Learn

How to verify a bank statement PDF

A bank statement is the most commonly altered document in lending, leasing, and business onboarding, because it's the document money decisions lean on. The alterations are usually small: an inflated balance, a deleted overdraft, a renamed transaction. Visually they're undetectable. At the file level they're often obvious, because banks produce PDFs in a very particular way and editors don't.

What a genuine bank statement file looks like

Banks generate statements in bulk through document platforms. The files come out with a consistent producer fingerprint, a creation date in a tight window after the statement period closes, no incremental updates, and increasingly, a digital signature from the institution. Every statement from the same bank for the same period tends to look identical at the byte level, because the same system produced millions of them.

That consistency is your lever. An altered statement has to break it somewhere: an editor or converter in the producer field, a creation date that doesn't match the statement cycle, edit layers stacked on the file, or a signature that's missing where the bank normally signs, or present but no longer covering the whole file.

The checks, in order

First, the signature. If the bank signs its statements, verification is close to decisive: valid and covering the whole file means the content is exactly what the bank produced; valid but with content added afterward means someone changed the file after the bank made it. Second, the producer chain: a money document whose bytes say online PDF editor did not come to you straight from a bank. Third, the dates: statement periods close on a schedule, and genuine files are created on that schedule, not the night before an application. Fourth, the content itself: running balances must arithmetic correctly from line to line, and template fakes often fail this the same way fake pay stubs fail their math.

The source check beats everything

For any decision that matters, the strongest verification isn't forensic at all: have the applicant grant read access through their bank's sharing feature, use an account-data service, or watch them log into the portal. File forensics is the fast first screen that tells you when the source check is worth insisting on. The two together are very hard to beat.

FAQ

My applicant says they downloaded the statement twice and that changed the file. True?

Downloading doesn't alter a PDF's internal records. Two downloads of the same statement from the same portal produce byte-identical files. If two copies of the same statement differ internally, they did not both come from the portal.

The statement is a scan. What now?

A scan carries no bank fingerprint, so the file can't support the document's claim at all. Treat scanned statements as unverified and require portal access or direct delivery.

Do all banks digitally sign statements?

Not yet, though the practice is spreading. Absence of a signature isn't suspicious by itself. Presence of a broken one, or of content added after signing, is always worth your attention.