How to Tell If a PDF Has Been Edited or Tampered With

In the modern business world, trust relies on PDFs. We accept bank statements, vendor invoices, academic transcripts, and legal contracts in PDF format every day. But with the rise of accessible PDF editing tools, altering a digital document is easier than ever.

A fraudster can easily change the routing number on an invoice or alter the balance on a bank statement. If you're processing sensitive documents, you need to know how to spot the digital fingerprints left behind by manipulation.

Here is a practical guide to detecting if a PDF has been tampered with.

1. Inspect the Hidden Metadata

Every PDF carries hidden information called metadata. This data records the file's history, including what software created it and when it was last modified.

You can view metadata in Adobe Acrobat by going to File > Properties, or by using specialized metadata extraction tools.

What to look for:

• Creation vs. Modification Dates: If a bank statement claims to be from January 1st, but the metadata shows a modification date of March 15th, you have a massive red flag.
• The "Producer" and "Creator" fields: A legitimate bank statement will usually show an enterprise software engine as the producer (e.g., Oracle BI Publisher or iText). If the producer field says Adobe Acrobat Pro, Canva, or ilovepdf, it means a human has likely opened and manipulated the file after it was officially generated.

(Note: If you are sharing documents and want to clear this data for your own privacy, use a tool to remove PDF metadata before sending).

2. Look for "Floating" Text Blocks

When a legitimate system generates a PDF invoice, the text is usually laid out in clean, continuous blocks.

When someone uses a PDF editor to change a number (like altering an invoice amount from $100 to $1000), the software often injects the new number as a completely separate text box layered on top of the existing document.

How to spot it: Open the PDF and use your mouse to highlight the text around the suspicious area. If it's a genuine document, your highlight cursor will smoothly flow across the sentence. If it's forged, the cursor will often jump erratically, skip the altered word entirely, or highlight the word in a weird, disconnected rectangular block.

3. The Font Inconsistency Test

Professional systems use embedded fonts to generate documents. When a fraudster alters a document, they often don't have the exact proprietary font the bank used.

Instead, their PDF editor will substitute a visually similar system font (like swapping Helvetica for Arial). To the naked eye, it looks fine. But under scrutiny, it fails.

Zoom in to 400% on the suspicious text and compare it to the surrounding text. Look at the lower-case 'a', 'g', and 't'. Are the curves slightly different? Is the ink weight slightly heavier? If the font of a single number looks slightly different from the rest of the line, it's forged.

4. The "Frankenstein" Scan (Image Level Analysis)

Sometimes fraudsters don't edit the text; they edit a scanned image. They might scan a document, use Photoshop to change a number, and then convert that image back into a PDF.

In these cases, look for compression artifacts. When an image is saved as a JPEG, it creates tiny blocky halos around the text (called JPEG artifacts). If someone copy-pastes a number from another part of the document, the artifact blocks around that specific number won't line up with the grid of the background. It will look like a digital patch.

5. The Ultimate Proof: Digital Signatures

The only 100% foolproof way to guarantee a PDF hasn't been altered is if it possesses a valid cryptographic Digital Signature.

A cryptographic signature seals the document. If even a single pixel or character is changed after the signature is applied, the mathematical hash breaks, and PDF readers will display a massive red warning that the signature is invalid.

If you are dealing with high-value contracts, do not rely on visual inspection. Require your partners to digitally sign the PDF using a certified certificate.

<script type="application/ld+json"> {"@context":"https://schema.org","@type":"BlogPosting","headline":"How to Tell If a PDF Has Been Edited or Tampered With","author":{"@type":"Organization","name":"heyPDF"},"datePublished":"2026-06-13T19:22:11.463Z"}</script> <script type="application/ld+json"> {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Can metadata be faked?","acceptedAnswer":{"@type":"Answer","text":"Yes, sophisticated users can alter or delete metadata. Therefore, clean metadata doesn't guarantee authenticity, but suspicious metadata is a reliable indicator of tampering."}},{"@type":"Question","name":"Is a flattened PDF more secure against tampering?","acceptedAnswer":{"@type":"Answer","text":"Flattening a PDF makes it harder for casual users to edit form fields, but it does not stop someone with a professional PDF editor or Photoshop from altering the document."}},{"@type":"Question","name":"How do I check if a digital signature is valid?","acceptedAnswer":{"@type":"Answer","text":"Open the PDF in a compliant reader like Adobe Acrobat. Click the Signature Panel icon on the left sidebar. It will verify the cryptography and tell you if the document has been altered since it was signed."}}]}</script>