What Your Excel File Knows About You

A few years ago, one of us invested in a private merchant lending operation. As part of the diligence, the deal team received a loan tape — borrower data, loan amounts, payment histories, performance metrics. It looked clean. The numbers tied out. The formulas worked.

Months later, we discovered the entire file had been generated by AI. Not the analysis — the data itself. Fabricated borrower records, synthetic payment patterns, all of it produced by a language model and dropped into Excel. We missed it because we did what everyone does with a spreadsheet: opened it, looked at the numbers, and moved on.

That experience broke something in the way we think about Excel files. We started asking a question we could not stop asking: what else is in there that nobody is seeing?

The answer, it turns out, is a lot.

Every Excel file carries a structural layer beneath the visible grid — artifacts that record how the file was created, what tools built it, in what sequence the data was entered, and whether anything was moved, hidden, or altered after the fact. None of this is visible when you open the file normally. But it is there, embedded in the file format itself, and it does not lie.

We built a forensic methodology to read that layer. Here is what a typical trace looks like when we examine a workbook that was represented as an analyst-built financial model:

Six structural findings. None of them visible on the spreadsheet. Every one of them documented, traceable, and verifiable.

The file origin trace tells us what software actually created the workbook — and it was not Excel. The timestamp trace tells us when, and that there is no revision history suggesting iterative work. The formula entry sequence tells us that data in rows 14 through 22 was entered before the data in rows 1 through 13 — which makes no sense for a model built top-down by a human, but is exactly what you would expect from programmatic generation or data manipulation. The style trace tells us every cell was formatted in a single pass, not gradually as a person works. And the hidden sheet contains hundreds of formula references feeding the visible output — invisible to anyone who simply opens the file and reviews what is on screen.

Each of these is a piece of structural evidence. Individually, any one of them might have an explanation. Together, they tell a story that the spreadsheet on screen was never designed to reveal.

This is not theoretical. In 2023, researchers at the blog Data Colada used Excel's internal calculation chain — a structural record embedded in the file's XML that tracks the order in which formulas were entered — to show that rows in a published dataset had been relocated from one experimental condition to another. The visible spreadsheet looked properly sorted. The structural trace showed it had been tampered with. Harvard Business School subsequently placed the professor on administrative leave, conducted a 1,200-page internal investigation that corroborated the findings, and in May 2025 revoked her tenure — the university's first such revocation in roughly eighty years. Four papers have been retracted, and related litigation between the professor and the university is ongoing.

The forensic principle is the same whether the file is a research dataset, a loan tape, or a financial model: a spreadsheet records how it was built, not just what it contains. The structural layer is a forensic record. And in most financial workflows — diligence, audit, model review, litigation discovery — nobody reads it.

That gap is getting more dangerous.

A Celent report published in May 2026, based on a survey of 115 U.S. financial institutions, found that 82% of lenders reported higher fraud losses compared to the prior year. More than one-third experienced double-digit increases. Generative AI can produce loan tapes, amortization schedules, and portfolio summaries that are internally consistent and pass surface-level review. Sixty-one percent of lenders identified synthetic identity fraud as the fastest-growing fraud type.

In the Tricolor case, manipulated auto loan receivables — including alleged double-pledging of collateral and falsified delinquency data — contributed to an $800 million gap between reported and real collateral. JPMorgan Chase charged off $170 million in the third quarter of 2025. Fifth Third Bank recorded a $170 to $200 million impairment. Barclays posted a $150 million loss. The spreadsheets that carried the data were treated as trustworthy — because the numbers added up.