How to check whether an invoice has been tampered with

Updated 2 August 2026

Invoice fraud no longer takes any special skill — a free PDF editor is enough to change an amount or a bank account number. The good news is that those edits almost always leave traces in the file, if you know where to look.

Contents

1. 1. Look at what produced the file
2. 2. Count the PDF revisions
3. 3. Examine the fonts line by line
4. 4. Look for covered-up text
5. 5. Check what can be checked from outside
6. The habit that beats every technical check

1. Look at what produced the file

A PDF records the software that wrote it in a field called Producer, and the originating application in Creator. An invoice issued by accounting software carries that software's signature. If it carries a consumer PDF editor's instead, the file was reopened and re-saved after it was issued.

That is not proof of fraud on its own — plenty of people compress an oversized attachment before emailing it. It is a signal to combine with the others.

• Online converters: iLovePDF, Smallpdf, Sejda, PDF24, Canva, Nitro. They rewrite the file entirely and erase the original history along the way.
• ModDate far later than CreationDate: the document was changed long after it was created.
• Empty metadata on a document supposedly issued by a large company: industrial billing pipelines fill those fields in.

2. Count the PDF revisions

The PDF format lets a program save a change by appending data to the end of the file instead of rewriting it. This is an incremental update, and the previous state stays physically present in the file.

The practical consequence: on a multi-revision document you can often render the earlier version and compare. An amount that changes between two revisions is one of the few pieces of evidence that comes close to proof.

Watch for false positives: an electronic signature legitimately adds a revision, and some administrative forms add one every time they are filled in.

3. Examine the fonts line by line

Software-generated documents use a consistent set of fonts and embed them in the file. When someone edits an amount, the editor may not have the original font available and substitutes a system one: Arial, Calibri, Helvetica.

• A font change mid-line or mid-word is very hard to produce by accident.
• A non-embedded font among embedded ones points to a late addition.
• Unusual font diversity on a single page — beyond five or six on an invoice — is worth a look.

4. Look for covered-up text

The most common edit deletes nothing: it covers. A white rectangle over the old amount, the new amount typed on top. Visually flawless. In the file, the old text is still there, underneath.

Copying the PDF's text into a plain text editor is sometimes enough to make the original value reappear. A variant is text made invisible — invisible render mode, or text coloured the same as the background — that contradicts what is displayed.

5. Check what can be checked from outside

Some invoice data can be verified outside the file, which is exactly what makes this step valuable: it does not depend on the issuer's good faith.

• Company registration number (SIREN/SIRET in France): the public registry answers directly. A number that does not exist, or belongs to an unrelated company, is decisive.
• EU VAT number: it has a computable check digit and can be validated against VIES.
• IBAN: its mod-97 checksum can be verified offline. A hand-edited IBAN almost always fails it.
• Arithmetic consistency: net + tax = gross. A partial edit breaks the sum.

The habit that beats every technical check

If you have any doubt about bank details, no file analysis replaces phoning the supplier on a number you already have — never the one printed on the suspicious invoice. Payment redirection fraud works precisely because the victim verifies the information using the information itself.