Sample report. This is a full forensic report on a fictional document — the same report you receive after a $9 check. All names, amounts and identifiers are invented for demonstration.
Verdict · Tampered
This document was edited after the bank generated it.
Two forensic hard-stops fired (a desktop editor signature and an overlay covering the deposits field), and the document’s structure does not match authentic Lakeside Bank statements in our reference set. The recovered original amount is shown below.
Tamper score
0.97
threshold ≥ 0.60
Integrity score
0.05
authentic ≥ 0.75
Verdict basis
Hard veto
+ reference mismatch
Document information
| File name | lakeside_bank_stmt_jan2026.pdf |
| File size | 241 KB |
| SHA-256 | a3f9d1c7e2b840f6…4d91ca (truncated) |
| Claimed issuer | Lakeside Bank, N.A. — matched to reference group US · LAKESIDE · stmt |
| Statement period | January 1–31, 2026 |
| PDF version | 1.6 (header) → 1.7 (last revision) — version raised between revisions |
| Pages | 2 |
| Incremental updates | 3 revisions (authentic Lakeside files: 0) |
Tier 1 — Forensic hard-stops
any single hit is near-conclusive
These signals almost never appear in a server-generated bank statement. One alone is grounds to reject the document; this file triggered two.
Editing-software fingerprint
Veto · metadata
/Info /Producer (Adobe Acrobat Pro 23.6.20320)
/Info /Creator (Adobe Acrobat 23.6)
XMP pdf:Producer (Adobe Acrobat Pro (Windows))
Banks render statements through a server report pipeline, not desktop PDF software. Authentic Lakeside Bank files in our reference set carry Producer Oracle BI Publisher 12.2. A desktop editor (Adobe Acrobat) as both Creator and Producer means the file was opened and re-saved after the bank produced it.
Overlay object covering the deposits field
Veto · content
Page 1 Form XObjects: 2 (reference max: 1)
Largest overlay bbox: 6.2% of page, positioned over “Total deposits”
/Contents is an array; the last appended stream draws a white
rectangle (re … f) then new text (BT … Tj … ET) — classic overlay pattern.
An overlay is a small graphic “stamp” added on top of the original page to mask a value and print a new one over it. Genuine statements draw every figure in a single content stream; here a second stream was appended after generation, sitting directly over the deposits total. See the recovered original below.
Recovered content — what the overlay was hiding
An overlay hides a value visually but does not remove the original text object underneath it. Text extraction recovered the figure the document was built with, beneath the one now shown on screen:
Displayed on the page
$9,400.00
Recovered underneath (original)
$2,400.00
pdftotext layer, page 1, deposits cell:
visible glyphs (top stream) ……… $9,400.00
underlying text object ………………… $2,400.00 ← original value, still in the file
The “Total deposits” shown to a reader was inflated by $7,000. The original $2,400.00 is still present as a text object below the overlay. True redaction removes content; this document merely covered it.
Tier 2 — Structural anomalies
corroborating edit traces
Individually advisory; together they describe a file that was opened, modified and re-saved several times — inconsistent with a once-generated bank document.
Trailer /ID mismatch & low entropy
High · structure
/ID[0] (created) : 8f3a2c…
/ID[1] (modified): 00a10b… ID[0] ≠ ID[1]
Shannon entropy of /ID[1]: 2.1 bits/byte (random IDs ≥ 3.8)
The trailer ID pair changes on every save. They differ here, and the modified ID has unnaturally low randomness — a fingerprint of an editor that does not generate a proper random ID, rather than the bank’s pipeline.
Multiple save cycles
High · structure
%%EOF markers: 3 (1 = single save; >2 = repeated edits)
/Prev chain length: 2 (two earlier revisions recoverable)
XMP xmpMM:History “saved” events: 3
PDF appends a new section on each save instead of rewriting the file. Three end-of-file markers and a two-link revision chain mean the document was saved at least twice after the bank created it. Authentic statements are written once.
Edit timestamp & timezone anomaly
Medium · timeline
/CreationDate : D:20260131T22:47:03Z (statement run, month-end)
/ModDate : D:20260204T11:22:44+05'00' (4 days later)
A bank pipeline writes both timestamps within seconds of each other, in one timezone. Here the file was modified four days later and in a different UTC offset — consistent with editing on a separate device.
Cross-reference table irregularities
Medium · structure
xref type changes between revisions: classic table → /XRef stream
Objects with generation number > 0: 17 (clean generation: 0)
Free (deleted) object entries: 11
A single generator keeps one xref style and generation numbers at zero. A change of xref type plus rewritten/deleted objects shows a second tool wrote into the file after the original generator.
Intruder fonts & uneven typography
Medium · fonts
Reference font set: Helvetica, Helvetica-Bold (2 faces)
This file adds: ArialMT, ChromeSansMM (not in reference set)
Deposits cell vs body: 9.5pt vs 9.0pt, baseline shift +0.4pt
Editors inject their own fonts when re-saving. The added faces are not part of Lakeside’s server toolchain, and the deposits figure is set at a slightly different size and baseline than the surrounding text — a hallmark of a value typed in by hand rather than rendered by the pipeline.
Checks that passed
reported for completeness
Not every check failed. The following were clean — we report them so the verdict reflects the whole document, not only its problems.
✓ No embedded JavaScript
✓ No embedded files
✓ No optional-content layers
✓ No interactive form fields
– Not digitally signed (Lakeside statements are unsigned — neutral)
– Not encrypted
How this verdict was reached
reference-driven
Compared to known-good files
The document was matched to a reference set of authentic Lakeside Bank statements and checked against their producer, font set, structure and overlay norms. It failed the producer, font and overlay checks.
reference-free
Checked on its own evidence
Independent of any reference, the file’s metadata, trailer IDs, save history and timestamps were scored for internal consistency. Multiple tamper signals fired; integrity signals were effectively absent.
The free on-screen check flags the metadata and edit-history signals in seconds. This full report adds the reference-set comparison, overlay analysis and the recovery of the hidden original value — the part that turns “looks edited” into “here is what it originally said.”
Risk indicators, not a legal determination. This report identifies forensic signals that are statistically associated with edited or falsified PDF documents, and reconstructs content where the file allows it. A high risk score means the document differs materially from authentic bank-generated files. It is not proof of fraud in itself, and the final decision about authenticity — and any action you take — remains solely with you. Atomara is not a law-enforcement authority and this report is not, on its own, admissible legal evidence.