A heuristic engine includes capabilities to collect an unstructured data set, including document image data and correlate the image data with known valid data to detect document fraud. Notifications of fraud detection may include particular signature images, or characteristics of a document image. By feeding back indications of document fraud with correlations to past instances of fraud into the heuristic algorithm, the algorithm may learn and improve in fraud detection accuracy.