How to Tell if a PDF Has Been Edited: 8 Checks Anyone Can Do
From file properties to font subsets and incremental saves — eight practical ways to tell whether a PDF was edited after it was created, and their limits.
PDFs feel official, but they are among the easiest documents to change. The good news: editing usually leaves traces. Some you can see yourself in a few minutes; others need a closer look at the file. Here are eight checks, how to run them, and what they can and can't prove.
1. Look at the document properties
Most PDF readers show "Producer" and "Creator" — the software that made the file. In Adobe Acrobat Reader, open File › Properties; on a Mac, Preview shows them under Tools › Show Inspector. A bank statement produced by a design app or a word processor is unusual; one produced by an online PDF editor even more so. See what PDF metadata reveals.
2. Compare created and modified dates
A modification date long after creation suggests the file was changed. A statement "issued" on March 1 but modified on April 20 deserves a question. Absence of dates proves nothing — they can be removed — but it is unusual for documents generated by banks and payroll systems.
3. Check the fonts
In the properties (Fonts tab in Acrobat), look at the embedded fonts. Documents edited after creation often contain extra fonts or extra subsets of the same font — the editor added characters the original file didn't include. A statement that uses one typeface but embeds three variants of it, or a font the bank never uses, is a signal.
4. Look for incremental saves
PDFs can be saved by appending changes to the end of the file, leaving the original content inside. Several save sections in a document that should have been generated once is a signal. Some viewers show a version history for signed documents; forensic tools reveal the rest.
5. Zoom in on the numbers that matter
Edited values may differ slightly in weight, kerning or baseline. White boxes placed over old values are a common shortcut — zoom to 400% and look for edges, slightly different background shades, or text that doesn't sit on the same line as its neighbors.
6. Select the text
Try selecting text around key values. Text that turns out to be an image, values that select as separate objects from their line, or a line where the selection jumps in an odd order can reveal pasted content.
7. Check digital signatures
A valid signature covers specific byte ranges of the file; changes after signing break it or fall outside the signed range. If a document claims to be signed, open the signature panel and read what the viewer says about changes since signing.
8. Do the arithmetic
Totals, balances and dates must agree. Editing a number usually breaks a sum somewhere else — a running balance, a total, a tax line. This is the most underrated check, because it works even on scans and photos.
A worked example
A tenant sends a bank statement PDF. The properties say it was created by a browser's print engine and modified twenty minutes later by an online PDF editor. Two embedded subsets of the same font appear. One payroll deposit is a hair bolder than the others, and the running balance after it is off by exactly $3,000. Each signal alone could be innocent; together they tell a clear story — and a request for a fresh statement directly from the bank settles it.
The limits
None of these checks is proof on its own. A "printed to PDF" document can be perfectly genuine, a scanned document has no meaningful metadata, and a careful fake can pass several checks. That is why combining many independent signals matters — and why the final step for important decisions is verifying with the issuer.
Automating it
ThisVerify runs these structural checks together with pixel analysis, visual inspection and arithmetic, and explains every finding — in under a minute.
Related guides
FAQ
Does a "modified" date mean the PDF is fake?
Not necessarily. Many legitimate workflows modify files. It is one signal to weigh with others.