How to Tell If a PDF Has Been Edited: 7-Step Reviewer Check

You can often tell a PDF has been edited by checking five things: the file properties, the producing software, the number of saved revisions, the digital signature status and the text and font layer. None of these proves a document is genuine. Each one can show that a file was changed after the issuer produced it, and together they take a reviewer about ten minutes.

This guide is written for the person who receives the file: a KYC analyst, a lettings agent, a lender's underwriter, an HR administrator. It assumes no forensic tooling. Where a command-line tool helps, the same information is usually available through the free Acrobat Reader or a browser.

What an edit check can and cannot prove

A PDF edit check finds traces of modification; it cannot certify authenticity. The PDF format is defined in ISO 32000-2, and the standard lets any application rewrite a file, strip its metadata or flatten it to images. A file with no traces is therefore "no evidence of editing found", never "verified".

Three outcomes are realistic:

• Clear traces: a consumer editing tool in the producer field, a modification date after the document's own date, or a broken signature. Escalate.
• Ambiguous traces: an incremental save or a re-exported file. Many legitimate workflows do this. Ask the applicant for the original.
• No traces: a clean file from an expected producer. Continue with cross-document checks, because a careful forger leaves nothing in the file itself.

Reviewers on specialist forums keep asking the same question: "can you really tell if a PDF was edited, or is it guesswork?" The honest answer is that metadata and structure checks catch careless edits quickly, and miss careful ones. That is why the last step below compares content rather than file properties.

Step 1: Read the file properties

Open the document properties and compare the creation date with the modification date. In Adobe Acrobat Reader press Ctrl+D (Cmd+D on Mac); in a browser viewer, use the document information panel. From a terminal, pdfinfo file.pdf or exiftool -a -G1 file.pdf prints the same fields plus the XMP block.

One trap catches new reviewers. Metadata dates describe when the file was produced, not the date printed on the document. Many bank and payroll portals generate the PDF at the moment you click download, so a March payslip with a creation date in June can be perfectly normal. Compare the file dates with the issuer's known behaviour, ideally against another genuine document from the same issuer.

Step 2: Check the producing software

The Producer field should match how that issuer really produces documents. Payroll platforms, banks and tax offices use server-side libraries (for example iText, Apache FOP, Skia/PDF, Adobe PDF Library or a vendor engine). A "bank statement" whose producer is a consumer PDF editor, an online "edit PDF" website or a word processor is a strong signal.

Warning combinations:

• Producer is an online PDF editor, with an issuer that never uses one.
• Creator says Microsoft Word or Canva, but the document claims to be a system-generated statement.
• Producer differs between the Info dictionary and the XMP block, which happens when a tool updates only one of them.
• Producer and Creator are both empty. Some privacy tools do this, but so does deliberate scrubbing.

The metadata tampering guide goes deeper on how these fields are forged and where scrubbing leaves its own signature.

Step 3: Count the revisions

A PDF saved incrementally keeps the earlier version inside the file, so the number of end-of-file markers hints at how many times it was saved. The format allows an application to append changes after the original %%EOF marker instead of rewriting the file (ISO 32000-2, section 7.5.6).

On a terminal, grep -a -c '%%EOF' file.pdf returns the count. One marker is a single write. Two is normal for "linearised" files optimised for web viewing. Three or more means at least one incremental update, and a PDF library such as qpdf or pdf.js can extract each earlier revision so you can read what the document said before.

Incremental updates are not proof of fraud. Filled forms, countersigned contracts and annotated files all produce them. The test is whether the update makes sense: a signed lease with a tenant's initials added is fine; a payslip with three revisions is not something a payroll system does.

Step 4: Validate every digital signature

A valid signature seals the file; a broken one proves it changed after signing. Open the signature panel in Acrobat Reader. A green tick means the document is unmodified since signing and the certificate chain is trusted. "Document has been altered or corrupted since it was signed" is the clearest evidence of editing you will ever get.

Under UK law, electronic signatures and seals are governed by the retained eIDAS Regulation as amended, and in the EU by Regulation (EU) 910/2014. Qualified signatures carry a legal presumption of integrity. Where a recipient wants an independent opinion, the European Commission publishes a free DSS signature validation tool that does not rely on your viewer.

Two cautions. A signature panel showing "signature validity unknown" usually means the viewer lacks the trust list, not that the file is bad. And a document with no signature at all tells you nothing: most payslips and statements are never signed.

Step 5: Test the text layer and the fonts

Select all text (Ctrl+A) and look at what highlights. On a genuine system-generated PDF, text appears as clean, aligned blocks. On an edited one you often see a single changed figure highlighted as a separate box, shifted a pixel off the baseline, or text that will not select at all because it was pasted in as an image.

Then open the font list (Document Properties, Fonts tab, or pdffonts file.pdf):

• Two subsets of the same typeface (for example ABCDEF+Arial and GHIJKL+Arial) often mean part of the page was retyped with a different tool.
• A font that appears only for the amount fields, such as salary, balance or rent, is the classic pattern.
• No text at all, only one big image, means the page was printed or screenshotted and re-wrapped, which removes the evidence this step relies on.

Copy the text into a plain text editor too. Hidden text layers, white-on-white characters and text placed outside the page area show up there. See hidden text layers in PDF fraud and font forensics for worked examples.

Step 6: Zoom in on the visuals

Zoom to 400% on logos, stamps, figures and table borders. Vector logos stay crisp; a logo that turns blurry while the surrounding text stays sharp was pasted as a raster image. Look for mismatched anti-aliasing around numbers, uneven spacing in right-aligned amounts, a different grey in a table row, and text that does not sit on the invisible grid the rest of the page follows.

Where a page is a scan or photo, compression analysis such as error level analysis can add a signal, but it produces false positives on heavily compressed scans. Treat it as a prompt for questions, not a verdict.

Step 7: Cross-check the content

Compare the numbers and identifiers against something the applicant did not control. This is the step that still works when the file is clean. A forger who scrubs metadata and matches fonts still has to make the figures agree with every other document in the file.

Arithmetic is the cheapest test of all. Re-add a statement's lines, and check that opening balance plus credits minus debits equals the closing balance. Edited amounts rarely survive that.

For UK regulated firms, regulation 28 of the Money Laundering Regulations 2017 requires customer due diligence based on documents from a reliable and independent source, which is why reviewers cannot stop at "it looks fine".

Free tools or an automated check

Free tools are fine for the occasional file, but do not upload customer documents to a random website. Uploading identity and financial documents to an unknown "PDF checker" is a personal-data transfer; under UK GDPR the Information Commissioner's Office expects you to know where that data goes and on what terms. Prefer local tools (Acrobat Reader, pdfinfo, exiftool, qpdf) or a processor under a data processing agreement.

At volume, the manual route breaks down. Automated checks can apply the same property, structure and consistency tests to every file and route only the odd ones to a person. CheckFile's AI-generation and tampering signals work as a complement to your existing controls, not a replacement for reviewer judgement. For file-level completeness and cross-document checks, the KYC and banking solution describes what is compared (fields, dates, registers), and the pricing page lists plans.

When an edit is legitimate, and when to escalate

Not every changed PDF is fraudulent. Applicants merge pages, compress files to meet upload limits, redact account numbers on a bank statement or fill in a form. Ask for the original and an explanation before assuming bad faith, and record what you were given.

Escalate when a trace is combined with a mismatch: an unexpected producer plus a figure that does not reconcile, or a broken signature on a document that was presented as original. Knowingly presenting an altered document can be a criminal offence; in England and Wales, section 1 of the Forgery and Counterfeiting Act 1981 covers making a false instrument with the intention that someone accepts it as genuine. Your firm's money laundering reporting officer decides what happens next, not the front-line reviewer.

For the wider process around these checks, see the document verification guide.

Frequently Asked Questions

Can you tell if a PDF has been edited?

Often yes, but not always. Metadata, revision count, signatures and fonts reveal careless edits within minutes. A careful forger who prints to a new PDF or rebuilds the file from scratch leaves few traces, so the content must also be cross-checked against other documents.

Does opening and saving a PDF change it?

Saving in most editors updates the modification date and the producer field, and may append a revision. Opening and viewing alone does not change the file. This is why a modification date later than the creation date is a prompt to ask questions, not proof of fraud.

Is there a free online tool to check if a PDF was edited?

Several exist, but uploading customer documents to them is a data protection risk. Use local tools for metadata and structure, and use an online service only under a data processing agreement or for non-personal test files.

Can AI tell if a PDF has been edited?

Automated systems can compare metadata, structure, fonts and image artefacts at scale, and flag combinations a human would miss. They produce signals rather than certainty, and the final decision should stay with a reviewer.

What if the PDF has no metadata at all?

Missing metadata is a flag, not a verdict. Some privacy tools strip it, and so do print-to-PDF workflows. Ask for the original from the issuer's portal and compare it with a document the issuer is known to produce.

For where this fits in the CheckFile offering, see our AI and deepfake detection approach.