Three ways to fake a receipt. All three got caught.
Once 'show me the receipt' became the standard, the obvious next question was: what happens when someone tries to forge one?
The job I handed over
- Test whether a signed proof-of-work receipt could be faked well enough to pass as real, before trusting it as the basis for paying out or approving work.
What happened
- Built a verification gate that checks a receipt's signature against the work it claims to certify, not just whether a receipt exists.
- Ran three separate forgery attempts against it: a real receipt with one field quietly edited after signing, a receipt fabricated without ever obtaining a valid signing key, and a receipt that was correctly signed but attached to a false claim about the underlying work.
- All three were built to look, at a glance, exactly like a legitimate pass.
How I checked it
- Ran a genuine, unmodified receipt through the same gate as a control, to confirm the gate wasn't just rejecting everything.
- The tampered-field forgery failed on signature mismatch. The no-key fabrication failed immediately for lacking a valid signature at all. The correctly-signed-but-false receipt was the interesting one — the signature was real, but the claim it certified didn't match the independently observed state of the work.
- Only the untouched, honestly-obtained receipt passed.
What it took from me
- The gate itself took real design time — it had to check the claim against outside evidence, not just check the signature's math.
- Documented all three forgery patterns so future audits test against known ways to fake a receipt instead of starting from zero.
What I took from it
- A signature proves the receipt wasn't altered. It doesn't prove the receipt is telling the truth. You need both — and most 'verified' systems only have the first.
Try this
- Before trusting any proof-of-completion (a signed log, a screenshot, a test-pass report), write down the three ways someone — or some agent — could fake one.
- Build your verification check against the claim itself, not just against the wrapper (the signature, the timestamp, the format).
- From time to time, try a forged receipt against your own check, the way you would test whether someone could break into a login page.
Applies to any workflow where a report of completed work triggers payment, approval, or trust in later steps — contractor invoices, agent task receipts, quality-check approvals.
Source
Verification-gate test log