How to Tell If a PDF Has Been Edited: 7-Step Check (Canada)

You can often tell a PDF has been edited by checking five things: the file properties, the producing software, the number of saved revisions, the digital signature status and the text and font layer. None of them proves a pay stub, T4 or bank statement is genuine. Each can show that the file changed after the issuer produced it, and together they take a reviewer about ten minutes.

This guide is written for the person who receives the file: a mortgage underwriter, a credit union analyst, a landlord or property manager, an HR coordinator. It assumes no forensic software. Where a command-line tool helps, the free Adobe Acrobat Reader usually shows the same information.

What an edit check can and cannot prove

An edit check finds traces of modification; it cannot certify authenticity. The PDF format is defined in ISO 32000-2, and any application can rewrite a file, strip its metadata or flatten pages into images. A file with no traces means "no editing found", not "verified".

Three outcomes are realistic:

• Clear traces: a consumer editor named as producer, a modification date later than the document's own date, or a broken signature. Escalate.
• Ambiguous traces: an incremental save or a re-exported file. Many legitimate workflows do this. Ask the applicant for the original.
• No traces: a clean file from an expected producer. Move to third-party cross-checks, since a careful forger leaves nothing inside the file.

Reviewers often ask whether this is real forensics or a hunch. Metadata and structure checks catch careless edits quickly and miss careful ones, which is why step 7 compares content with sources the applicant does not control, such as a CRA Notice of Assessment or an employer's confirmation.

Step 1: Read the file properties

Open the document properties and compare the creation date with the modification date. In Acrobat Reader press Ctrl+D (Cmd+D on Mac). From a terminal, pdfinfo file.pdf or exiftool -a -G1 file.pdf prints the same fields plus the XMP block.

New reviewers fall into one trap. Metadata dates show when the file was produced, not the date printed on the document. Online banking and payroll portals usually generate the PDF at the moment you click download, so a March pay stub with a June creation date can be perfectly normal. Compare against another genuine document from the same issuer.

Step 2: Check the producing software

The Producer field should match how that issuer really generates documents. Banks, payroll providers and government portals use server-side engines. A "bank statement" whose producer is a consumer PDF editor, an online "edit PDF" website or a word processor is a strong signal.

Warning combinations:

• Producer is an online PDF editor, with an issuer that never uses one.
• Creator says Microsoft Word or Canva on a document claiming to be system-generated.
• Producer differs between the Info dictionary and the XMP block, which happens when a tool updates only one of them.
• Producer and Creator both empty. Privacy tools do this, and so does deliberate scrubbing.

The metadata tampering guide explains how these fields get forged and what scrubbing leaves behind.

Step 3: Count the revisions

A PDF saved incrementally keeps its earlier version inside the file, so the number of end-of-file markers hints at how many times it was saved. The format allows an application to append changes after the original %%EOF rather than rewrite everything (ISO 32000-2, section 7.5.6).

On a terminal, grep -a -c '%%EOF' file.pdf returns the count. One marker is a single write. Two is normal for linearized files built for fast web viewing. Three or more means at least one incremental update, and a library such as qpdf or pdf.js can extract each earlier revision so you can read what the document said before.

Incremental updates are not proof of fraud: filled forms, countersigned offers to lease and annotated files all produce them. Ask whether the update makes sense. A lease with a tenant's initials added is fine; a pay stub with three revisions is not something payroll software does.

Step 4: Validate every digital signature

A valid signature seals the file; a broken one proves it changed after signing. Open the signature panel in Acrobat Reader. A green check means unmodified since signing and a trusted certificate chain. "Document has been altered or corrupted since it was signed" is the clearest evidence of editing you will find.

In Canada, electronic signatures are recognized under PIPEDA Part 2 and provincial electronic commerce statutes, and the Secure Electronic Signature Regulations define when a signature carries the strongest presumption of integrity. A message of "signature validity unknown" usually means your viewer lacks the issuer's certificate, not that the file is bad.

Most pay stubs, T4 slips and bank statements are never signed, so a missing signature says nothing.

Step 5: Test the text layer and the fonts

Select all text (Ctrl+A) and see what highlights. A system-generated PDF shows clean, aligned blocks. An edited one often shows a single changed figure in its own box, sitting a pixel off the baseline, or text that will not select because it was pasted as an image.

Then open the font list (Document Properties, Fonts tab, or pdffonts file.pdf):

• Two subsets of the same typeface (ABCDEF+Arial and GHIJKL+Arial) often mean part of the page was retyped with another tool.
• A font that appears only on the amount fields, such as gross pay, balance or rent, is the classic pattern.
• No text, only one large image, means the page was printed or screenshotted and re-wrapped, which removes the evidence this step relies on.

Paste the text into a plain editor too. Hidden text layers, white-on-white characters and text parked outside the page area show up there. See hidden text layers in PDF fraud and font forensics.

Step 6: Zoom in on the visuals

Zoom to 400% on logos, stamps, figures and table borders. Vector logos stay crisp; a logo that blurs while nearby text stays sharp was pasted as a raster image. Watch for mismatched anti-aliasing around numbers, uneven spacing in right-aligned amounts and a different grey in one table row.

For scans and phone photos, error level analysis adds a signal but produces false positives on heavily compressed images. Use it to prompt questions, not to rule.

Step 7: Cross-check against sources the applicant does not control

Compare numbers and identifiers with third-party data. This step still works when the file is clean, because a forger who scrubs metadata and matches fonts must still make the figures agree with everything else in the file.

Total income appears on line 15000 of a Notice of Assessment, and an applicant can retrieve the real one from CRA My Account. Arithmetic is the cheapest test: re-add the statement lines and confirm opening balance plus credits minus debits equals the closing balance.

Reporting entities under the PCMLTFA must verify identity using one of the methods in FINTRAC guidance, including the government-issued photo identification method and the credit file method. FINTRAC publishes the current methods and the record-keeping expectations that follow, which is why reviewers cannot stop at "it looks fine".

Free tools or an automated check

Free tools are fine for the occasional file, but do not upload customer documents to a random website. Sending identity and financial records to an unknown "PDF checker" is a disclosure of personal information. Under PIPEDA the organization remains accountable for information transferred to a third party, and the Office of the Privacy Commissioner of Canada expects comparable protection through contract. Where Quebec residents are involved, Law 25 adds transparency and impact-assessment duties for transfers outside Quebec. Prefer local tools (Acrobat Reader, pdfinfo, exiftool, qpdf) or a service provider bound by contract.

At volume, the manual route breaks down. Automated checks apply the same property, structure and consistency tests to every file and route only the odd ones to a person. CheckFile's AI-generation and tampering signals work as a complement to your existing controls, not a replacement for reviewer judgment. For completeness and cross-document checks, the KYC and banking solution describes what is compared (fields, dates, registers), and the pricing page lists plans.

When an edit is legitimate, and when to escalate

Not every changed PDF is fraud. Applicants merge pages, shrink files to meet an upload limit, redact an account number or fill in a form. Ask for the original and an explanation before assuming bad faith, and record what you were given.

Escalate when a trace combines with a mismatch: an unexpected producer plus a T4 figure that does not match the Notice of Assessment, or a broken signature on a document presented as the original. Forgery is an indictable offence under section 366 of the Criminal Code, and knowingly using a forged document is covered by section 368, each carrying a maximum of ten years. Whether a transaction is reported to FINTRAC as suspicious is decided by your compliance officer, not the front-line reviewer.

For the wider process around these checks, see the document verification guide.

Frequently Asked Questions

Can you tell if a PDF has been edited?

Often yes, but not always. Metadata, revision count, signatures and fonts reveal careless edits within minutes. A careful forger who prints to a new PDF or rebuilds the file leaves few traces, so the content must be cross-checked against CRA documents, employer records or other files.

Does opening and saving a PDF change it?

Saving in most editors updates the modification date and the producer field, and may append a revision. Opening and viewing does not change the file. A modification date later than the creation date is a prompt to ask questions, not proof of fraud.

Is there a free online tool to check if a PDF was edited?

Several exist, but uploading customer documents to them is a privacy risk under PIPEDA and provincial law. Use local tools for metadata and structure, and an online service only under a written agreement or for test files with no personal information.

Can AI tell if a PDF has been edited?

Automated systems compare metadata, structure, fonts and image artifacts at scale and flag combinations a human would miss. They give signals rather than certainty, and the final decision should stay with a reviewer.

What if the PDF has no metadata at all?

Missing metadata is a flag, not a verdict. Privacy tools strip it, and so do print-to-PDF workflows. Ask for the original from the issuer's portal and compare it with a document that issuer is known to produce.