How to tell if a PDF was edited — seven signs that actually work

I've examined a lot of tampered documents, and the pattern never changes: the visible page is flawless, and the file underneath is a confession. Editing a PDF cleanly — leaving no trace anywhere in the file structure — is far harder than people assume, because the format itself works against the editor. Here are the seven traces that matter, roughly in order of how damning they are.

1. The file still contains the earlier version

This one surprises everyone. Many PDF tools save changes using something called an incremental update: instead of rewriting the document, they append the changes to the end of the file and leave the original bytes untouched. The "before" document is still in there, complete and recoverable.

Which means that on a statement where someone changed 4,200 into 38,900, the file can carry both numbers — the new one on the visible page, the old one in the buried revision. This isn't an indicator or a probability. It's the previous document, intact, extracted from inside the file someone handed you. When I find this, the conversation is usually over.

2. The software trail doesn't add up

PDFs record which software created them (the Creator and Producer fields). A bank statement is generated by the bank's rendering system and says so. An invoice from accounting software carries that software's name. When a document like that also shows traces of a desktop PDF editor — or when the producer string has been stripped entirely, which is its own kind of tell — someone opened it and saved it after it was issued.

Is that proof of fraud? No. Files get merged, stamped, re-saved for innocent reasons. But it's a documented fact about the file, and it's worth exactly one question to whoever sent it: "Why does your bank statement show it was saved by a PDF editor?" Watch how they answer.

3. The dates argue with each other

Every PDF carries a creation date and a modification date, usually with timezone offsets. Three things to look for:

• Modification after creation. Normal for working documents; strange for a "final" issued statement or certificate.
• Timezone jumps. A document supposedly produced in one office, whose timestamps hop between UTC+1 and UTC+6, has a travel history someone should explain.
• Impossible dates. A file whose metadata says 2015 but whose internals could only have been produced by software released years later. (Fonts are the sharpest version of this — a font release date once decided a Supreme Court case.)

4. A font that doesn't belong

When someone edits text in a PDF, their editor almost never has the exact font the original system used. So it substitutes — a clone, a newer version, a near-identical lookalike. The result: a document that visually looks uniform but contains two different fonts wearing the same name, with the edited text set in the impostor.

You can sometimes spot this with free tools (pdffonts lists embedded fonts — look for the same family appearing twice with different subset prefixes, the ABCDEF+ part). Proving it properly requires comparing glyph outlines against authentic references, which is exactly what a proper checker automates.

5. The typography stumbles in one place

Machines typeset with boring, perfect consistency. Human edits break rhythm. A number sitting half a point off the baseline. Letter-spacing on one value that's subtly tighter than every other value in the column. A digit whose weight is fractionally wrong. Individually, each is small; when several of these anomalies concentrate on the one number that matters — the salary, the balance, the date — the odds of innocence collapse. Correlation is the tell: benign quirks scatter randomly, tampering clusters.

6. Something is covering something

A lazy but common trick: draw an opaque white rectangle over the inconvenient text and type the new text on top. The page looks right, prints right — and the original text is still in the file, still live, still extractable underneath the patch. The same goes for image patches pasted over text regions. Any structural analysis of the page will find content whose only purpose is to hide other content, and can usually read what's hidden.

7. The arithmetic is wrong

Not a file-format check at all, but I'd be negligent to leave it out because it catches so many amateur jobs: re-do the math. Fraudsters change one number and forget it participates in sums. Running balances that don't run. Line items that don't add to the total. VAT that's suddenly the wrong percentage of the subtotal. Thirty seconds with a calculator has ended a lot of frauds that would have survived a glance.

What a clean result does not mean

Honesty requires this section. A document that passes every check above is not certified genuine — and anyone who promises otherwise is overselling:

• Scans have no digital history. A photographed or scanned forgery carries none of the traces above. Digital forensics reads digital documents.
• A perfect fabrication is possible. A document generated from scratch by a careful forger, never edited afterwards, contains no editing traces — because there was no edit.
• Absence of evidence is only that. The correct conclusion from a clean report is "no modification indicators found", never "authentic".

For anything that matters — a lease application, a court exhibit, a large invoice — the final step is always the same: verify with the issuer. Forensics tells you which documents deserve that phone call.