How Do You Verify Electronic Receipts In The Age Of Photoshop?

by

This is a slightly edited version of my answer to the following question on Quora. 

Short Answer: Verification techniques range from “do nothing” and heuristics through to rigorous matching of returns filed by buyer and seller.

Long Answer:

I’ll first answer the question that’s asked by taking the stated use case where Party A (Individual) pays Party B (Company) and Party B needs to verify the artefacts (e.g. screenshots, bank statements, receipts) submitted by Party A to prove payment.

Then, in the true spirit of Quora, I’ll answer the question that’s not asked by taking a trickier case where Party A (Individual or Company) pays Party B (Company) but a third party C (Government Agency) needs to verify the artefacts submitted by Party A to prove payment.

CASE 1: A PAYS B, B NEEDS TO VERIFY

I’ll take three examples.

EXAMPLE-1:

In Indian supermarkets, the Customer (Party A) reaches checkout, pays the Cashier (Party B) and receives the Receipt. At the exit, Customer passes through a gantry like Sensormatics, which beeps if Customer hasn’t paid for a certain item (or the tag attached to a certain item hasn’t been removed / demagnetized at checkout counter). These two steps are no different from those I’ve seen followed at supermarkets elsewhere in the world.

There’s another step, which I’ve seen used only on self-checkout lines outside India but is applied to all shoppers in India: At the exit, the Customer shows the Receipt and their shopping bags to a Security Guard (representative of Party B). The guard reads the number of bags mentioned in the receipt and looks at the number of bags physically carried out by the customer. If the two figures match, the guard stamps the receipt and lets the customer out. If they don’t, the guard digs deeper.

Now take the Receipt on the right that I got from an outlet of Star Bazaar, which is a joint venture between India’s Tata Group and UK’s Tesco. It’s not hard to Photoshop it.

AFAIK, the guard doesn’t make any effort to verify the authenticity of the Receipt. Perhaps the store management assumes that, in the short walk from checkout to exit, a customer can’t really pull up Photoshop, create a fake receipt and take a printout. I know this is a naive assumption since the customer could have printed out the fake receipt at home before visiting the store or could be carrying a genuine receipt from their previous visit to the same store.

So I don’t know how this verification works. Maybe the presence of the security guard acts as a strong deterrent to shoplifting. In the same way that mere installation of CCTVs is known to bring down crime – even if the cameras are not turned on!

EXAMPLE-2:

Student (Party A) pays fees to College (Party B) and collects Receipt in Month 1. In Month 6, student shows the Receipt to Exam Invigilator (employee or authorized representative of Party B), who allows the Student to take the exam only if the Student has paid the fees.

It’s again easy to Photoshop the fee receipt. But I guess the Accounts Department of the College supplies a list of names of students who have paid the fees to Exam Invigilator, who can match the Receipt produced by the said Student with the presence or absence of their name on their internal list.

So, I guess this verification works.

EXAMPLE-3:

Patient (Party A) admitted to a Hospital (Party B) is certified by attending physician (representative of Party B) for discharge. Patient – or more likely an attending relative or friend of the Patient – settles the bills at the Hospital’s Billing Counter (Party B), collects the Receipt, shows it to Nursing Station (representative of Party B), which releases the Patient.

The Receipt can be easily Photoshopped. But someone from the Nursing Station can independently view the payment status on the hospital’s internal system. Even if the Hospital is not fully computerized, someone from the Nursing Station can always call the Billing Counter to verify the payment status.

So, I guess, this verification also works.

CASE 1 does not present a big verification challenge for Party B because, in most circumstances, it inevitably has an independent record of the payment and can cross-check Party A’s proof artefacts against the status displayed on its internal systems.

The real problem in this case is for Party A. If Party B challenges the authenticity of its receipt on the grounds that its internal system does not reflect any record of payment, it’s not easy for Party A to prove that it has made the payment. I know someone who is currently going through this ordeal but that’s a story for another day.

Things get really interesting in Case 2.

CASE 2: A PAYS B, C NEEDS TO VERIFY PAYMENT

As we all know, certain expenses are tax deductible for both Individuals and Companies e.g. travel.

On the one hand, the Taxpayer (Party A) has a monetary incentive to claim that they have made payments to a Company (Party B) and submit false receipts to claim the deduction in order to pay less tax. On the other hand, the Tax Authority (Party C) needs to ensure that they don’t leave any tax dollars on the table i.e. grant ineligible deductions, so it needs to rigorously verify the proof artefacts submitted by Party A. The verification challenge is magnified by the fact that Party C does not have access to the internal systems of Party B to whom the payments were purportedly made by Party A. Therefore, the issue of establishing the authenticity of proof artefacts takes on a greater significance in this case.

Let’s see how this works.

In the good old days in India, we filed income tax, sales tax and other tax returns in paper form. For expenses claimed as tax deduction, we submitted a copy of the Receipts along with the tax return.

Then tax returns became electronic. We filed the return on the tax department’s website and attached scanned copies of all Receipts.

We believed that the tax authorities had some way of figuring out whether the said receipts were genuine or fabricated using whatever predecessor of Photoshop that existed at the time. (I’ve heard that receipt numbers are compliant with MOD10 algorithm in Canada. So, the tax authority can tag receipts with non-MOD10 compliant numbers as fake and take further action. However, there’s still no guarantee that receipts with MOD10-compliant numbers are genuine.)

Then came a time when tax authorities told us not to submit any proof artefacts along with our e-returns. As people started wondering how tax authorities verified proof of payments, rumors surfaced that tax authorities never ever did. Apparently, they used rules of thumb – or what we’d call “heuristics” in today’s age of Artificial Intelligence / Machine Learning – like “A company with X revenue or an individual with Y salary will not spend more than Z amount on travel”. So, tax authorities called for Receipts – and took steps to rigorously verify them – only from those taxpayers whose travel expense claims were disproportionately high compared to their revenue / salary.

Cue to the present day.

Subsequent to the rollout of Goods & Services Tax by the government of India in July 2017, verification of expenses has been taken to the next level. All invoices and receipts should carry the so-called GST Identification Number (GSTIN) (and many more details). Buyer needs to mention their Seller’s GSTIN and Seller needs to mention their Buyer’s GSTIN in their respective invoices and GST returns. Using software at their end, tax authorities flush out fake payments by matching payments / transactions across the buyer-seller pair at invoice line item level. I believe India is the only country in the world to follow such a rigorous procedure to verify payments across multiple entities. Cf. my blog post GST For Techies – Part 2 for more details.

Let me hasten to reiterate that the aforementioned method of verifying payments is used by the government’s GST (Indirect Tax) Department. Going by this Economic Times article, the government’s Income Tax (Direct Tax) Department does not seem to use this – or any other – system to verify payments, and has been gifting away tax deductions on tax-savings investments never made by taxpayers.

At last, I don’t need to be defensive when people tell me that my answers are too short by Quora standards!