# How to tell whether a bank statement PDF was edited

**Short answer.** You cannot prove it from the file alone, but five checks catch
most crude edits in a few minutes: compare the file's SHA-256 fingerprint with
one from the sender, look at which program saved it and when it was modified,
count how many times changes were appended to it, check the statement's own
arithmetic (opening balance plus deposits minus withdrawals, and the running
balance row by row), and look for figures typed in a different font. Any of
them is a reason to get the statement straight from the bank, not proof of
fraud.

---

## Why this matters now

A business loan or a KYB review often rests on a PDF the applicant uploaded.
Editing a PDF takes a free online tool and a few minutes, and the edited file
looks the same on screen. The checks below need no special software and,
done in the browser, the statement never leaves your machine.

## 1. Is it the same file you were sent?

A SHA-256 fingerprint changes if a single byte of the file changes. If the
sender (or a bank portal, or your own earlier copy) gives you a fingerprint,
compare it with the file in front of you. Equal means byte-for-byte the same
file. It does not mean genuine: it says nothing about who made it.

You can compute it in the browser at [Did this PDF change?](/en/verify/), or in
a terminal with `shasum -a 256 statement.pdf`.

## 2. Which program saved it, and when?

Every PDF carries a *Producer* and usually *Creator*, creation and modification
dates. Bank statements typically come from the bank's own reporting system.
A statement saved by a word processor, a design tool or an online PDF editor,
or modified weeks after it was created, deserves a second look.

This is a weak signal on its own: some banks do use common PDF libraries, and
opening and re-saving a file in a viewer changes the producer too.

## 3. Were changes appended to it?

Many editors save changes by appending a new section to the end of the PDF
instead of rewriting it, so the old content stays inside the file. A statement
that was saved more than once after it was generated is worth asking about. Two
exceptions: files optimized for the web carry an extra end marker by design, and
a digital signature adds one revision.

## 4. Does the statement add up?

The fastest check is the one nobody bothers to do:

- Opening balance + deposits − withdrawals should equal the closing balance.
- In the transactions table, each row's change in balance should equal that
  row's amount. An edited balance on one row breaks the chain on that row and
  the next.
- Deposits should be plausible against the revenue on the tax return. A
  statement showing twice the business's declared revenue needs an explanation.

## 5. Is any figure in a different font?

When someone types a new number over an old one, the new figure often uses a
font that no other figure in the document uses. A bold total does the same,
so this is a reason to look, not a conclusion.

## What to do when a check fails

Ask for the statement through a channel the applicant does not control: a
direct download from the bank portal during a call, a bank verification
letter, or a read-only connection to the account through your bank-data
provider. Do not accuse anyone on the basis of metadata.

## Doing it for a whole package

Checking one PDF by hand is fine. Checking a formation document, a W-9, three
statements and a tax return for every application is where the time goes. The
package review in Sırdaş (coming in version 0.5.0) runs checks 2 to 5 across all
documents on your machine, plus legal name and EIN consistency, and cites the
file, page and line for each finding. It prepares the review; it does not
approve or score anyone.