The present disclosure involves systems, software, and computer implemented methods for transaction auditing. One example method includes determining valid pixel-based pattern(s) that are included in valid reference images. Fraudulent pixel-based pattern(s) that are included in fraudulent reference images are determined. A request to classify an image is received. A determination is made as to whether pixel values in the image match a valid pixel-based pattern or a fraudulent pixel-based pattern. In response to determining that the pixel values match a valid pixel-based pattern, a likelihood of classifying the first image as a valid image is increased. In response to determining that the pixel values match a fraudulent pixel-based pattern, a likelihood that the image as a fraudulent image is increased. The image is classified in response to the request as either a valid image or a fraudulent image based on the likelihoods.