Not all fraud signals weigh the same. Math proves tampering. Metadata only suggests it.
Weight balance-chain errors highest. A broken running total means numbers changed. No innocent export causes that. One break outweighs three metadata quirks.
Weight payer and sequence anomalies next. Missing pages, date gaps, duplicate rows. These alter totals indirectly. They deserve half the weight of math.
Weight metadata lowest. Editor names, stripped fields, odd dates. Useful context. Weak alone, since banks re-export through odd software too.
A sound model: 60 math, 25 sequence, 15 metadata. Score 0-100. Route clean straight through. Review the middle. Reject math breaks fast.