A bank statement, a pay stub, an invoice — when one arrives as a PDF, the decision to lend, rent or pay often rests on how it looks. The trouble is that a clean look is now free: anyone can produce a flawless-looking document in a minute. So the useful question is no longer "does it look right" but "was this file edited after it was made" — and a PDF answers that more honestly than the page it displays.
A PDF is a record, not just a picture
A PDF is not a flat image. It is a container that stores how it was built: the software that produced it, the dates it was created and last changed, the fonts it embeds and the structure underneath the visible page. A genuine bank statement is generated once by the bank's server software and saved straight away. An edited one is opened in an editor, changed, and saved again — and that second life leaves marks in places a forger rarely thinks to clean.
Read the metadata first
Two fields tell most of the story. Producer and Creator name the tool that wrote the file. A real statement names the bank's reporting software; an edited one often names an online or desktop PDF editor, Word or a design tool instead. Creation date and modification date tell you when. Software that generates a document writes both within seconds of each other. A modification date hours, days or weeks after creation means the file was reopened and resaved later — the classic shape of "open the real one, change a number, save again."
Why a later "modified" date isn't proof on its own
This is where most checklists overreach. A modification date later than the creation date is a flag, not a verdict. It can also appear because someone added a comment or a highlight, re-saved the file unchanged, or printed it to PDF. Some legitimate tools never write a modification date at all, and a few documents carry an extra save for a signature or a stamp. Treat the dates as a reason to look closer, never as the whole answer — that restraint is exactly what separates a real check from a guess.
Check it yourself in under a minute
You can see the basics without any forensic tools:
Open the PDF and view its properties — in most readers, File → Properties, or Document Properties.
Look at Author / Producer / Application: does it name the bank or payroll provider, or a PDF editor?
Compare the creation and modification dates: are they seconds apart, or far apart?
Scan the text itself — copy a figure and paste it elsewhere: numbers that look painted on but won't select cleanly are a warning.
If the producer names an editor and the dates don't line up, you have good reason to doubt the document. If everything looks tidy, you still don't have proof — only the absence of the easy tells. Or skip the manual steps: our free PDF metadata checker reads these fields for you.
Where surface checks stop
Two things the eye and the Properties panel miss. First, covering is not removing: when a number is hidden under a white box, the original is often still inside the file and can be pulled back out — visually gone, but not deleted. Second, fonts and spacing that change from one line or column to the next betray text that was pasted in, even when the metadata looks clean. And a determined forger can rebuild a document so the surface and the dates pass — which is why a confident answer comes from the file's deeper structure and any digital signature, not its first page. That's the layer our guide to spotting a fake bank statement works through, and AI document fraud explains why it matters more every year.
The bottom line
Reading the metadata is the right first move, and it catches the careless majority of fakes. But clean metadata means "no obvious edit," not "authentic." For a decision worth real money — a loan, a tenancy, an invoice — verify the file, not the picture it shows.
We value your privacy
We use cookies to run the site and, with your consent, to measure traffic and improve it. Privacy Policy
