How to tell if a PDF was edited

The method in 6 steps

1. Start from the original file

   Ask for the PDF as it was received or downloaded, not a screenshot or a reprint. Any conversion can change what you are trying to read.

2. Read the properties

   Creation and modification dates, the original application, the software that produced the PDF. Our free tool shows them in your browser, sends nothing anywhere and passes no judgment.

3. Compare the dates with the document

   They should be plausible given the stated issue date, the day you received the file and the issuer.

4. Look for saved versions

   A PDF can hold several successive states, and our free tool shows how many. Having them is not abnormal: what matters is what changed from one to the next.

5. Check the digital signature, if there is one

   This is the firmest check available: it tells you whether the signed content has changed since signing.

6. Look at the page, then cross-check

   Study the sensitive areas, such as names, dates and amounts, and confirm with the issuer or against the rest of the case file before you conclude.

Reading the file’s properties

The ISO 32000 standard, which defines the PDF format, provides for a document information dictionary. It includes, among others:

• Creator: the product that created the original document, if it was converted to PDF, such as a word processor.
• Producer: the product that converted it to PDF.
• CreationDate: when the document was created.
• ModDate: when it was most recently modified.

To see them in Acrobat, open the file, then File, Properties, Description tab; the labels can vary with the version. Without Acrobat, our free tool shows the same fields.

Do not confuse these dates with the ones in your file explorer. Those describe the file on your computer, such as when it was downloaded, not the history of the document.

PDF also has a second location, XMP metadata, introduced with PDF 1.4. The US Library of Congress notes that the two structures can conflict, and that PDF 2.0 keeps only the two dates in the dictionary. A mismatch is therefore worth noting, but it proves nothing on its own.

What the dates really say

A date never stands alone: compare it with what you know about the document. These are the usual situations:

• A change long after the stated date. An invoice dated March and modified in June raises a simple question: who touched the file, and why?
• A creation date later than the document’s date. A January statement created in April may be a re-issue from a customer portal. That is ordinary, but it can be checked.
• Two identical dates. They do not show that the file is intact, only that nothing has been recorded in those fields since.
• A date later than the day you received it. It can point to a badly set clock or a date entered by hand.
• A gap of an hour or two. The standard’s date format allows an offset from universal time. Take time zones into account before calling it inconsistent.

Saved versions inside the file

A PDF can be updated without being rewritten. Under the ISO 32000 standard, the changes are appended to the end of the file and the original content stays intact; even a deleted element remains present, merely marked as deleted. An earlier state of the document may therefore still be readable.

There is nothing suspicious about this in itself: the standard presents it as a way to save small changes quickly. A completed form, a comment or a signature can each add a version. The right question is not whether several versions exist but what differs between them. A field completed by the recipient means something very different from an amount that changes on an invoice already issued.

The reverse does not hold: a file with no earlier version has not necessarily stayed intact since it was issued.

The digital signature

A PDF signed with a certificate is the most favorable case. According to the standard, if the signature is valid, the document can be recreated as it stood at signing. Adobe’s validation key separates two checks: the signer’s identity, and the document’s integrity, meaning the signed content has not changed, or only in ways the signer allowed. Acrobat’s signature panel shows the result:

• Document unchanged: the signed content has not changed since signing.
• Permitted or signed changes: edits took place, either allowed or themselves signed.
• Unsigned changes: something was added after signing. Use View Signed Version to see what the signature actually covered.
• Invalid signature: the key mentions illegal changes, a corrupted file or violated policy restrictions.
• Certificate problem: this concerns the signer, not necessarily the content.

Keep this check in proportion. A valid signature tells you the file has not changed since, not that its content was true when signed. Its legal weight also depends on its level: within the EU, only a qualified signature explicitly has the effect of a handwritten one. A picture of a signature placed on the page allows none of these checks.

Visual clues

Properties do not tell you where a change happened, but the page sometimes does. Zoom in and focus on what carries value, such as names, addresses, dates and amounts:

• Font and spacing: a digit or word whose font, size or alignment differs from the rest of the line.
• Text selection: an area that does not select like its neighbors, such as an image where the surrounding text is selectable.
• Edges and background: a lighter rectangle around some text, blurred outlines on an otherwise sharp page.
• Sums: totals that no longer match the line items.

Be more careful with a scan or a photo: compression and lighting also create local differences. And a careful edit may leave nothing visible, so a spotless page does not close the question.

The limits: what these clues do not prove

• Properties can be missing. The standard makes most of them optional, and some software writes very few. An empty field proves nothing, even though Adobe notes that an author can remove this information on purpose.
• Properties can be edited. According to Adobe, authors can choose any date they want. Consistent properties therefore do not guarantee that a document is authentic.
• Saving a file is not fraud. An accountant re-saving an invoice, a portal compressing uploads, a signing tool adding a version: all of these leave perfectly legitimate traces.
• Edited does not mean forged. Fixing a typo or completing a form changes the file without distorting the truth. French law, for instance, targets a fraudulent alteration of the truth (in French) that is liable to cause harm.

In practice, these checks help you decide what to ask next rather than settle the matter. If doubt remains, get the file from the source, through the issuer’s customer portal, or confirm with the issuer through its official contact details. Our guide to verifying a document’s authenticity puts these checks into a complete method, and our pages on the invoice and the bank statement apply them to real cases.

Going beyond properties

Our free tool shows facts, with no verdict. To check documents in volume, Docusan, a French document fraud detection service, analyzes the file at several levels, including its metadata and structure: edits, annotations, recovery of previous versions. It gives a verdict, No detection, Warning or Alert, and locates the anomalies on the document. The decision always stays with your teams.

Docusan does not contact the issuer or government databases: it complements the checks above and does not replace them. You can use it from the platform or integrate it into your tools with its API, and your documents are never used to train our models (security and privacy).