistic-font mismatch is the kind of concrete evidence these provisions require.

Which Canadian body examines suspected forged documents?

The RCMP's National Forensic Laboratory Services examine questioned documents as part of their national forensic mandate, from sites in Ottawa, Edmonton, and Surrey. Ontario and Quebec maintain their own provincial labs outside this system, and suspected counterfeit negotiable instruments are routed to the RCMP's National Anti-Counterfeiting Bureau.

Does CheckFile perform font or typography forensics?

CheckFile's verification approach combines structural, metadata, and cross-document consistency checks, with an additional layer of AI-generation signals available depending on client configuration. For documents where copy-pasted or substituted text is suspected, this multi-layer methodology functions alongside the manual typographic checks described in this article rather than replacing expert forensic examination.