The problem is not hacking. It is trust in an ordinary file
Most document fraud does not announce itself. An invoice arrives where it is expected, from an address that looks right, with numbers that seem plausible. Someone opens it, approves it, and pays. Nothing looks wrong until the money is gone.
Industry research keeps returning to the same pattern: a large share of companies report fake-invoice attempts, and finance teams routinely face payment fraud that rides on ordinary email and PDF habits. The mechanics are usually simple — a forged invoice, a “quick update” to vendor bank details, or a duplicate payment that slips through because two systems do not reconcile the same file.
What makes this hard to stop is not sophistication. The fraud uses the same thread, the same approval routine, and the same PDF attachment everyone already trusts by habit.
Why this matters more in our region
Fraud risk is not evenly distributed. While some mature markets have seen pressure ease, attempted document and payment fraud has remained acute across parts of the Middle East, Africa, and Asia-Pacific — often because a plain PDF still has no built-in way to prove it has not been altered after it left the sender.
At the same time, governments are moving the other way on regulation. Jordan’s JoFotara e-invoicing requirements, Saudi Arabia’s FATOORA / ZATCA phases, and Egypt’s national e-invoicing rollout all push toward structured, verifiable documents for tax compliance. That is important market context — and it is not the same product as Opcilo. Opcilo does not clear government e-invoices. It seals the commercial file you already send so recipients can check integrity without a portal login.
For many SMEs — a contractor sending an invoice, an agency sending a signed contract, a school issuing a certificate — regulatory e-invoicing infrastructure is not built around their everyday WhatsApp-and-email workflows. They are still attaching a plain PDF and hoping nobody edits it in transit.
Two kinds of document fraud — and different defenses
It helps to separate two problems that often get conflated:
- File substitution — someone alters a document after it was issued and passes the altered copy off as the original (a changed bank account on an invoice, a modified figure on a contract).
- Legitimate-pipeline abuse — someone with access to a real sending identity pushes a fraudulent document that looks “official” because it comes from a familiar account.
Integrity sealing is strongest against file substitution. Reducing legitimate-pipeline abuse needs more than a hash: Issuer Verified after business verification (Know Your Business, or KYB) versus email-verified accountability, Identity Not checked honesty, malware scanning on the upload path, engagement trails on higher plans, and a way for recipients to report a seal that still feels wrong.
How Opcilo helps — without overselling
Against file substitution
Every document sealed on Opcilo receives a SHA-256 cryptographic fingerprint of the exact bytes at sealing time. Change a character, a digit, or a line — the fingerprint no longer matches. Anyone with the verification link can check that result without creating an account. For the core loop, see What is document sealing? and try Verify.
X7F-G2K-9PX
Issuer: Northwind Labs
Sealed: 17 Sep 2026
A live verification card: status, issuer, and seal date — without creating an account.
Against legitimate-pipeline abuse
Sealed documents show issuer accountability on the verification page — email-verified status for many accounts, and Issuer Verified only after business verification (Know Your Business, or KYB). Identity is Not checked. Those cues help recipients see who sealed the file; they are not a guarantee that every claim inside the document is true.
Uploads are scanned for malware as part of the sealing path so infected files are not treated as a normal sealed document. On Pro and above, sealed documents can also carry an engagement trail — when a link was sent, opened, viewed, and downloaded — which helps separate “who sealed it” from “what happened after.” Recipients can report a seal that looks wrong even when the cryptographic check still passes.
What this means in practice
- A contractor seals an invoice before sending it — the client can confirm the sealed file was not altered before paying, without logging in.
- A landlord seals a lease — a tenant or bank can confirm the version they hold matches the sealed original.
- An agency seals a signed contract — either party can later prove exactly which bytes were sealed.
None of this requires the recipient to install software or create an account. The seal is the integrity proof — not a promise that every business claim in the file is true.
Frequently asked questions
Does sealing stop fake invoices completely?
No. Sealing removes the easy swap-after-send attack and gives recipients an independent integrity check. It does not stop every social-engineering or compromised-account scenario.
Is Opcilo a JoFotara, FATOORA, or Egypt e-invoicing platform?
No. Those are government tax e-invoicing programs. Opcilo seals commercial documents for integrity verification. Use the mandated clearance channels where the law requires them.
Do recipients need an account to check a seal?
No. Open the verification link on Verify — seal status and document details are available without signing in.
Where can I read what Opcilo does and does not claim on security?
See the Security page and What is document sealing?.
Someone sent malware with a familiar filename and a real-looking Opcilo code. Am I safe?
A code points to Opcilo’s sealed copy, not the email attachment — use Verify and “check my copy,” or download only from that page. See Same filename, real-looking code.