How to tell whether a bank statement PDF was edited
Five checks that catch crude edits to a bank statement PDF in minutes, without uploading it anywhere, and what to do when one fails.
By Brayan Pedraza6 min read
In short
You cannot prove it from the file alone, but five checks catch most crude edits in a few minutes: compare the file's SHA-256 fingerprint with one from the sender, look at which program saved it and when it was modified, count how many times changes were appended to it, check the statement's own arithmetic (opening balance plus deposits minus withdrawals, and the running balance row by row), and look for figures typed in a different font. Any of them is a reason to get the statement straight from the bank, not proof of fraud.
Why this matters now
A business loan or a KYB review often rests on a PDF the applicant uploaded. Editing a PDF takes a free online tool and a few minutes, and the edited file looks the same on screen. The checks below need no special software and, done in the browser, the statement never leaves your machine.
1. Is it the same file you were sent?
A SHA-256 fingerprint changes if a single byte of the file changes. If the sender (or a bank portal, or your own earlier copy) gives you a fingerprint, compare it with the file in front of you. Equal means byte-for-byte the same file. It does not mean genuine: it says nothing about who made it.
You can compute it in the browser at Did this PDF change?, or in a terminal with shasum -a 256 statement.pdf.
2. Which program saved it, and when?
Every PDF carries a Producer and usually Creator, creation and modification dates. Bank statements typically come from the bank's own reporting system. A statement saved by a word processor, a design tool or an online PDF editor, or modified weeks after it was created, deserves a second look.
This is a weak signal on its own: some banks do use common PDF libraries, and opening and re-saving a file in a viewer changes the producer too.
3. Were changes appended to it?
Many editors save changes by appending a new section to the end of the PDF instead of rewriting it, so the old content stays inside the file. A statement that was saved more than once after it was generated is worth asking about. Two exceptions: files optimized for the web carry an extra end marker by design, and a digital signature adds one revision.
4. Does the statement add up?
The fastest check is the one nobody bothers to do:
- Opening balance + deposits − withdrawals should equal the closing balance.
- In the transactions table, each row's change in balance should equal that row's amount. An edited balance on one row breaks the chain on that row and the next.
- Deposits should be plausible against the revenue on the tax return. A statement showing twice the business's declared revenue needs an explanation.
5. Is any figure in a different font?
When someone types a new number over an old one, the new figure often uses a font that no other figure in the document uses. A bold total does the same, so this is a reason to look, not a conclusion.
What to do when a check fails
Ask for the statement through a channel the applicant does not control: a direct download from the bank portal during a call, a bank verification letter, or a read-only connection to the account through your bank-data provider. Do not accuse anyone on the basis of metadata.
Doing it for a whole package
Checking one PDF by hand is fine. Checking a formation document, a W-9, three statements and a tax return for every application is where the time goes. The package review in Sırdaş (coming in version 0.5.0) runs checks 2 to 5 across all documents on your machine, plus legal name and EIN consistency, and cites the file, page and line for each finding. It prepares the review; it does not approve or score anyone.