A PDF is not a flat image: it is a documented format that retains far more about its own history than the visible page suggests. Here is what it keeps, and what can be inferred from it.
When software saves a change it can rewrite the whole file, or append the changed objects to the end and leave everything before untouched. The second mode — the incremental update — is the default in several editors, and it is a gift for analysis: every revision is a preserved snapshot.
A file with three revisions was saved three times. Truncate it at the end of the first to recover the original state, then compare.
Deleting an element in a PDF editor removes it from the display, not necessarily from the file. The object becomes orphaned: no longer referenced, still present. Finding an old amount, an old address or a logo that no longer appears is strong evidence.
A PDF can carry metadata in two places: the legacy Info dictionary, and an XMP stream in XML. Many tools update one and forget the other.
A divergence between them — different dates, different producers — reveals processing by a tool that did not clean up after itself. XMP sometimes keeps a DocumentID and a version history more talkative than the Producer field.
Metadata fields are free text: anyone can write whatever producer they like. A well-informed forger restores the expected value after editing.
This is why structural evidence matters more: object ordering, compression style, how the cross-reference table is written. Those details are emitted by the library that wrote the file, and a forger does not reproduce them by editing a string. A file announcing one producer while its structure matches another is an interesting case.
This deserves saying plainly: most modified PDFs were modified for entirely mundane reasons — compression before sending, adding a signature, merging documents, flattening a form, passing through an archiving tool.
Detecting a modification therefore only moves the question along: what was modified, and does it touch data that matters? Several signals converging on the same region of the document make a case; one signal on its own does not.
Edited amounts, altered dates, swapped bank details: the technical evidence that gives away a tampered invoice PDF, and how to check for it.
Utility, telecom and internet bills used as proof of address: the technical checks that reveal an edited document, and when the checks simply cannot apply.
The 2D-Doc barcode on tax notices, pay slips and official certificates: what it contains, what it actually proves, and why it is different from every other check.
Fake pay slips in rental files and loan applications: payroll software fingerprints, arithmetic checks and the French 2D-Doc barcode that expose an edited document.
Payment redirection fraud swaps the bank details on a genuine invoice. IBAN checksum, bank-code consistency and PDF tampering traces: how to check details received by email.
A supplier announces new bank details? How the fraud works, the warning signs in the message and in the attached document, and the checks to run before you pay.
Check a Kbis against the public registers (SIREN, directors, registered office, company status), spot a forged PDF, and know what a genuine Kbis does not prove.
Landlord or agency: verify a tenant's French income-tax notice with the tax office's online service (SVAIR), the signed 2D-Doc code and the other documents in the file.
Checking a French subcontractor's attestation de vigilance: the 15-character security code on urssaf.fr, the six-month validity, and what the law requires of the client.
Analyse a document for free