A signed PDF can still be fake
A digital signature feels like the end of the argument. The reader shows a green check, the panel says "signed," and the document looks settled. For a bank statement or an invoice that decides a loan or a tenancy, that reassurance is worth questioning — because a valid signature answers a narrower question than most people think it does.
What a valid signature actually proves
A genuine cryptographic signature proves two real things: that the file has not changed by a single byte since it was signed, and — if you inspect the certificate — who held the key that signed it. That is strong evidence, and far better than a document with no signature at all. But notice what is missing from that list: it does not, on its own, prove that the signer is your bank, or that what you see on the page is what the signer approved.
Three things a green checkmark doesn't tell you
- Signed is not the same as signed by the bank. The check confirms the file was signed; the certificate says by whom. A valid signature from a personal certificate, a generic provider or an unrelated company is still valid — and still not your bank. The signer's organisation is the field that matters, and it is the one people skip.
- A picture of a signature is not a signature. A pasted "digitally signed" graphic, a scanned squiggle or a logo that says "verified" carries no cryptography at all. If the reader's signature panel is empty, there is nothing to validate — only an image designed to look like proof.
- The signer may not have seen what you see. Using entirely legitimate PDF features, content can be hidden under the signature or swapped in afterwards so the page renders differently while the signature stays valid (researchers call these shadow attacks). A green check confirms integrity since signing — not that the visible figures are the ones that were approved.
How to check a signature properly
- Open the signature panel (in Adobe Acrobat Reader, Foxit and most viewers). If there is no panel, the "signature" is just an image.
- Confirm the status is valid and that the document has not been modified since signing.
- Open the certificate and read the signer: does the organisation match the bank or issuer the document claims to come from — not just a plausible-looking name?
- Check the date the signature was applied against the document's own dates.
What this looks like across Europe
Under the EU's eIDAS rules, a qualified electronic signature carries the highest legal weight, and many banks sign their statements by default — so in some markets an unsigned statement is itself unusual. But "qualified" still means integrity plus a named signer; it does not waive the question of whether that signer is the bank. Some national schemes add a wrinkle: a signature can be perfectly genuine yet show as unverifiable in standard readers because validating it needs a national tool. Unverifiable is not the same as fake — but it is not proof either.