How to Tell If a PDF Has Been Edited or Faked (Free Forensic Check)

Someone sends you a PDF — a bank statement for a loan, an invoice to approve, a signed contract, a payment receipt. It looks fine. But "looks fine" is exactly what a forger is counting on. Editing a PDF is trivial now, and generative AI can produce a convincing document from a text prompt in seconds. The good news: most tampering leaves fingerprints in the file, and there is one check that gives a yes-or-no answer with no room for doubt. Here is how to tell whether a PDF is the genuine, unaltered original — and where the popular checks quietly fail.

Start with the metadata — but do not trust it blindly

Every PDF carries metadata: the software that produced it (the "Producer" and "Creator"), the creation and modification dates, and the PDF version. Classic red flags are a producer that does not match the claimed source (a "bank statement" made by a word processor or an image editor), a modification date later than the creation date, dates set in the future, or metadata that has been stripped out entirely to hide the trail.

The catch is that metadata is easy to fake and easy to break by accident. Adding a harmless comment or highlight updates the modified date; some editors rewrite the producer field on save. So a suspicious producer is a reason to look harder, not a verdict on its own. Treat metadata as the first clue in an investigation, never as proof.

Look at the structure: incremental updates and edits after signing

PDFs keep a kind of history by design. When most editors save a change, they append the new content to the end of the file rather than rewriting it, leaving the original objects in place and adding new ones after the end-of-file marker. Counting these "incremental updates" tells you how many times the file was re-saved after it was first created — a high number on a document that should have been written once is a warning sign.

A structural check can also flag whether the file was modified after a signature was applied, whether its unique file ID changed (a sign it was re-saved elsewhere), and whether the completion certificate on a sealed document is intact. None of this decompresses the visible content, so it is advisory — but on a receipt or statement that claims to be a pristine original, unexpected edit history is a strong signal something was changed.

The blind spot every "checker" shares: a clean fake

Here is the uncomfortable truth that most fraud tools gloss over. Structural and metadata checks catch documents that were altered. They do not catch a document that was fraudulent from the first byte. If someone types a fake bank statement from scratch in a word processor and exports it to PDF, the file is structurally clean — because it was never edited, it was born fake. Every "is this PDF edited?" test will pass it.

That is why serious fraud teams add content checks that have nothing to do with the file format: do the transaction lines on a bank statement actually add up to the running balance? Are the fonts and logo consistent with a real statement from that bank? Does the named account holder match other records? Structure tells you if a file was touched; arithmetic and context tell you if the story inside it is true.

AI-generated documents and the provenance trail

Generative AI raises the stakes: a plausible invoice, letter or ID can be produced from a prompt. Sometimes these files carry provenance markers you can detect — C2PA Content Credentials (the open standard backed by Adobe, Microsoft, OpenAI, Google and camera makers) can embed a signed record of whether AI was involved and what edits were made. Some tools also leave tell-tale metadata, like an AI generator name or an embedded prompt block.

This matters more every month. The EU AI Act's transparency rules for AI-generated content take effect in August 2026, pushing the whole industry toward labelled provenance. But provenance is only present when the creating tool chose to add it, and it can be stripped. So an explicit "AI-generated" marker is proof of AI origin; the absence of one is not proof a human made it. Honest verification reports say both.

The one check that actually settles it: a hash match

All of the above is detective work on an untrusted file. There is a way to remove the doubt entirely — but it has to be set up when the document is created, not after the fact. When a document is sealed, you compute a cryptographic fingerprint of the whole file (a SHA-256 hash) and record it. To verify any copy later, you re-compute its fingerprint and compare. Identical hash means a byte-for-byte identical file; a single changed character produces a completely different hash. There is no grey area and nothing to take on trust.

This is the difference between "we found no signs of tampering" and "this is provably the original." A forensic scan is a probability; a hash match against a sealed record is a certainty. It is also why the strongest thing you can do is not just check documents you receive, but seal the ones you send — so the other side can verify them the same way.

Check any PDF free — in about ten seconds

You do not need forensic software to run the first pass. On the PDF Verified verify page you can drop any PDF — a receipt, invoice, statement or contract — and get a free, read-only forensic report: the producing software, incremental-update history, edit-after-signing signals, an AI-origin check, and a plain-English risk rating. If the file was sealed on PDF Verified, you also get the full signing record and a definitive hash match, so you know it is the untouched original.

And if you are the one sending documents that people need to trust — quotes, agreements, official letters — sealing them on PDF Verified gives every recipient a public verification link and a QR code they can check in seconds, with a tamper-evident SHA-256 seal and an audit trail behind it. Detecting fakes is useful; making your own documents impossible to fake quietly is better.