File review is triage. It sorts documents into fine, ask again, and escalate, and it is very good at that. What it cannot do is answer the last question, because the last question is almost always about origin, and origin is a fact about the world rather than a fact inside the file. The reviewer’s real skill is recognizing the moment the file has said everything it can and knowing what to ask for next.
The signal that the file is finished talking
Three situations end a file review, and all three end it in the same place.
- The arithmetic does not reconcile and the applicant’s explanation cannot be tested against anything you hold.
- The metadata raises a provenance question — a general-purpose editor, a generator signature, a reversed timestamp — which is a question about origin by definition and one metadata cannot answer.
- The document is internally perfect. A clean file is the least informative outcome there is, and on a material decision it should not end the process by itself.
Asking for another copy of a document whose origin you doubt is asking the same question to the same answerer. Change who is answering, not how many times you ask.
Rung 1 — a different document, not another copy
There is a narrow case where more paper still helps: when you need a period you do not have, or a field the first copy cropped. An adjacent pay period lets you test year-to-date continuity. The statement month either side lets you test whether an opening balance was carried forward honestly. A full statement rather than a summary page gives you the transaction detail the summary hid.
This rung is cheap and often sufficient. It stops being useful the instant your doubt is about authorship rather than coverage.
Rung 2 — the original download from the institution’s portal
This is the most underused request in document review, and usually the most productive. Ask specifically for the file as the institution generated it, downloaded from the bank’s or payroll provider’s own site, and sent without being printed, scanned, screenshotted, re-saved, or combined with anything else.
It matters because handling destroys evidence. A screenshot discards every structural signal a PDF carries. A print-and-rescan replaces the document’s history with the scanner’s. A well-meaning applicant who assembles a packet in an editor produces a file that looks worse than the original it was made from. Asking for the untouched download frequently resolves a finding that was never about the applicant at all.
Be reasonable about what you are asking. Some institutions retain only twelve or twenty-four months of statements online, some paperless accounts expose statements only through an app, and an applicant using a shared or borrowed device may have a genuine obstacle. Difficulty is not a signal.
Rung 3 — a consumer-permissioned data connection
When the question is whether an account or an income stream exists as described, the strongest answer available to a private reviewer is a connection the applicant authorizes directly with their institution. The applicant grants read-only access through a data-access provider; you see balances, transactions, or payroll records at the source rather than in a file someone emailed you; and the applicant can revoke it.
For payroll specifically, this is the rung that replaces the stub entirely. A permissioned payroll connection or an authorized income-verification service reports what the payroll system holds, which is the thing the stub was only ever a printout of. For accounts with no branch network, it is often the only meaningful escalation that exists.
Do not request an applicant’s online banking or payroll username and password, a one-time code, or a screen-share of a logged-in session. It is unsafe for them, it creates liability for you, and it is unnecessary — permissioned access exists precisely so that nobody has to hand over a password.
Rung 4 — authorized confirmation with the institution
The last rung is a person at the employer, the payroll provider, or the bank, contacted under whatever authorization your policy and jurisdiction require. The rule that makes it worth anything is the one reviewers skip: use contact details you sourced independently — the company’s published main line, a regulatory registry, a directory — and never a phone number, email address, or web address printed on the document you are questioning. A fabricated document can supply a fabricated verifier.
Document the call the way you would document the file: who you reached, how you found them, when, and precisely what they confirmed or declined to confirm. Where a professional employer organization or a staffing arrangement is involved, expect employment and payroll to be confirmed by two different parties. Ocolta’s employment letter guide covers this conversation in detail.
The ladder as a checklist
Escalation goes wrong in predictable ways — asking for the wrong thing, asking the wrong party, or asking one applicant and not another. These are the rules that prevent each.
- Name the specific field and the specific inconsistency before you ask for anything.
- Ask for a source document rather than an explanation of a number.
- Request the original download from the institution's own portal, not a new copy of the same file.
- Offer a consumer-permissioned connection or an authorized verification service where your policy allows it.
- Use contact details you looked up independently, never ones printed on the document in question.
- Never ask for account credentials or live account access.
- Give a clear deadline, put the request in writing, and keep it in the file.
- Apply the same rung of the ladder to every applicant in comparable circumstances.
Where a paid review fits, and where it does not
One step sits beside the ladder rather than on it. When the file itself deserves a closer read before you escalate externally, AI Deep Review ($5 per document, $10 for Deep Review+, no subscription) organizes fraud-risk and AI-generation indicators with evidence locations, benign explanations, limitations, and next checks. Deep Review+ adds public corroboration for the employer, bank, or payroll provider the document names, and a “not found” there is inconclusive, never an adverse finding — small, new, and offline organizations routinely have no public web presence.
It is still file review. It can return “unable to determine,” and it does not replace a single rung above it. If the question is whether the account exists or whether the employment is real, skip it and escalate.
When the ladder ends without an answer
Sometimes it does, and the correct outcome is to say so. Record what you requested, what arrived, what did not, and what remains unverified. “Unable to determine” is a legitimate and frequently correct result, and a file that says so honestly is more defensible than one that reaches a conclusion the evidence never supported. What to do with that result is a policy question, and the page on handling it covers the decision side.
Ocolta reports supported file observations and arithmetic relationships. It does not prove a document authentic or fraudulent, does not confirm identity, account ownership, employment, or issuer records, and does not return a fraud verdict. Review priority is not fraud probability. Ocolta supports document review; it is not an automatic approval, denial, tenant-screening, or adverse-action system. Apply a written policy with the same criteria to every applicant, keep “unable to determine” available as an outcome, and obtain legal review before a document finding contributes to an adverse decision.