PAN Tampering Detection

Endpoint Overview

POST /api/v1/ocr/pan-tampering-detection

Description

The PAN Tampering Detection API analyzes uploaded PAN (Permanent Account Number) card images or PDFs to detect signs of digital tampering, manipulation, or forgery. Using advanced image forensics and AI-driven analysis, the endpoint evaluates the authenticity of a PAN card document and returns a tampering verdict along with a confidence score indicating the likelihood that the document has been altered.

This API is a critical component in fraud prevention workflows, enabling organizations to automatically flag potentially forged or manipulated PAN cards during KYC onboarding, loan processing, account opening, and other identity verification scenarios. By catching tampered documents early in the process, businesses can significantly reduce fraud losses, regulatory penalties, and reputational damage.

Key Benefits

Automated Fraud Detection: Instantly identify tampered or forged PAN card documents without manual review

Confidence Scoring: Receive a quantitative confidence score to implement threshold-based decision logic

Flexible Input Support: Process both image files (JPEG, PNG) and PDF documents with a single endpoint

Seamless KYC Integration: Easily embed into existing onboarding and verification pipelines as a pre-verification check

Use Cases

Banking & Financial Services

Insurance

Fintech & Digital Platforms

Detect forged PAN cards during new account opening and KYC onboarding to prevent identity fraud

Validate PAN card authenticity before processing loan or credit card applications

Flag tampered documents in bulk verification workflows for audit and compliance teams

Technical Implementation

Authentication

All API requests require authentication using a JWT Bearer token. Authentication follows these steps:

Obtain API Credentials: Register with Surepass to receive your API key.

Generate JWT Token: Use your API key to generate a JWT token.

Include in Requests: Add the token to the Authorization header as Bearer TOKEN.

Different authentication tokens are used for sandbox and production environments:

Sandbox: https://sandbox.surepass.app

Production: https://kyc-api.surepass.app

Request Parameters

Request Headers

Header	Required	Description
Authorization	Yes	Bearer token for API authentication. Format: `Bearer <JWT_TOKEN>`
Content-Type	Yes	Must be set to `multipart/form-data` to support file upload

Request Body

Parameter	Type	Required	Description
file	file	Optional	The PAN card document to be analyzed for tampering. Supported formats include images (JPEG, PNG) and PDF documents.
use_pdf	boolean	Optional	Set to `"true"` if the uploaded file is a PDF document, or `"false"` if it is an image file.
base64	string	Optional	The PAN card document base64 string to be analyzed for tampering.
link	string	Optional	The PAN card document link to be analyzed for tampering.

Example Request

Note: This endpoint uses multipart/form-data encoding to support file uploads. The use_pdf parameter should be provided as form data alongside the file.

Process Response

Response Parameters

Parameter	Type	Description
data	object	Container object holding the tampering detection results
data.client_id	string	Unique identifier for this tampering detection request, useful for tracking and support
data.is_tampered	boolean	Indicates whether the PAN card document is detected as tampered (`true`) or authentic (`false`)
data.confidence	float	Confidence score (0–100) representing the likelihood of tampering. Higher values indicate greater confidence in the tampering verdict
status_code	integer	HTTP status code of the response (200 for success)
success	boolean	Indicates if the API request was processed successfully
message	string	Human-readable message describing the result
message_code	string	Machine-readable status code for programmatic handling

Example Successful Response

{
    "data": {
        "client_id": "pan_tampering_detection_uiraomdjqHggkwZeNSyD",
        "is_tampered": true,
        "confidence": 58.0
    },
    "status_code": 200,
    "success": true,
    "message": "Success",
    "message_code": "success"
}

Response Interpretation:

is_tampered: true with confidence: 58.0 means the system detected signs of tampering with 58% confidence

Implement threshold logic based on your risk tolerance (e.g., flag for manual review above 50%, auto-reject above 80%)

Possible Error Responses

Invalid File Format

Missing File

Authentication Error

No document detected

Server Error

{
    "data": null,
    "status_code": 400,
    "success": false,
    "message": "Invalid file format. Please specify 'use_pdf=True' for PDF inputs.",
    "message_code": null
}

This error occurs when the uploaded file is not a supported format. Ensure the file is a valid JPEG, PNG image, or PDF document. use_pdf must be set to True for PDF Inputs

Integration Best Practices

Security Recommendations

Secure Token Storage: Store JWT tokens securely in server-side environments; never expose them in client-side code or version control

HTTPS Only: Always use HTTPS endpoints to encrypt PAN card images and sensitive data during transmission

File Sanitization: Implement virus scanning and file type validation on your application layer before forwarding files to the API

Access Control: Restrict API access to authorized personnel and services; implement role-based access for tampering review workflows

Audit Logging: Maintain logs of all tampering detection requests and results for compliance audits and fraud investigations

User Experience Guidelines

Image Quality Guidance: Provide clear instructions to users for capturing or uploading high-quality, well-lit PAN card images to improve detection accuracy

Threshold-Based Workflows: Design tiered workflows based on confidence scores — auto-approve low scores, flag medium scores for manual review, and auto-reject high scores

Real-Time Feedback: Display processing status indicators during file upload and analysis to keep users informed

Graceful Error Handling: Show user-friendly messages when documents cannot be processed, with actionable guidance (e.g., "Please upload a clearer image")

Manual Review Fallback: Always provide a manual review path for edge cases where confidence scores fall in ambiguous ranges

Code Samples

cURL

Python

Node.js

Related APIs

PAN OCR API: Extracts text data (name, PAN number, date of birth, father's name) from PAN card images using optical character recognition.

PAN Verification API: Validates a PAN number against government records to confirm its authenticity and retrieve registered details.

PAN Comprehensive API: Combines PAN OCR extraction and database verification in a single call for end-to-end PAN validation.

Aadhaar Tampering Detection API: Detects tampering in Aadhaar card documents using similar forensic analysis techniques.

Face Match API: Compares the face on a PAN card with a selfie or another document photo for identity verification.

Compliance and Legal Considerations

When implementing PAN tampering detection, ensure compliance with India's Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 (DPDPA). PAN card images contain sensitive personal information — including name, date of birth, and a unique identification number — which must be handled in accordance with applicable data protection regulations. Obtain explicit consent from individuals before processing their PAN card documents. Implement strict data retention policies and ensure PAN card images are not stored longer than necessary for the verification purpose. Tampering detection results should be used as one factor in a comprehensive fraud assessment; automated decisions based solely on tampering scores should include a provision for human review and appeal. Organizations in regulated industries (banking, insurance, securities) must ensure their use of tampering detection aligns with RBI, IRDAI, and SEBI guidelines for KYC and document verification. Maintain detailed audit trails of all tampering detection activities for regulatory reporting and compliance audits.

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

{ "data": { "client_id": "pan_tampering_detection_uiraomdjqHggkwZeNSyD", "is_tampered": true, "confidence": 58.0 }, "status_code": 200, "success": true, "message": "Success", "message_code": "success" }

PAN Tampering Detection

PAN Tampering Detection#

Description#

Use Cases#

Technical Implementation#

Request Headers#

Request Body#

Example Request#

Response Parameters#

Example Successful Response#

Possible Error Responses#

Integration Best Practices#

Code Samples#

Request

Responses

PAN Tampering Detection

Description

Use Cases

Technical Implementation

Request Headers

Request Body

Example Request

Response Parameters

Example Successful Response

Possible Error Responses

Integration Best Practices

Code Samples