AI document fraud detection has become an urgent problem for Australian lenders, and the issue is now in front of federal parliament. In its submission to the Joint Select Committee on Artificial Intelligence, the Australian Banking Association (ABA) warns that AI makes it easier to produce fake payslips, bank statements and identity documents at scale. As the committee’s hearings continue this week, the banks want customer-consented access to Australian Taxation Office (ATO) income data so they can check what applicants earn at the source. If your business makes decisions based on documents customers upload, this matters to you too.
Here is what the banks are asking for, why manual checks are failing, and what sensible detection looks like for lenders, brokers, insurers and other document-heavy businesses.
What the banks told the AI inquiry
The ABA submission (dated 2 October 2026) calls loan fraud “a key concern for banks”. It asks the committee to support two fixes:
- A verifiable digital identity available across the digital economy, not only for government services, so banks can confirm who an applicant is without relying on a document AI could fabricate.
- ATO income data shared through the Consumer Data Right, so income can be cross-checked at its source.
The ABA also asks the government to expressly preserve industry’s ability to use AI to detect scams, fraud and financial crime, so that no future “high-risk” AI designation captures those protective uses. On 8 October, The Mandarin reported that the big banks are applying unprecedented pressure on the ATO for access to this earnings data, as AI-enabled loan fraud threatens billions in losses.
The push is not new. In August, a Senate productivity committee interim report recommended the government explore amending tax law that currently stops the ATO sharing tax information with a bank, as Broker Daily reported. What has changed is the urgency, and the fact that the AI inquiry is now hearing it.
Why fake payslips are now an AI problem
Doctored payslips are not new, but they have become far cheaper and more convincing. In an interview with The Adviser, Experian’s A/NZ head of fraud and identity, Richard Atkinson, said AI-generated payslips, bank statements and other income documents have become so persuasive that spotting fraud by manual review is “nearing on impossible”. He said mortgage and vehicle finance were where Experian saw the greatest exposure.
Atkinson described a simple trick fraudsters use to hide editing: manipulate a PDF statement, then print and scan it or photograph it on a phone. The result is an image of a document, with much of the digital evidence stripped out. His advice for brokers is to always ask for the original digital copy.
The same article covered AUSTRAC’s Fintel Alliance Operation Claw, which analysed data from 10 major Australian banks and identified potentially hundreds of millions of dollars in suspect lending, mostly linked to Sydney properties.
What AI document fraud detection actually checks
No single tool catches everything; Atkinson was frank that detection tools “don’t detect every fraud”. Good programs layer checks so a forger has to beat all of them at once.
1. Source data before documents
The strongest check is to not rely on the document at all. Open banking lets a lender see income and expenses straight from the applicant’s bank account, with consent. ATO data via the Consumer Data Right would add another source if the law changes. Lending experts told Banking Day that tax data can lag by months, so it will not replace every other check.
2. Document forensics
Machine learning and image analysis can read submitted files and look for signs of manipulation: inconsistent fonts or layouts, edited regions, metadata that does not match the claimed source, and figures that do not add up across pages. This is where AI document processing and computer vision overlap: the same models that extract data from a PDF or phone photo can also score how trustworthy that file looks.
3. Cross-document and cross-application matching
A fake payslip has to agree with the bank statement, the employment details and the application itself. Software can reconcile these automatically. Across a whole pipeline, it can also flag applications that share a device, IP address or physical address (signals Atkinson listed for direct channels) or reuse the same document template.
4. Identity, not just ID
Atkinson’s point was that a driver licence photo proves little on its own. Is the licence valid, and is the person presenting it the person on the card? That points to proper identity verification and liveness checks, the same capability the ABA wants built into a national digital identity.
5. Straight-through for clean files, people for the rest
Detection should not slow down honest customers. Automate the checks, let clean files through, and send the exceptions to a trained person who goes back to the customer. CommBank is a useful reference: its 6 October announcement says its AI systems generate more than 40,000 proactive fraud alerts a day, alongside human-supervised agentic AI used by its fraud teams.
It is not only a banking problem
Any workflow that accepts a document as proof faces the same risk: broker and non-bank lender origination, insurance claims supported by invoices and receipts, supplier onboarding and accounts payable, and rental or credit applications. Smaller lenders and brokers will also be watching whether any ATO data access is offered equally beyond the big four.
The practical question for each is the same: which documents do we accept as evidence, what would a convincing fake cost to produce, and what independent source could we check it against? For lenders and fintechs, our finance AI development page covers how we approach this work, and AI integrations connect checks to the systems you already run.
Watch the governance traps
Fraud models make or inform decisions about people, so they come with obligations. From December 2026, the ABA notes, banks must disclose in general terms when an automated decision using personal information significantly affects a customer. The ABA argues that this should not extend to explaining how fraud systems work, because that would help fraudsters evade them. Our explainer on the automated decision-making Privacy Act rules covers what that disclosure involves.
Three other things to get right:
- False positives cost real customers. Measure how often genuine applicants are flagged, and make sure a person reviews before anyone is declined.
- Keep the evidence. Log which checks ran, what they found and who made the final call.
- Minimise the data. Collect what you need to verify, protect it, and do not let a verification feed turn into a general income database.
This is general information, not legal or compliance advice. Check your obligations under privacy, AML/CTF and responsible lending laws with a qualified adviser.
What to do this month
- List every decision in your business that relies on a customer-supplied document.
- For each, note whether an independent data source (open banking, payroll or the issuer) could replace or confirm it.
- Ask applicants for original digital files, not scans or photos, wherever you can.
- Pilot automated forensics and cross-checks on a sample of past files, including known fraud cases, before you switch anything on.
- Write down who reviews flags and how quickly, so detection does not become a bottleneck.
Not sure where to start? Our guide to what an AI audit includes shows how we map processes, data and risk before recommending any build.
Find the document-fraud gaps in your process
An AI business audit maps where your decisions rely on uploaded documents, where fakes could slip through, and which checks would pay off first. Aideveloper builds compliance-first AI document and vision systems for Australian organisations. Talk to us about a practical detection pilot.
Featured image: Photo by Hanna Pad on Pexels.
