PDF Modified After Signing: Check the Signature and Revision History

A PDF that was edited after signing shows up in two places: the signature panel, which reports whether the bytes covered by the signature still match, and the revision history, which lists every version appended to the file. If the panel says the document was altered since signing, the content you are reading is not what the signer approved. If it says only "changes after signing," you must open the signed revision and compare it with the current one.

This guide is written for the person who receives the file: a bank BSA/AML analyst, a property manager reviewing a lease, a contract administrator, an HR onboarding specialist. It needs nothing beyond a free PDF reader, and it explains what each message means and what to ask the sender next. A check like this finds traces of change. It does not prove that a document is genuine.

How a digital signature protects a PDF, and where it stops

A PDF signature stores a cryptographic hash of a defined range of bytes, so any change inside that range breaks validation. The format is specified in ISO 32000-2. The signature is a container inside the file that lists a byte range covering the whole file except the space reserved for the signature value itself.

A PDF may also grow legitimately after signing, because the format allows incremental updates appended after the signed bytes. A second signer adds a signature, a form field is filled in, a comment is added. The original bytes are untouched, so the first signature stays mathematically valid. Whether the update is acceptable depends on the permissions the author set.

The US legal frame is permissive about format and silent about verification. The federal ESIGN Act, 15 U.S.C. § 7001, gives electronic signatures and records the same legal effect as paper, and the Uniform Electronic Transactions Act, adopted in nearly every state, says the same. Neither tells you how to check that a PDF is unchanged. That job falls to your own controls, and in litigation to Federal Rule of Evidence 902, where subsections (13) and (14) allow electronic records to be authenticated by a qualified person's certification, including by hash value comparison. A signature image pasted onto a page gives you no hash to compare.

Step 1: Read the signature panel, not the badge

Open the signature panel and read the full status text, because the green check in the toolbar summarizes less than it appears to. In Adobe Acrobat Reader, choose the Signatures panel (View, Show/Hide, Navigation Panes). Each signature is listed with a status and, when later revisions exist, text such as "Revision 1 of 3." Use "View Signed Version" to open the file exactly as it was when that person signed.

Write down three things for each signature:

• The signer name and the certificate issuer.
• The signing time, and whether it comes from a trusted timestamp or only from the signer's computer clock.
• The status line, word for word.

Users on forums keep asking: "I signed a PDF and now someone says they edited it afterward, how do I know?" The panel answers both. If a tool forces you to remove the signature to edit the file, the original signed version is gone from the editor's point of view, so ask for the signed original, not the edited copy.

Step 2: Count revisions and extract the signed version

Each incremental save appends a new section ending in an %%EOF marker, so the marker count approximates the number of revisions. On a terminal, grep -a -c '%%EOF' file.pdf returns it. A freshly generated file often has one marker, a web-optimized file two. Three markers on a document that only one person signed deserve a question.

To read what the file said at signing time, use "View Signed Version" in Acrobat, or cut the file at the byte offset where the signed range ends. qpdf and pdfsig (from Poppler) report the signed range and validate it from the command line. pdfsig file.pdf prints each signature, its byte range, and whether the digest matches.

Then compare the two versions visually and by text. Look for:

• Changed amounts, dates, names and account numbers.
• Pages added, removed or reordered.
• A new text block that sits above an old one (the old text is still in the file under the new layer).
• Annotations or stamps that cover original content.

Acrobat's Compare Files tool highlights textual differences across many pages. Do this on a local copy.

Step 3: Know the attacks that keep a signature valid

Some edits leave the signature showing as valid, which is why a green status alone is not enough. A 2019 study from Ruhr University Bochum on incremental saving attacks showed that several viewers displayed valid signatures on files whose visible content had been changed by an appended revision. "Shadow Attacks" (2020) described a document prepared with hidden content that is revealed by a permitted later update, such as filling a form field. Both are published at pdf-insecurity.org, and vendors have patched many of the original findings.

The lesson for a reviewer is practical:

• A valid signature plus a later revision is a reason to compare, not to relax.
• A signature on a document whose author allowed form filling or annotation is weaker evidence than one on a document certified with "no changes allowed."
• Open the file in a second viewer. A discrepancy between two viewers is itself a flag.

Check the certification level too. A certifying signature carries a permission setting (no changes, form fill and signing, or annotations allowed). If the author chose "no changes" and a later revision exists, the viewer should flag it.

Step 4: Validate the signer, not only the file

A signature can be mathematically valid and still be worthless if the certificate is self-signed, expired or issued by someone nobody trusts. Check who issued the certificate. Adobe maintains an Approved Trust List, and a certificate from a commercial signing platform will normally chain to it; a self-signed certificate will show "validity unknown." For a second opinion independent of your viewer, the European Commission offers a free DSS signature validation tool that reports the certificate chain, timestamp and whether the document digest matches. Because it uploads the file, use it only with sample documents or under your data handling policy.

The related risk of invented certificates is covered in fake electronic signature certificates.

Step 5: Cross-check what the signed content says

Compare the figures and identifiers in the signed revision against a source the sender did not control. A perfect signature only proves the signer approved those bytes, not that the amounts were true. For a signed employer letter, check the company against the Secretary of State business registry for the state of incorporation. For a signed contract, check the party names and entity status. For a signed pay stub, check net pay against the bank deposit.

Applicants have a simple question: "I signed it, why does the bank want the original from the portal?" Because the bank is validating origin and consistency, not only integrity. The guide to telling whether a PDF has been edited and the metadata tampering guide cover the file-level checks that complement this one.

What to ask the sender, and when to escalate

Ask for the original signed file straight from the signing platform or the signer, and keep the version you received. Do not reconstruct or "fix" the file yourself. A legitimate sender can almost always re-download the sealed copy or send the audit trail from the e-signature service.

• Panel says altered since signing: request the original; do not process the copy.
• Later revision exists but panel is valid: compare revisions, and ask why the update was needed.
• Validity unknown: check the certificate issuer and validate in a second tool before concluding anything.
• No signature although one was promised: ask for the signed version.

Escalate when a change coincides with a mismatch, for example an altered amount plus a revision made days after signing. Your BSA officer decides whether anything rises to a suspicious activity report; the front-line reviewer should not accuse anyone. Under the Bank Secrecy Act's customer identification program rule, 31 CFR 1020.220, banks must verify identity using documents and keep records of what they relied on, and FinCEN publishes the SAR guidance. Knowingly submitting an altered document to obtain credit can also fall under federal bank fraud, 18 U.S.C. § 1344.

For the wider process, see the document verification guide. If you receive signed files at volume, CheckFile's AI-generation and tampering signals are a complement to your existing controls, and the KYC and banking solution shows what a file check compares: fields, dates and registers. The pricing page lists plans.

Frequently Asked Questions

Can a PDF be edited after it is signed?

Yes, in two ways. Changes inside the signed byte range break the signature, which the viewer reports. Changes appended as a new revision leave the first signature valid, so you must open the signed version and compare it with the current one.

How do I see the version that was signed?

In Adobe Acrobat Reader, open the Signatures panel, right-click the signature and choose "View Signed Version." On the command line, pdfsig from Poppler lists each signature and its byte range, and qpdf can extract earlier revisions.

Why does my PDF say "validity unknown"?

Usually your viewer does not have the issuer in its trust list, or it cannot check revocation offline. It does not mean the file was changed. Validate the same file in a second tool before drawing a conclusion.

Does a valid signature prove the content is true?

No. It proves the bytes have not changed since the signer applied the signature, and links them to a certificate. Whether the amounts, names and dates are accurate still needs a cross-check against registries or other documents.

Can I remove a signature and re-sign a corrected PDF?

You can, but the result is a new document with a new signature. Anyone relying on the earlier signed version should receive the original as well, so the chain of versions stays visible.