How to Tell If a PDF Has Been Edited: 7-Step Check (US)

You can often tell a PDF has been edited by checking five things: the file properties, the producing software, the number of saved revisions, the digital signature status and the text and font layer. None of them proves a pay stub, bank statement or W-2 is genuine. Each can show the file changed after the issuer produced it, and together they take a reviewer about ten minutes.

This guide is for the person on the receiving end: a loan processor, a bank account-opening analyst, a property manager running tenant screening, an HR coordinator completing onboarding. No forensic software is required. Where a command-line tool helps, the free Adobe Acrobat Reader usually shows the same information.

What an edit check can and cannot prove

An edit check finds traces of modification; it cannot certify that a document is authentic. The PDF format is specified in ISO 32000-2, and any application can rewrite a file, wipe its metadata or flatten it into images. A file with no traces means "no editing found", not "verified".

Three outcomes are realistic:

• Clear traces: a consumer editor in the producer field, a modification date later than the document's own date, or a broken signature. Escalate.
• Ambiguous traces: an incremental save or a re-exported file. Plenty of legitimate workflows do this. Ask the applicant for the original.
• No traces: a clean file from an expected producer. Go straight to third-party cross-checks, because a careful forger leaves nothing inside the file.

Reviewers on compliance and lending forums keep asking whether this is science or guesswork. Metadata and structure checks catch sloppy edits fast and miss careful ones. That is why step 7 compares content with sources the applicant does not control, such as IRS transcripts and payroll data.

Step 1: Read the file properties

Open the document properties and compare the creation date with the modification date. In Acrobat Reader press Ctrl+D (Cmd+D on Mac). From a terminal, pdfinfo file.pdf or exiftool -a -G1 file.pdf prints the same fields plus the XMP block.

One trap catches new reviewers. Metadata dates show when the file was produced, not the date printed on the document. Payroll portals such as employer HR systems and online banking sites typically generate the PDF when you click download, so a March pay stub with a June creation date can be normal. Compare against another genuine document from the same issuer.

Step 2: Check the producing software

The Producer field should match how that issuer actually generates documents. Banks, payroll processors and the IRS use server-side engines. A "bank statement" whose producer is a consumer PDF editor, an online "edit PDF" site or a word processor is a strong signal, especially when the same issuer's other statements show the same engine every time.

Warning combinations:

• Producer is an online PDF editor, with an issuer that never uses one.
• Creator says Microsoft Word or Canva on a document claiming to be a system-generated statement.
• Producer differs between the Info dictionary and the XMP block, which happens when a tool updates only one of them.
• Producer and Creator both empty. Privacy tools do this, and so does deliberate scrubbing.

The metadata tampering guide covers how these fields are forged and the signature scrubbing itself leaves behind.

Step 3: Count the revisions

A PDF saved incrementally keeps the earlier version inside the file, so the count of end-of-file markers hints at how many times it was saved. The format lets an application append changes after the original %%EOF instead of rewriting everything (ISO 32000-2, section 7.5.6).

On a terminal, grep -a -c '%%EOF' file.pdf returns the count. One marker is a single write. Two is normal for linearized "fast web view" files. Three or more means at least one incremental update, and a library such as qpdf or pdf.js can pull out each earlier revision so you can read what the document said before.

Incremental updates are not proof of fraud: filled forms, countersigned leases and annotated files all produce them. Ask whether the update makes sense. A lease with a tenant's initials added is fine. A pay stub with three revisions is not something payroll software does.

Step 4: Validate every digital signature

A valid signature seals the file; a broken one proves the file changed after signing. Open the signature panel in Acrobat Reader. A green check means unmodified since signing and a trusted certificate chain. "Document has been altered or corrupted since it was signed" is the clearest evidence of editing you will ever get.

In the US, electronic signatures are recognized under the federal E-SIGN Act, 15 U.S.C. § 7001 and state versions of the Uniform Electronic Transactions Act. Neither guarantees integrity by itself. Integrity comes from cryptographic signatures such as those chained to the Adobe Approved Trust List. A "signature validity unknown" message usually means your viewer lacks the issuer's certificate, not that the file is bad.

Most pay stubs, W-2s and bank statements are never signed, so a missing signature tells you nothing.

Step 5: Test the text layer and the fonts

Select all text (Ctrl+A) and see what highlights. On a system-generated PDF, text appears as clean, aligned blocks. On an edited one you often see a single changed figure in its own box, off the baseline by a pixel, or text that will not select because it was pasted in as an image.

Then open the font list (Document Properties, Fonts tab, or pdffonts file.pdf):

• Two subsets of the same typeface (ABCDEF+Arial and GHIJKL+Arial) often mean part of the page was retyped with a different tool.
• A font that appears only in the amount fields, such as gross pay, ending balance or rent, is the classic pattern.
• No text, only one big image, means the page was printed or screenshotted and re-wrapped, which removes the evidence this step relies on.

Paste the text into a plain editor as well. Hidden text layers, white-on-white characters and text parked outside the page show up there. See hidden text layers in PDF fraud and font forensics.

Step 6: Zoom in on the visuals

Zoom to 400% on logos, seals, figures and table borders. Vector logos stay crisp; a logo that blurs while nearby text stays sharp was pasted as a raster image. Look for mismatched anti-aliasing around numbers, uneven spacing in right-aligned amounts and a different shade of grey in one table row.

For scans and phone photos, error level analysis adds a signal but produces false positives on heavily compressed images. Treat it as a reason to ask questions, not a verdict.

Step 7: Cross-check against sources the applicant does not control

Compare numbers and identifiers with third-party data. This is the step that still works when the file is clean. A forger who scrubs metadata and matches fonts must still make the figures agree with everything else.

Lenders can order IRS transcripts through Form 4506-C with the borrower's consent, and employment and income can be verified directly with the employer or through a payroll data service. Arithmetic is the cheapest test of all: re-add the lines of a statement and confirm opening balance plus credits minus debits equals the closing balance.

For banks, the Customer Identification Program rule at 31 CFR 1020.220 requires verifying identity through documents, which is why reviewers cannot stop at "it looks fine". FinCEN publishes the related Bank Secrecy Act guidance.

Free tools or an automated check

Free tools are fine for the occasional file, but do not upload customer documents to a random website. Sending identity and financial records to an unknown "PDF checker" can conflict with your obligations under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, 16 CFR Part 314, and with state privacy laws such as the CCPA. Prefer local tools (Acrobat Reader, pdfinfo, exiftool, qpdf) or a service provider bound by contract.

At volume, the manual route breaks down. Automated checks apply the same property, structure and consistency tests to every file and route only the odd ones to a person. CheckFile's AI-generation and tampering signals work as a complement to your existing controls, not a replacement for reviewer judgment. For completeness and cross-document checks, the KYC and banking solution describes what is compared (fields, dates, registers), and the pricing page lists plans.

When an edit is legitimate, and when to escalate

Not every changed PDF is fraud. Applicants merge pages, shrink files to meet an upload cap, redact an account number or fill in a form. Ask for the original and an explanation before assuming bad faith, and document what you received.

Escalate when a trace is combined with a mismatch: an unexpected producer plus a figure that does not reconcile with the IRS transcript, or a broken signature on a document presented as original. Knowingly submitting an altered document to a lender can fall under 18 U.S.C. § 1344 (bank fraud, up to 30 years) or 18 U.S.C. § 1014 (false statements to a financial institution). Under 31 CFR 1020.320, a bank files a Suspicious Activity Report within 30 calendar days of detecting facts that may constitute a violation. Your BSA officer decides that, not the front-line reviewer.

For the wider process around these checks, see the document verification guide.

Frequently Asked Questions

Can you tell if a PDF has been edited?

Often yes, but not always. Metadata, revision count, signatures and fonts reveal careless edits within minutes. A careful forger who prints to a new PDF or rebuilds the file leaves few traces, so the content must be cross-checked against IRS transcripts, employer records or other documents.

Does opening and saving a PDF change it?

Saving in most editors updates the modification date and the producer field, and may append a revision. Opening and viewing alone does not change the file. A modification date later than the creation date is a prompt to ask questions, not proof of fraud.

Is there a free online tool to check if a PDF was edited?

Several exist, but uploading borrower or customer documents to them is a data protection risk under GLBA and state law. Use local tools for metadata and structure, and an online service only under a written service-provider agreement or for test files with no personal data.

Can AI tell if a PDF has been edited?

Automated systems compare metadata, structure, fonts and image artifacts at scale and flag combinations a human would miss. They produce signals rather than certainty, and the final decision should stay with a reviewer.

What if the PDF has no metadata at all?

Missing metadata is a flag, not a verdict. Privacy tools strip it, and so do print-to-PDF workflows. Ask for the original from the issuer's portal and compare it with a document the issuer is known to produce.