Review
How to check if a PDF was edited after it was made
A bank statement for a lease, an invoice, a payslip, a contract that comes back signed. You can learn a lot about a PDF’s history without special software, if you know where to look and what the signs really mean.
Check whether the file was saved more than once, whether a signature reports changes after signing, whether the creating program and dates make sense, whether figures use a different font from their neighbours, and whether text is hidden under boxes or other text. None of these proves fraud on its own, and a clean result doesn’t prove a file is original. The most reliable check is still comparing with the source, such as the bank’s own portal.
1. Count the saved versions
Many PDF editors add changes to the end of the file instead of rewriting it. Each addition ends with the marker %%EOF. On a Mac you can count them in Terminal:
grep -c "%%EOF" statement.pdf
One marker means a single version. Two can be normal (some files are “linearized” for fast web viewing and carry two). More than that means the file was saved on top of itself several times. That’s fine for a form you filled in, and suspicious for a statement that a bank produced once.
What it doesn’t prove: a file can be edited and rewritten from scratch, which leaves a single version. One version means “no history in the file”, not “never touched”.
2. Look at the signature, if there is one
Statements, certificates and invoices from larger organizations are often digitally signed. Open the signature panel in a validator such as Adobe Acrobat Reader. “Document has been modified since this signature was applied” is the strongest sign you can get, because it’s cryptographic. If the validator lists changes after signing, read them: a filled form field is normal, a changed page isn’t.
3. Read the properties
In Preview choose Tools › Show Inspector; in Acrobat, File › Properties. Look at:
- Creator and Producer: the programs that made the file. A bank statement “produced” by a consumer PDF editor or a word processor deserves a second look.
- Created and modified dates: modified long after created, or modified before created, is odd.
What it doesn’t prove: these fields are easy to edit, and some legitimate workflows pass a file through several programs.
4. Check the fonts of the numbers
When someone changes a figure, the editor often can’t reuse the original font, especially if the file only contains the digits it used. The new number ends up in a similar-looking font. In Acrobat, File › Properties › Fonts lists every font; an extra font with only a handful of characters is a hint. Zoom in on the amounts and compare the shape of digits like 1, 4 and 7 with the same digits elsewhere in the column.
5. Look for text under text or under boxes
A quick way to edit a PDF is to paint a white rectangle over a number and type a new one on top. The old number is still in the file:
- Select all the text on the page and paste it into a plain text editor. A total that appears twice, or a number you can’t see on screen, is a red flag.
- Search for the visible figure and for other plausible values.
- Drag-select around the suspicious area; sometimes the hidden text highlights.
6. Look for what’s hidden
Layers that are switched off, white text on white, text placed outside the page, or invisible text that isn’t part of a scan’s OCR layer. Acrobat’s Layers panel shows optional content. Copying all text, as above, also reveals white or invisible text.
7. Compare with the source
For documents that matter, the honest best check is outside the file: download the statement yourself from the bank’s portal, ask the company to confirm the invoice, or compare the returned contract with the version you sent, word by word.
What these checks can and can’t tell you
Every sign above has innocent explanations, and a skilled forger can avoid most of them. Treat them as reasons to ask questions, not as verdicts. The reverse is also true: a file with one version, consistent fonts and normal metadata may still have been recreated from scratch.
Keepsign’s What changed? does all seven file checks at once, on your iPhone, iPad or Mac. It lists every save with its program and date, shows text changes after a signature word by word (“30” → “14”), and points to figures in a different font from their column, text covered by boxes or by other text, hidden layers, invisible text and dates that don’t add up, each with a button to the spot on the page. It never says “fake”; it shows the evidence and its limits. More about What changed?
Sources
- ISO 32000-1:2008, section 7.5.6, Incremental updates; section 7.5.5, File trailer and
%%EOF; Annex F, Linearized PDF (public copy at opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandards/PDF32000_2008.pdf). - ISO 32000-1:2008, section 12.8, Digital signatures, and section 8.11, Optional content (layers).
- Apple, Preview User Guide for Mac, support.apple.com/guide/preview.