How to spot a fake or altered boleto

For teams paying Brazilian suppliers, where the invoice arrives as a PDF by email — which is exactly where the fraud gets in.

A boleto bancário is Brazil's universal payment slip: a standard-layout document carrying a barcode and a 47-digit typeable line, payable at any bank, any app, any lottery agent. It is also the country's most-abused business payment instrument, for a structural reason that has nothing to do with how carefully anyone reads it. This page covers the three shapes the fraud takes, the checks anyone in accounts payable can run by hand, and what the PDF file itself records about having been edited — with the limits of each stated plainly, including the case where none of them finds anything.

TL;DR

  • The layout proves nothing. The boleto's design is standardised and any generator reproduces it. Only the typeable line and the record registered behind it decide who gets paid.
  • One check beats all the others. Key the line into a banking app before paying and read the beneficiary, CNPJ, amount and due date as registered — not as printed on the attachment.
  • The file answers one of the three scams. A genuine slip that was edited leaves traces in the PDF's structure; one generated from scratch leaves none, and malware that swaps the line at payment time never touches the file at all.

The three shapes of boleto fraud

Nearly everything in circulation falls into three shapes. They cost the fraudster different amounts of effort and — the part that matters here — leave completely different traces in the file.

  1. The genuine boleto, edited. The fraudster holds a real slip — intercepted in transit, found in a compromised mailbox, or simply forwarded along the chain — and replaces the barcode, the typeable line and sometimes the beneficiary with details of an account they control. Everything else stays: same supplier, same invoice number, same printed amount. This is the common shape in business-to-business billing, and it is the one the file gives away, because editing a server-generated PDF leaves marks.
  2. The brand-new boleto with the “updated due date”. An email arrives that looks like it came from the supplier, often replying inside a real thread, saying the previous slip expired, that there was a problem with the bank, or that the company changed institutions — here is the replacement. The attachment was generated from scratch by the fraudster's own tool with the layout copied. Structurally it is spotless: one revision, coherent metadata, no editing trace. No structural signal catches this, and this page repeats that below, because it is the point that most misleads buyers of forensic tooling.
  3. The boleto swapped on the machine. Banking malware that sits on the workstation and rewrites the typeable line the moment it is copied, or substitutes the downloaded PDF. Here the file you analyse may well be the real one; what was tampered with is what reached the payment field. The remedy is to verify in the banking app, at the moment of payment, not in the file — which is why the registration check below is the most valuable item on the list.

Note the asymmetry: the first shape is attackable from the file's structure, the second is not attackable that way at all, and the third never passes through the file. An honest tool says which of these it works on — this one works on the first, helps triage the second by a different route, and has nothing to say about the third.

Why looking at it does not work

The advice that circulates on consumer banking blogs — watch for spelling errors, a blurry logo, misaligned fields — describes the amateur of a decade ago. The boleto has a standardised layout: the compensation slip, the field positions, the barcode font and the structure of the typeable line are specified so that any bank can process any slip. Reproducing that is an afternoon's work, and off-the-shelf generators already do it.

Worse, what settles the payment is not what you read. ATMs, apps and clearing all process the barcode or the typeable line. The beneficiary name printed across the top plays no part in settlement. A slip can say “ACME Distribuidora Ltda” at the top and send the money to a different company at a different bank with no visual inconsistency whatsoever, because inside the file the two facts are not connected to each other at all.

The rule that summarises everything. On a boleto, the only data with any effect are the digits encoded in the typeable line and the registered record behind it. Everything else is printed text, and printed text is the easiest thing to forge in any document.

The checks you can run by hand

None of these needs a tool, an account or an API. In order of return on effort, best first.

1. Read the registered slip in a banking app before paying

Since 2018 every collection boleto is registered with a central platform before it can circulate. So when the typeable line is scanned or keyed into a Brazilian banking app, the confirmation screen shows the beneficiary, the CNPJ (the Brazilian company tax number), the amount and the due date as registered against the slip — not as printed on the PDF that reached you. If those disagree, you are holding a fake, and you found out before spending anything.

This is by a wide margin the strongest check on this page, and it is free. If the paying entity uses DDA, better still: slips issued against its CNPJ appear inside the bank, and paying from there means never trusting an email attachment at all.

2. Compare the bank code against the bank printed on the slip

The first three digits of the typeable line are the code of the bank the slip was registered with, and the fourth is the currency — 9 for the real. A slip carrying Itaú's branding whose line begins 237 is wrong.

One caveat, so this does not become a false-alarm generator: it is normal for the boleto's bank not to be your supplier's bank. Plenty of Brazilian companies bill through fintechs and billing platforms, and the code that appears is the settling institution's, not the supplier's commercial account. The warning sign is a mismatch between the code and the logo printed on that same slip, not between the code and your expectation.

3. Decode the amount and the due date out of the typeable line

A bank boleto's typeable line is 47 digits and carries the amount and the due date inside it. If the figure printed in the “Valor do documento” field does not match the encoded amount, somebody changed one of the two.

34191.09008 00123.451239 45678.900007 5 15650000150000 bank 341 = Itaú currency check digit due date 1565 = Sep 10, 2026 amount = R$ 1,500.00 check it against the printed amount the rest is the bank's free field — each block ends with its own mod-10 check digit
The worked example's typeable line, field by field — the amount and the due date are encoded in it.

a 47-digit typeable line, field by field

34191.09008  00123.451239  45678.900007  5  15650000150000

34191.09008    field 1 · bank 341 · currency 9 · free field · mod-10 check digit
00123.451239   field 2 · free field · mod-10 check digit
45678.900007   field 3 · free field · mod-10 check digit
5              field 4 · barcode's overall check digit · mod-11
1565           field 5 · due-date factor  →  2026-09-10
0000150000     field 5 · amount in centavos  →  R$ 1,500.00
  • Amount. The last ten digits are the amount in centavos, left-padded with zeros. 0000150000 is R$ 1,500.00. A slip that prints R$ 1,500.00 and encodes 0000180000 will debit R$ 1,800.00 — and the app will display the encoded amount, because that is the one that counts.
  • Due date. The four digits before the amount are the fator de vencimento, a day counter defined by FEBRABAN. The counter reached 9999 on 2025-02-21 and rolled back to 1000 the next day, so one factor can map to two dates 27 years apart; any online factor calculator resolves it. In the example above, 1565 is 2026-09-10.
  • Check digits. Each of the first three fields ends in a mod-10 check digit, and the lone digit in the middle is the barcode's overall mod-11 digit. A line invented by hand, or altered digit by digit, almost always breaks here — the app rejects it before even consulting the registry. A tool-generated line does not: its check digits will be correct, because the tool computed them. A valid check digit is not evidence of legitimacy, only the absence of a typing error.

Utility and tax slips — boletos de arrecadação for water, electricity, municipal taxes — follow a different standard: they start with 8, run to 48 digits and lay the fields out differently. The bank and registration checks still apply; the field map above does not.

4. Check the beneficiary's CNPJ, not the name

A trading name is free text; a CNPJ is not. Take the CNPJ printed in the beneficiary field and look it up in the Receita Federal register: the legal name must be the supplier you actually contracted with, and the registration must be active. Two patterns that show up on fraudulent slips: a CNPJ opened a few weeks ago, and a legal name that resembles the supplier's without matching it — the one-word difference nobody reads carefully at 17:50 on a Friday.

Check the sacador/avalista field too where it is filled in. That is where third-party billing legitimately lives, which is exactly why an unexpected beneficiary goes unnoticed there.

What the file gives away

A boleto is a machine-generated document. It should have been written exactly once, by a server-side generator — the bank's portal, an ERP, a billing platform — in a single pass, with one set of metadata and one font subset per typeface. Every departure from “written once by one tool” is a question you can put to whoever sent the file.

  • More than one revision. Bytes appended after the first %%EOF. The signal is strong when a later revision overwrites an object that already existed and carries page, content-stream or image data — meaning the displayed appearance changed after generation. That is precisely the signature of a typeable line pasted over the original slip.
  • A consumer editor in the production chain. Online converters, desktop PDF editors, image editors. A billing system does not emit slips by way of Photoshop. Common benign cause: the recipient re-saved the file to batch it or to shrink the attachment.
  • Two metadata records that disagree. The Info dictionary against the XMP packet. Editors routinely update one and forget the other, and sometimes only one of them names the tool at all.
  • Internal dates that do not cohere. A modification date earlier than the creation date, or dates that do not square with what the page claims. Comparing the date stored in the file against the issue date printed on the slip is your job — the engine does not read the page — and the metadata viewer shows both fields with no account needed.
  • The same font embedded twice. Glyphs from one typeface embedded on two separate occasions: the signature of text added to a finished document by a second tool.
  • Visible vector text over a rasterised page. Legitimate scans carry no text layer, or an invisible OCR one. A handful of visible glyph runs over a full-page image is how numbers get changed on a scan.

Each family is documented in full — with the benign causes named alongside the malicious ones, which is what matters to anyone building a review queue — in the fraud signals field guide. The manual version of the same checks, with terminal commands, is in how to detect an edited PDF.

When you have both files. If the supplier sent a replacement and you still have the original, comparing the two PDFs answers a more direct question than any single signal: is this file a descendant of that one, a different file generated from scratch, or that one with an extra revision stuck on the end?

What this does not catch

Said without hedging, because a fraud tool that oversells itself is worse than no tool:

  • A boleto generated from scratch carries no signals at all. That is the second shape from the top of the page, and the usual one in the “updated due date” scam. The file was written once, by one tool, never edited — which is the description of a healthy file. It scores low, correctly. Only the manual checks reach that case; nothing else on this page does.
  • Tamperlens does not read the typeable line. There is no OCR, no barcode reading, no check-digit validation and no comparison between the printed and the encoded amount. The whole manual-checks section is human work, deliberately: doing that reading badly would produce something with the shape of a verdict and the reliability of OCR.
  • Signals are not verdicts, and no signal is not an approval. A legitimate replacement issued from the bank's own portal is a clean new file with nothing to report. A genuine slip that passed through three inboxes and an attachment compressor may raise two signals with nobody having tampered with anything.
  • Nothing here verifies that the debt exists. The tool does not know whether you owe that amount to that supplier. A perfectly genuine slip for a bill that is not yours passes without a scratch.

For the fabricated-from-scratch case there is a route on the API, and it is honest about its price: an issuer baseline. Every institution generates its PDFs with a fixed toolchain, and that toolchain leaves a consistent structural fingerprint — same producer, same PDF version, same embedded font set, same page geometry. A fabricated slip is internally coherent and wrong for the issuer whose name is on it. The price: no Brazilian bank baseline ships with the product — the bundled profiles are US institutions, built from published documents. For boletos the useful baseline is one you train yourself, on slips you already know to be genuine, from the recurring supplier you pay every month. The procedure is in the API reference.

Fitting it into accounts payable

The people who feel this fraud are not the security team: they are the finance function of a twenty-person company, the accounting firm paying bills for thirty clients, the building-management company, the buyer who receives supplier slips by email. All with the same profile — high volume, few people, no budget for an anti-fraud platform.

  1. Run the registration check on every slip, always. It is free, it takes sixteen seconds and it reaches all three shapes of the fraud. No file check substitutes for it.
  2. Fix a rule for changes to banking details. Any change of account, bank or supplier CNPJ requires voice confirmation on a number that was already on file before the request arrived. That single control is worth more than every tool on this page, and the email asking for the change is always convincing.
  3. Use the file check to triage, not to refuse. A high signal becomes “ask the issuer for the original and check the registration with extra care”, not “accuse the supplier”. The most effective response to a structural signal is a specific request: “could you download it again straight from the bank and resend it without opening it in any other application?” Legitimate senders can.
  4. Store the evidence, not the file. Persist the signal ids and the evidence objects alongside the payable. That is a small audit trail with no document content in it, and it is what supports the decision if it is questioned later.
  5. Measure your own traffic before setting a threshold. Run a sample of slips you already believe are genuine, by supplier, before deciding what counts as an alarm. Toolchains vary enormously between issuers, and knowing what “normal” looks like for your own suppliers is worth more than any default we could ship.

Frequently asked questions

Can you tell a fake boleto just by looking at the PDF?

Almost never. The boleto layout is standardised by FEBRABAN, so any generator reproduces the artwork, the bank logo and the field positions exactly. What separates a legitimate boleto from a fake is not visual: it is the linha digitável, which encodes the bank, the amount and the due date; the registered record of the slip, which the payer's banking app shows before payment; and, when the file was edited rather than generated, the history the PDF keeps about itself.

Does Tamperlens read the linha digitável or the barcode?

No. Tamperlens does no OCR, does not read the numbers printed on the page and does not validate check digits. It reads the structure of the file: how many times the PDF was written, which tools signed the metadata, whether the two internal date records agree, whether a font was embedded twice. The linha digitável checks on this page are yours to run — and they are the cheapest ones available, because they need nothing but a calculator and a banking app.

Does a fake boleto always leave signals in the file?

No, and this is the most important limit on the page. If the fraudster generated the boleto from scratch in their own tool, with their own linha digitável, the file is structurally spotless: a single revision, coherent metadata, no editing traces at all. Nothing fires. Structural signals catch a genuine boleto that was altered; they do not catch a whole document that was never genuine. That case is what the manual checks are for, and — on the API — an issuer baseline trained on boletos you already know to be real.

A supplier sent a replacement boleto "with an updated due date". What now?

Treat it as untrusted until proven otherwise, because that sentence is the standard opening of the scam. Do not reply to the email that arrived: call the supplier on a number you already had on file, never one printed in the new message or on the new slip. And read the slip in a banking app before paying — the registered beneficiary, CNPJ and amount are shown there, and it is the registration, not the PDF, that decides where the money goes.

The report flagged "incremental updates" on a boleto. Is that fraud?

Not on its own. The signal says the file was written more than once after it was created, and there are legitimate reasons: the recipient opened it in a system viewer and re-saved it, merged several slips into one file, printed to PDF for filing, or ran the attachment through a compressor. It gets stronger when a later revision overwrites a page or content object, because then the displayed appearance changed after generation. Even so it is grounds for asking the issuer for the original file, not for accusing anyone.

Do I have to upload the boleto anywhere? Is that safe?

The file travels over HTTPS, is parsed in memory and is discarded when the response is written. No document is written to disk, nothing is logged, there is no human review step and nothing is sent to a third party. The analysis does not need the numbers either: it is structural, and the content of the page is never interpreted. The privacy policy spells this out.

Run a real slip through the checker

The free checker takes a dropped PDF and shows the same report the API returns — no account, nothing stored. Start with a boleto you know is genuine, from the supplier you pay every month; then run one you opened and re-saved in an online editor yourself. The gap between those two reports is what tells you whether this signal is useful in your workflow. Need it inside your own payables system? One HTTP call returns the same report as JSON — see the API quickstart, 50 documents a month on the free tier, with the paid plan amounts on pricing.

Tamperlens reports risk signals, not authenticity verdicts. Signals can have benign causes; combine them with your own decision logic — and, for a boleto, with the registration check in a banking app, which is the only one that decides where the money actually goes.

Related reading