Learn

What to do when you suspect a document was altered

The suspicion usually starts small: a number that doesn't fit, a date that contradicts an email, formatting that shifts mid-page, or a story that changed between versions. What you do in the next hour matters more than whether your suspicion turns out to be right, because the wrong moves, confronting early, editing the file, or losing the original, cost you either the evidence or the relationship.

First: preserve, don't react

Keep the file exactly as you received it. Don't open it in an editor, don't re-save it, don't print it to a new PDF; every one of those actions overwrites the records that an examination reads. If it arrived by email, keep the email too, the message is independent evidence of when and from whom the file came. Make a copy for any checking you do and leave the received file untouched.

Say nothing accusatory yet. Most document anomalies have innocent explanations, a converter at the sender's office, a portal that re-stamps dates, a scan of a legitimate original. Your goal in this phase is evidence, not confrontation.

Second: read what the file says about itself

A document's file records tell their own story: what software created it, when, whether it was changed after creation or after signing, and how many editing passes it carries. Check the suspicious file and, if you have one, an earlier or parallel version; comparing two versions can establish which came first and exactly what changed between them. Write down what the records show alongside what the document claims, the contradiction, if there is one, is your finding.

Know what this can and cannot tell you. Records that contradict the document's story are strong evidence something happened to the file. Clean records are support, not proof, careful editing can preserve them. Either way you now have specifics instead of a feeling.

Third: request the original from the source

The decisive move is almost always the same: ask for the document from its origin, not from the person who handed it to you. The bank's portal, the payroll system, the issuing agency, the counterparty's records. Frame it neutrally, "for my records, I need the version directly from the source", which lets honest senders comply easily and puts pressure exactly where it belongs otherwise. A refusal to produce a source original after a flagged file is itself information.

Fourth: escalate proportionally

If money, housing, employment, or legal exposure rides on the document, bring in the right professional with your evidence organized: the received file, the file-record findings, the source-verification outcome, and the timeline. That might be a lawyer, your bank's specialist, an insurer's investigator, or law enforcement. Hand them evidence, not conclusions; a clear file trail shortens everything that follows.

FAQ

Should I confront the person who sent the document?

Not before you've preserved the file, checked its records, and requested a source original. Early confrontation warns them while your evidence is weakest, and it burns the relationship in the cases where the anomaly was innocent.

Does checking a file alter it?

Reading a file's records does not change them when done properly; the check analyzes a copy in memory. What alters records is opening the document in an editor and re-saving it, which is why you work from copies and keep the received file untouched.

What if the records come back clean but I still have doubts?

Clean records lower the odds of crude editing but don't prove the document's story; move to source verification, which doesn't depend on the file at all. The document the source produces either matches what you were given or it doesn't, and that answer is decisive either way.