The font that caught a prime minister's daughter

In July 2017, Pakistan's Supreme Court was picking through the fallout of the Panama Papers. Among the documents submitted in defence of the prime minister's family was a trust declaration, signed by his daughter, dated February 2006. It was supposed to prove that certain London properties had been held in trust all along — that nothing had been hidden.

The document was typed in Calibri.

If you don't spend your days thinking about fonts, that means nothing. If you do, it's a fire alarm. Calibri was designed by Lucas de Groot for Microsoft in the early 2000s, but it wasn't released to the public until it shipped with Office 2007 and Windows Vista — at the end of January 2007. Before that it existed only inside Microsoft and in beta builds that almost nobody outside the software world ever touched.

So the defence was left arguing, in front of a Supreme Court, that a family trust declaration had been typed in 2006 using a pre-release beta font. The investigators' report called the document what the evidence suggested it was. Pakistani Twitter called it Fontgate. Wikipedia's Calibri page got so much traffic that editors temporarily locked it. And the prime minister was disqualified from office later that year.

One font. That's all it took.

Why fonts make such good witnesses

Here's the thing that made the Calibri evidence so devastating, and it applies to every document you'll ever be handed: a font is software, and software has release dates.

You can fake a signature. You can type any date you like at the top of a page. But you cannot type a 2006 document in a font that reached the public in 2007, any more than you can take a 2006 photograph with a phone that launched in 2019. It isn't a matter of judgment or probability. It's an anachronism — physically impossible, and provable from the file itself.

And it goes deeper than font names. Fonts have versions. The Arial on a Windows XP machine is not the same file as the Arial on Windows 11 — glyphs get redrawn, characters get added, metrics get nudged. Each version has its own release window. A PDF embeds the actual font data, so the file quietly records exactly which version of which font touched it. If a document claims to be from 2011 but carries a font version first published in 2019, the date on the page is a lie. There is no innocent explanation. I've yet to hear anyone attempt one.

A signature can be argued about. A font version either existed on the claimed date or it didn't.

The trick nobody expects: same name, different font

There's a subtler version of this that catches modern forgeries, and it's the one I find most often in the wild.

When someone edits a real PDF — changes a number on a bank statement, say — their editing software needs to render the new text. It looks for the original font, doesn't have it, and silently substitutes the closest thing it can find: a clone, a different version, a lookalike with the same family name. The edited document now contains two fonts wearing the same name tag. To the eye they're nearly identical. Byte by byte, glyph by glyph, they are strangers.

This is why serious document verification doesn't trust font names at all. A name is just a string in the file's metadata; anyone can write "Arial" there. What can't be faked is the shape data — the mathematical outlines of every letter. Fingerprint those outlines, compare them against known authentic releases, and the impostor stands out immediately, even when the name, the size, and the general look all match.

How to check this on a document you've been handed

You need to answer three questions about every font in the file:

1. What is actually embedded? Not what the file claims — what the font binary really is. Tools like pdffonts (free, part of Poppler) will at least list the fonts and whether they're embedded.
2. Does the version predate the document's date? This needs a database of font release dates, which is the hard part — that information is scattered across decades of vendor changelogs and OS releases.
3. Do the glyph outlines match a known authentic release, or just the name? This is beyond manual inspection entirely; it needs fingerprint comparison against reference copies.

The first check takes five minutes. The second and third are why I built the tool this site hosts: it fingerprints every embedded font glyph-by-glyph, compares the outlines against 70,000+ reference fonts, and checks the version against a corpus of 21,000+ dated releases. When something is impossible — a font newer than the document's claimed date — it says so and shows the dates side by side, so the evidence stands on its own.

What Fontgate should teach the rest of us

The remarkable thing about the Calibri affair isn't that a forgery was caught. It's who got caught. This was a document prepared with serious money and serious lawyers on the line, submitted to the most scrutinised court proceeding in the country's history — and the person who prepared it still didn't think about the font. Nobody ever does. Forgers obsess over signatures, letterheads, stamps and dates, because those are the things humans check.

Typography is invisible precisely because it works. And that invisibility cuts both ways: forgers forget it exists, which means, for anyone verifying documents, it's the closest thing you get to a hidden camera in the room where the file was made.

If you take one habit away from this story, make it this: when a document matters — a contract in a dispute, a statement supporting a loan, anything with money or law attached — check the fonts before you check anything else. It's the test the other side didn't prepare for.