Online PDF Editor Traces: What an Edited File Reveals

An online PDF editor almost always rewrites the whole file instead of patching it, and that rewrite leaves traces: a changed producer string, a new modification date, a regenerated file ID, re-embedded fonts and, if the original was signed, a broken or missing signature. None of these proves fraud. Together they show that a web tool processed the document after the issuer created it, which is what a mortgage underwriter, compliance officer or property manager needs to know before relying on it.

This guide is for the person who receives the file: an AML analyst at a reporting entity, a lender's adjudicator, a rental screening agent, an HR coordinator. It covers what web-based editors typically change, where to see it, and why a clean file proves nothing.

Why web editors leave different traces from desktop software

Browser-based editors usually regenerate the document on a server, so the output is a new file, not a modified copy. The PDF format, specified in ISO 32000-2, allows two ways to change a file: append an incremental update after the original end-of-file marker, or write a complete new file. Desktop tools often append; many web services rebuild, merge, compress and re-save in one pass.

Counting %%EOF markers to find revisions works on incrementally saved files and fails on files that went through a web service. A single revision does not mean "untouched".

The seven traces to look for

The most reliable traces sit in the producer fields, the file identifier, the font list, the object structure and the signature state. Check them in this order.

1. The Producer and Creator fields

Producer records the software that wrote the final file; Creator records the application that made the source. A bank statement downloaded from an online banking portal normally names the bank's statement engine. If it names a general-purpose web editor or an unrelated PDF library, it passed through a second tool. Run exiftool -a -G1 file.pdf or open Document Properties (Ctrl+D in Acrobat Reader).

Build your own reference set. Take one genuine document from each issuer you see often, such as a payroll provider, a Canadian bank or a utility, record its producer string and compare incoming files. Do not rely on a published list of "bad" strings: services swap libraries, and the PDF Association notes that the Producer key is deprecated in ISO 32000-2 and that metadata is optional and easily edited (PDF Association presentation on PDF forensics and metadata).

2. Creation and modification dates

A modification date hours or days after creation means a re-save. A modification date later than the date printed on the document, such as a pay stub for a September pay period modified in October, deserves a question. Equal timestamps are common in single-pass exports and are not reassuring alone.

3. The file identifier and XMP IDs

A PDF trailer can carry an /ID array of two strings: the first is set at creation, the second changes on save. XMP metadata adds DocumentID and InstanceID. When a rewrite regenerates both, the link to the issuer's original is gone, and you can compare only against a known-good copy.

4. Fonts and text objects

Edited text often uses a different font subset from the text around it. Embedded subsets carry a six-letter prefix, for example ABCDEF+Arial. A page that mixes two subsets of one typeface, or an amount in a fallback font, is a classic sign that a value was replaced. Select the suspicious number in a viewer: edited text often sits in its own block with different spacing.

5. Overlays, white boxes and flattened annotations

Some web tools never touch the underlying text. They draw a white rectangle over the old value and place new text on top, or flatten annotations into the page. Copy all text into a plain text editor: hidden original values, text outside the page area and duplicated figures show up. See hidden text layers in PDF fraud and font forensics.

6. Digital signature state

A PDF signed by the issuer carries a cryptographic signature over a defined byte range. Any change breaks validation, and a full rewrite by a web editor commonly removes the signature field. A document presented as the signed original with no signature, or a broken one, calls for the original from the issuer.

7. Compression, resolution and watermarks

Free tiers of some services stamp a watermark or footer, and compression lowers image resolution or changes the colour space. A logo that is crisp in a genuine copy and soft in the received file shows a re-encode. This is supporting evidence only: applicants also compress files to meet upload limits on lender portals.

What these traces cannot tell you

Traces show a file was processed, not why, and they can be removed. Metadata can be rewritten with free tools, and a TrueScreen guide describes online tools that let a user overwrite the producer, title and dates directly (TrueScreen on editing PDF metadata). Printing to PDF or rasterizing a page and re-wrapping it removes most structural clues. Researchers identify the producing tool from internal coding style because metadata is unreliable (Robust PDF Files Forensics Using Coding Style).

Three outcomes are realistic:

• Clear traces: an unexpected producer plus a changed identifier and a mismatched font. Request the original from the issuer.
• Ambiguous traces: a rewritten but otherwise clean file. Many honest applicants merge, compress or rotate pages. Ask why.
• No traces: continue with cross-document checks, because a careful forger leaves nothing in the file.

What reviewers actually ask

Compliance and lending forums keep returning to the same questions. Two come up most.

"My client says they only compressed the PDF. Is that believable?"

It can be. Compression or merging changes the producer, the identifier and often the revision count, but should not change fonts inside the text, move figures or alter values. If the only differences are producer, dates and image quality, and the figures reconcile with other documents, treat it as a benign re-save and note it in the file.

"Can I run a client's document through a free online checker?"

Not without thought. The file contains personal information, and disclosing it to a third party needs appropriate consent and safeguards. Under PIPEDA, an organization remains responsible for personal information it transfers to a service provider for processing and must use contractual or other means to give comparable protection. The Office of the Privacy Commissioner of Canada publishes guidance on outsourcing. In Quebec, Law 25 adds duties, including privacy impact assessments for certain transfers outside the province. Use local tools for metadata, and an external service only under a written agreement.

A short procedure you can adopt

1. Record the producer, creator, dates and identifier of every incoming PDF in the case file.
2. Compare them with a genuine reference from the same issuer.
3. Select and copy the key figures (name, amount, date, account number) and check font and text-block consistency.
4. Confirm signature status where the issuer normally signs.
5. Reconcile figures against other documents: a pay stub against a bank statement, a statement against a CRA notice of assessment.
6. Escalate mismatches to your compliance officer.

The cross-document step matters most. The document verification guide covers how the checks fit together, how to tell if a PDF has been edited goes deeper on revision structure, and PDF metadata tampering explains how scrubbing itself leaves a signature.

Legal and regulatory context in Canada

Using a forged document is a criminal offence in Canada, and reporting entities must be able to show how they verified the identity and documents they relied on. Section 366 of the Criminal Code defines forgery, including making a false document knowing it to be false with intent that it be used as genuine, and section 368 covers uttering a forged document. Both are indictable offences carrying up to 10 years' imprisonment.

For financial entities, securities dealers, money services businesses and other reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, FINTRAC sets the identity verification methods, including government-issued photo identification, credit file and dual-process approaches. Where a reporting entity has reasonable grounds to suspect that a transaction or attempted transaction is related to a money laundering or terrorist financing offence, it must submit a suspicious transaction report to FINTRAC. An altered document is one fact among others in that assessment, not a trigger by itself. OSFI expects federally regulated institutions to maintain sound controls over such processes.

A file accepted despite unexplained edit traces is hard to defend in an examination; one where the reviewer recorded the traces, requested the original and documented the outcome is not. The front-line reviewer does not decide whether to report. The compliance officer does.

Doing this at volume

Manual inspection takes minutes per file and depends on who is looking. Automated checks apply the same property, structure and consistency tests to every upload and route only unusual files to a person. CheckFile's AI-generation and tampering signals are a complement to your existing controls, not a replacement for reviewer judgement. For file completeness and cross-document comparison of fields and dates, see the KYC and banking solution, the security page for file handling, and the pricing page.

Frequently Asked Questions

Do online PDF editors leave traces?

Yes. Most change the producer or creator field, update the modification date, regenerate the file identifier and rewrite the object structure. Some also re-embed fonts or remove digital signatures. The traces can be stripped afterward, so their absence is not proof of an unedited file.

Can you tell which online editor was used?

Sometimes. The producer string often names the service or its library, and coding style can hint at the tool. It is a lead, not a certainty, because values can be overwritten and services change their software.

Does a single revision mean the PDF was not edited?

No. Many web editors rewrite the whole file, which resets the revision count to one. A single revision with an unexpected producer and a new identifier is more informative than the count.

Is a PDF with no metadata suspicious?

It is a flag, not a verdict. Privacy tools, print-to-PDF workflows and some portals strip metadata. Ask for the original from the issuer and compare with a known genuine document.

Does an edited document trigger a FINTRAC report?

Not by itself. A suspicious transaction report depends on reasonable grounds to suspect a link to money laundering or terrorist financing. Record the traces and escalate to your compliance officer, who makes that assessment.