# Edited PDF Bank Statement? Metadata and Layer Checks

- Author: PreciseBankFlow (https://www.precisebankflow.com)
- Published: 2025-05-20
- Updated: 2025-05-20
- Category: Fraud and forensic review
- Canonical: https://www.precisebankflow.com/blog/edited-pdf-bank-statement

> How to tell if you have an edited PDF bank statement: metadata, fonts, text layers, object counts and the arithmetic that exposes a changed number.
An edited PDF bank statement usually gives itself away in the file, not on the page. Check the producer and modification date, count the appended saves, compare the embedded fonts with the digits you see, and recompute every balance the changed number feeds. One odd result is a question. Several together justify asking the bank for its own copy.

## What does editing a PDF bank statement change inside the file?

An edit to a PDF bank statement changes more than the visible digits. The editor rewrites or adds text objects, may embed a new font subset, updates the document information fields and, in many tools, appends a new section to the end of the file. Each of those leaves a trace you can read with free tools.

A PDF is a container of numbered objects: pages, fonts, text streams, images and a table that says where each object sits. A bank's statement server writes all of these in one pass, so a genuine download tends to be tidy. Someone who opens that file later in a desktop editor and changes one amount triggers a second write by a different program. That second program has its own habits, and those habits are what you are looking for.

Work only on a copy. Before you open the file in anything, save the original exactly as it arrived, with the email or upload record that delivered it. Some viewers resave a file quietly when you add a comment or rotate a page, and that would plant the very traces you are trying to read.

## Reading the producer and date fields of a bank statement PDF

The document information fields are the first place to look, because they record which software wrote the file and when. The PDF standard defines Creator as the program that made the original document, Producer as the program that converted it to PDF, and CreationDate and ModDate as the creation and last-modified times.

Those definitions come from the [ISO 32000-1 PDF specification published by Adobe](https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandards/PDF32000_2008.pdf), in its table of document information entries. Every field there is optional, which matters later: absence proves nothing.

Read the fields with your viewer's document properties panel, or on the command line with `pdfinfo statement.pdf` from the free Poppler tools. Then ask three questions:

1. **Does the producer look like a bank system?** Statement servers usually name a reporting engine or a server-side PDF library. A consumer editor, a word processor or an online "edit PDF" site in the Producer field means the file passed through that program.
2. **Do the dates fit the statement period?** A statement for March cannot have been created before March ended. A creation date weeks after the period end is normal for a download made later, but it should match when the person says they downloaded it.
3. **Is there a gap between creation and modification?** A ModDate minutes, hours or days after CreationDate says something saved the file again after the bank produced it.

Metadata can be wiped or typed in by hand, so treat a clean result as neutral. A suspicious result, though, is specific and easy to put in front of the person who supplied the file.

## Incremental saves and object counts in an edited statement file

An incremental save is the strongest file-level sign that a statement was changed after it was produced. The PDF standard lets a program save changes by appending them to the end of the file and leaving the original bytes intact. Each appended update ends with its own end-of-file marker, written `%%EOF`.

The same ISO 32000-1 section on incremental updates says a file updated several times contains several trailers, and that it can hold more than one copy of an object with the same number. In plain terms, an edited statement may still contain the bank's original text stream, with a newer replacement stacked after it.

### Counting the saves

You can count end-of-file markers without special software:

- On macOS or Linux, `grep -c "%%EOF" statement.pdf` prints how many there are.
- On Windows, open the file in a plain-text editor such as Notepad and search for `%%EOF`.

One marker is what a single-pass bank download normally shows. Two or more means the file was saved again at least once. Some statement systems do write a second section on purpose, so a count of two is a reason to look closer, not a verdict.

### Counting the objects

Object counts help when you hold two statements from the same bank. Run the free `qpdf --show-xref` command on each one, count the objects it lists, and compare the totals for a similar page count. A statement with a dozen extra font or text objects, or with objects marked as replaced, has had something added. If you can recover the earlier revision by truncating the file at the first `%%EOF` and opening that copy, the original figures are sometimes still there to read.

## Do the fonts and text layer of the statement PDF agree?

The fonts and text layer agree on a genuine statement: every amount uses the same embedded font, and the text you extract matches the digits on the page. An edit often breaks one of these. A pasted amount may bring its own font subset, or the visible digits may sit in a layer that extraction does not see.

Run `pdffonts statement.pdf` to list the embedded fonts. A typical statement uses two to four, in a few subsets with random-looking prefixes. Watch for a font that appears on only one page, a second copy of the bank's numeric font with a different subset prefix, or a system font such as Arial or Calibri that the rest of the document never uses.

Then extract the text with `pdftotext -layout statement.pdf out.txt` and compare it, line by line, with what you see. Three results deserve attention:

- **Extracted text differs from the screen.** If the page shows 8,450.00 and the text layer reads 3,450.00, a white box or image now covers the original number.
- **An amount extracts on its own line.** Bank statements are written row by row. A figure that extracts separately, or out of order, was probably added as its own object.
- **A page has no text at all.** An image-only page hides every edit trace. Ask for the bank's digital download rather than accepting a picture of one.

Checks printed on the statement as images are a separate problem, because the image can be altered without touching any text. Reviewing them is covered in [what to look for in altered check images](/blog/altered-check-images).

## The arithmetic that exposes one changed statement amount

Arithmetic catches a changed amount even when the file looks clean, because one figure on a statement feeds several others. Raise a deposit and the running balance on every later line, the deposit total in the summary box and the closing balance all have to move with it. Forgers often fix one of these and miss another.

Here is an example. The figures are invented for illustration. The supplier of the statement says the March 9 deposit was 8,450.00.

| Date | Description | Amount | Printed balance | Recomputed balance |
| --- | --- | --- | --- | --- |
| Mar 1 | Opening balance | | 12,310.44 | 12,310.44 |
| Mar 4 | Card settlement | +2,118.60 | 14,429.04 | 14,429.04 |
| Mar 9 | Customer deposit | +8,450.00 | 17,879.04 | 22,879.04 |
| Mar 12 | Supplier payment | -4,906.15 | 12,972.89 | 17,972.89 |
| Mar 31 | Closing balance | | 12,972.89 | 17,972.89 |

The printed balances move by 3,450.00 on March 9, not 8,450.00. Every balance after that line agrees with a deposit of 3,450.00. Someone changed one digit in the amount column and left the balance column alone. The difference, 5,000.00 exactly, is a round figure, which is also typical of a hand edit.

Check the summary box the same way. Add the credits yourself and compare them with the printed total. Then compare this statement's opening balance with the prior month's closing balance, because a forger who adjusts the closing figure has to adjust next month's opening figure too, and usually works on one file at a time.

PreciseBankFlow foots each statement from its opening balance to the printed closing balance, so the example above would be marked out of balance by 5,000.00 rather than adjusted to fit. It does not read PDF metadata or judge whether a file was forged; the checks above stay yours.

## When an edited-looking statement PDF is still the bank's file

Some genuine statements carry the same signs as an edited one. Before you call a file altered, rule out the ordinary ways a real bank download gets a second save, a new producer or an extra font. One innocent explanation that fits the facts is enough to stop treating a single sign as proof.

### Innocent causes worth ruling out

- **Printing to PDF.** A person who opens the bank's file and prints it to a new PDF produces a fresh file whose Producer is their printer driver. The content may be untouched. Ask for the original download.
- **Signing or annotating.** Adding a signature, a highlight or a sticky note appends an update and adds a `%%EOF` marker without changing a single amount.
- **Optimizing or compressing.** "Reduce file size" tools rewrite the whole file, swap the producer and may re-subset fonts.
- **Combining files.** Merging several months into one PDF creates a new file with new metadata.
- **The bank's own resave.** Some banks stamp or watermark a statement when it is downloaded, which shows up as a second section.

Each of these explains file traces. None explains a running balance that fails, which is why the arithmetic test carries more weight than any single metadata reading.

## What to do with a statement PDF that fails the file checks?

A statement PDF that fails the file checks should not be relied on until the bank confirms it. Keep the file exactly as received, record what each test showed, and obtain the same statement from the bank through a route the supplier does not control. Do not accuse anyone on the strength of metadata alone.

Work in this order:

1. **Preserve.** Keep the original file, the message that delivered it, and a note of when and how it arrived. Work on a copy for every test.
2. **Record.** Write down each check, the tool, the reading and the time, in a log like the example below. The record is what lets someone else repeat your work.
3. **Ask a neutral question.** Ask the supplier how they obtained the file and whether they changed, printed or combined it. Their answer either explains the traces or does not.
4. **Go to the source.** Get the statement directly from the bank, as described in [how to verify a bank statement with the bank](/blog/verify-a-bank-statement-with-the-bank). Compare the bank's version with yours line by line.
5. **Decide what to rely on.** Use the bank's version for the work. Keep the altered one as evidence of what was submitted.

### Example check log for one statement file

The log below is an example, with invented readings, of how one reviewer recorded the checks on a statement received by email. It shows how readings are weighed together rather than one at a time.

| Check | Tool | Reading on the example file | What it means |
| --- | --- | --- | --- |
| Producer and creator | pdfinfo | Producer names a desktop PDF editor | File passed through an editor after download |
| Created and modified | pdfinfo | Modified two days after created | Saved again after the bank wrote it |
| End-of-file markers | grep or text editor | 2 | One appended update |
| Embedded fonts | pdffonts | Bank numeric font in two subsets, one only on page 2 | A new font subset arrived with the edit |
| Text layer | pdftotext | Page 2 deposit reads 3,450.00, screen shows 8,450.00 | Visible amount covers the original |
| Running balance | Recalculation | Breaks by 5,000.00 on March 9 | Amount column changed, balances did not |
| Conclusion | Reviewer | Six signs agree | Obtain the statement from the bank before relying on it |

Context changes the stakes. A law firm checking a client's statement against its trust ledger has record-keeping duties of its own, set out in [trust account record keeping requirements](/blog/trust-account-record-keeping). A forensic engagement will need the whole chain of files preserved, and choosing tools that keep that trail is covered in [what forensic accounting software should prove](/blog/forensic-accounting-software).

To have the footing check done on a batch of statements before you start the file tests, [request a place in the early group](/get-started).