This article presents a simple non-destructive method to test if strokes or pieces of text written with ballpoint pens of the same or different manufacturers were added to a document at a later stage. This work was motivated by a real-world fraud case, in which a student was under suspicion of having altered the content of an exam paper. The proposed method was able to detect the fraud in the original exam paper. The fraud identification procedure presented may be used in other kinds of documents such as forms or bank checks.