How to Verify a PDF, and Spot a Fake Bank Statement or Payslip

Anyone reviewing documents for a living — a lender, a landlord, a finance team, an HR manager — eventually meets a document that is not what it claims to be. The uncomfortable part is that a forged bank statement or payslip almost never looks wrong. Modern editing tools reproduce a bank's layout convincingly, and a PDF opened on a phone shows you a picture, not a provenance record. The evidence is real, but it is in the file, not the image.

Why looking at a PDF tells you almost nothing

A PDF is a container. What you see is the rendered result; what matters for authenticity is the structure underneath — when the file was created, what software wrote it, whether anything was appended after the original save, and whether the document carries a cryptographic seal tying it to a signer.

This is why "it looks legitimate" is not a control. A convincing forgery and a genuine statement can render identically while differing completely in structure. Equally, a document can look slightly odd and be entirely genuine, because a bank re-exported it or a portal re-compressed it.

The practical consequence: a reviewer who only opens the file is not verifying anything. They are reading a picture that the sender chose to show them.

Two different questions, two different checks

It helps to separate the questions, because they have different answers and different levels of certainty.

The first is: was this document signed through a service that sealed it? If so, the seal is decisive. A sealed PDF has a SHA-256 fingerprint recorded at the moment of completion, so re-computing that fingerprint either matches the record byte-for-byte or it does not. There is no interpretation involved. This is what a verification QR code or link resolves.

The second is: this PDF was not sealed by anyone I trust — is there anything suspicious about it? That question can never be answered with certainty, only with evidence. What a forensic check does is surface the signals a forger has to work to hide, and let a human weigh them.

What actually gives a forged document away

Edits after the last save. PDFs support incremental updates: a change can be appended without rewriting the file. That is a legitimate feature — it is how signature fields work — but on a bank statement that should have been generated once and never touched, extra appended revisions are worth explaining.

A producing tool that does not fit the issuer. Statements from a bank are generated by reporting software. When the producer metadata says a consumer image editor or a browser print-to-PDF, that does not prove forgery, but it does mean the file did not come out of the bank the way it claims.

A running balance that does not reconcile. This is the strongest signal on a statement, and the one forgers most often miss. If you change a transaction amount to inflate income, every subsequent balance has to be recalculated or the arithmetic breaks. Re-adding the column catches this immediately, and it is a fact rather than an inference.

Declared AI origin. C2PA content credentials and IPTC provenance markers are increasingly embedded by generative tools. A document that carries an explicit AI-generation marker is telling you where it came from.

Mismatched timestamps. Creation and modification dates that contradict the statement period, or a modification date after the document was supposedly issued, are worth a question.

How to check a PDF in about five seconds

Open the verification page, drop the PDF in, and the file is fingerprinted in your browser. If it matches a sealed record you see who signed it and when. If it does not, you get the structural report instead: manipulation risk, incremental changes, producing-software mismatches, an AI-origin scan and, on anything that looks like a statement, automatic balance reconciliation.

You can also verify without the file at all. If you have the SHA-256 fingerprint or the short verification code from a QR seal, paste that instead — useful when someone has sent you a reference and you want to confirm it resolves to a real record before requesting the document.

Checking a document that PDF Verified sealed is free and always will be: that is the whole point of putting a seal on it. The forensic report on an unsealed PDF is $1.50 without an account, or included on a plan.

How to read the result without over-reading it

Be careful with the word "unverified". It means only that the file carries no sealed record we can match — which is true of most PDFs in the world, including entirely genuine ones. It is not an accusation.

Treat the risk level as triage, not a verdict. A high risk score means a document deserves a human look and probably a question to the sender; it does not establish fraud. Conversely, a low score does not certify a document as genuine — a careful forger can produce a structurally clean file.

The exception is the reconciliation check. Arithmetic that does not add up is a fact about the document, not a probabilistic signal, and it deserves a direct explanation.

The stronger move: make your own documents verifiable

Detection is inherently reactive — you are trying to catch something after it has been made. The durable fix, if you are the one issuing documents, is to remove the ambiguity at the source.

A document sealed at the point of signing carries a fingerprint and a QR code that resolves to a public verification page. Anyone who receives it can confirm it in seconds without contacting you, and any alteration breaks the match. You stop relying on recipients being good at spotting fakes, which most people are not.

For finance and HR teams the same applies in reverse. If you routinely receive statements and payslips, asking for documents issued with a verifiable seal converts an expensive judgement call into a lookup.