Someone opens a real payslip in a free PDF editor, changes one number, and saves. Nothing looks wrong, because nothing is wrong with how it looks.
Income verification in a lending file usually rests on an uploaded payslip. A payslip does not have to be forged. It only has to be plausible. A classical document check that only asks whether a document looks right passes a document like this without noticing anything, because nothing about how it looks was touched.
Aletheia reads the parts of a document that a forger does not think to fix, asking whether the document makes sense rather than whether it looks right: whether the arithmetic holds, whether the claimed salary matches money that actually arrived, whether the pay date matches the employer's cycle. Three layers work independently and are correlated: file and pixel forensics, content logic and plausibility, and behavioural consistency against real account data. In a proof of concept, Aletheia recognised every case the bank had found and surfaced additional suspicious cases the existing process had missed.
A manipulated document is real and then edited, so forensics catches it. An original fake was never real: it was generated cleanly in one pass and leaves forensics nothing to find. A tool with one layer catches one of these and calls the other clean. The same three layers apply wherever a document is asked to support a decision, not only a payslip in a lending file.