How to Tell If a PDF Has Been Edited: 7-Step Check (Australia)

You can often tell a PDF has been edited by checking five things: the file properties, the producing software, the number of saved revisions, the digital signature status and the text and font layer. None of them proves a payslip or bank statement is genuine. Each can show the file changed after the issuer produced it, and together they take a reviewer about ten minutes.

This guide is for the person who receives the file: a mortgage broker's assessor, a lender's credit analyst, a property manager reviewing a rental application, an HR officer onboarding a new starter. No forensic software is needed. Where a command-line tool helps, the free Adobe Acrobat Reader usually shows the same information.

What an edit check can and cannot prove

An edit check finds traces of modification; it cannot certify authenticity. The PDF format is defined in ISO 32000-2, and any application can rewrite a file, strip its metadata or flatten pages into images. A file with no traces means "no editing found", not "verified".

Three outcomes are realistic:

• Clear traces: a consumer editor named as the producer, a modification date later than the document's own date, or a broken signature. Escalate.
• Ambiguous traces: an incremental save or a re-exported file. Plenty of legitimate workflows do this. Ask the applicant for the original.
• No traces: a clean file from an expected producer. Move to third-party cross-checks, since a careful forger leaves nothing in the file itself.

Reviewers keep asking whether this is science or guesswork. Metadata and structure checks catch careless edits fast and miss careful ones, which is why step 7 compares content with sources the applicant does not control, such as ATO data or an ABN lookup.

Step 1: Read the file properties

Open the document properties and compare the creation date with the modification date. In Acrobat Reader press Ctrl+D (Cmd+D on Mac). From a terminal, pdfinfo file.pdf or exiftool -a -G1 file.pdf prints the same fields plus the XMP block.

New reviewers often fall into one trap. Metadata dates show when the file was produced, not the date printed on the document. Internet banking and payroll portals generally build the PDF when you click download, so a March payslip with a June creation date can be perfectly normal. Compare against another genuine document from the same issuer.

Step 2: Check the producing software

The Producer field should match how that issuer really generates documents. Banks, payroll providers and government portals use server-side engines. A "bank statement" whose producer is a consumer PDF editor, an online "edit PDF" website or a word processor is a strong signal.

Warning combinations:

• Producer is an online PDF editor, with an issuer that never uses one.
• Creator says Microsoft Word or Canva on a document claiming to be system-generated.
• Producer differs between the Info dictionary and the XMP block, which happens when a tool updates only one of them.
• Producer and Creator both empty. Privacy tools do this, and so does deliberate scrubbing.

The metadata tampering guide explains how these fields get forged and what scrubbing leaves behind.

Step 3: Count the revisions

A PDF saved incrementally keeps its earlier version inside the file, so the number of end-of-file markers hints at how many times it was saved. The format lets an application append changes after the original %%EOF instead of rewriting everything (ISO 32000-2, section 7.5.6).

On a terminal, grep -a -c '%%EOF' file.pdf returns the count. One marker is a single write. Two is normal for linearised files built for quick web viewing. Three or more means at least one incremental update, and a library such as qpdf or pdf.js can extract each earlier revision so you can read what the document said before.

Incremental updates are not proof of fraud: filled forms, countersigned lease agreements and annotated files all produce them. Ask whether the update makes sense. A lease with a tenant's initials added is fine; a payslip with three revisions is not something payroll software does.

Step 4: Validate every digital signature

A valid signature seals the file; a broken one proves it changed after signing. Open the signature panel in Acrobat Reader. A green check means unmodified since signing and a trusted certificate chain. "Document has been altered or corrupted since it was signed" is the clearest evidence of editing you will find.

In Australia, electronic signatures are given legal effect under the Electronic Transactions Act 1999 (Cth), available through legislation.gov.au, and its state and territory counterparts. The Act accepts a signature that identifies the signatory and is as reliable as appropriate; it does not itself guarantee that the file was left untouched. That job belongs to cryptographic signatures. A "signature validity unknown" message usually means your viewer lacks the issuer's certificate, not that the file is bad.

Most payslips and bank statements are never signed, so a missing signature says nothing.

Step 5: Test the text layer and the fonts

Select all text (Ctrl+A) and see what highlights. A system-generated PDF shows clean, aligned blocks. An edited one often shows a single changed figure in its own box, a pixel off the baseline, or text that will not select because it was pasted in as an image.

Then open the font list (Document Properties, Fonts tab, or pdffonts file.pdf):

• Two subsets of the same typeface (ABCDEF+Arial and GHIJKL+Arial) often mean part of the page was retyped with another tool.
• A font that appears only on the amount fields, such as gross pay, balance or rent, is the classic pattern.
• No text, only one large image, means the page was printed or screenshotted and re-wrapped, which removes the evidence this step relies on.

Paste the text into a plain editor too. Hidden text layers, white-on-white characters and text parked outside the page area show up there. See hidden text layers in PDF fraud and font forensics.

Step 6: Zoom in on the visuals

Zoom to 400% on logos, stamps, figures and table borders. Vector logos stay crisp; a logo that blurs while nearby text stays sharp was pasted as a raster image. Watch for mismatched anti-aliasing around numbers, uneven spacing in right-aligned amounts and a different grey in one table row.

For scans and phone photos, error level analysis adds a signal but produces false positives on heavily compressed images. Use it to prompt questions, not to decide.

Step 7: Cross-check against sources the applicant does not control

Compare numbers and identifiers with third-party data. This step still works when the file is clean, because a forger who scrubs metadata and matches fonts must still make the figures agree with everything else in the file.

Employer payroll data reaches the ATO through Single Touch Payroll, so the applicant's income statement in myGov is a strong independent anchor. Arithmetic is the cheapest test of all: re-add the statement lines and confirm opening balance plus credits minus debits equals the closing balance.

Reporting entities under the AML/CTF Act 2006 must verify a customer's identity from reliable and independent documents or electronic data, and the reforms made by the AML/CTF Amendment Act 2024 have been phasing in during 2026. AUSTRAC publishes the current rules and guidance, which is why reviewers cannot stop at "it looks fine".

Free tools or an automated check

Free tools are fine for the occasional file, but do not upload customer documents to a random website. Sending identity and financial records to an unknown "PDF checker" is a disclosure of personal information. Under the Privacy Act 1988, Australian Privacy Principle 8 makes the entity accountable for overseas disclosures and APP 11 requires reasonable steps to secure information; the OAIC publishes guidance on both. Prefer local tools (Acrobat Reader, pdfinfo, exiftool, qpdf) or a service provider bound by contract.

At volume, the manual route breaks down. Automated checks apply the same property, structure and consistency tests to every file and route only the odd ones to a person. CheckFile's AI-generation and tampering signals work as a complement to your existing controls, not a replacement for reviewer judgement. For completeness and cross-document checks, the KYC and banking solution describes what is compared (fields, dates, registers), and the pricing page lists plans.

When an edit is legitimate, and when to escalate

Not every changed PDF is fraud. Applicants merge pages, shrink files to meet an upload limit, redact an account number or fill in a form. Ask for the original and an explanation before assuming bad faith, and record what you were given.

Escalate when a trace combines with a mismatch: an unexpected producer plus a payslip figure that does not match the ATO income statement, or a broken signature on a document presented as the original. Obtaining a financial advantage by deception is an offence under section 134.2 of the Criminal Code Act 1995 (Cth), with a maximum of ten years' imprisonment, and each state and territory has its own forgery and fraud offences. A suspicious matter report to AUSTRAC is due within three business days of forming the suspicion, and your AML/CTF compliance officer decides that, not the front-line reviewer.

For the wider process around these checks, see the document verification guide.

Frequently Asked Questions

Can you tell if a PDF has been edited?

Often yes, but not always. Metadata, revision count, signatures and fonts reveal careless edits within minutes. A careful forger who prints to a new PDF or rebuilds the file leaves few traces, so the content must be cross-checked against ATO data, employer records or other files.

Does opening and saving a PDF change it?

Saving in most editors updates the modification date and the producer field, and may append a revision. Opening and viewing does not change the file. A modification date later than the creation date is a prompt to ask questions, not proof of fraud.

Is there a free online tool to check if a PDF was edited?

Several exist, but uploading customer documents to them is a privacy risk under the Privacy Act. Use local tools for metadata and structure, and an online service only under a written agreement or for test files with no personal information.

Can AI tell if a PDF has been edited?

Automated systems compare metadata, structure, fonts and image artefacts at scale and flag combinations a human would miss. They give signals rather than certainty, and the final decision should stay with a reviewer.

What if the PDF has no metadata at all?

Missing metadata is a flag, not a verdict. Privacy tools strip it, and so do print-to-PDF workflows. Ask for the original from the issuer's portal and compare it with a document that issuer is known to produce.