Almost every forgery that reaches an employer or landlord fails a check that takes under a minute. The difficulty is knowing which minute to spend.
Start with the metadata
A PDF records how it was made, and forgers routinely forget this because it is not visible on the page.
Open document properties. A bank statement whose producer is a photo editor, a university transcript created three days ago rather than on its stated issue date, or a title showing a different person's name are all straightforward signals.
- Producer and Creator — image editors and generic PDF writers on documents that should come from an institutional system.
- Creation and modification dates — a modification date long after issue, or a creation date after the date printed on the page.
- Title and Author — often carry the original filename or a template name.
- Page count and size mismatches — one page produced differently from the rest.
Metadata is evidence, not proof, in both directions. It can be edited by anyone who thinks to, and it is routinely stripped or rewritten by entirely innocent processing — printing to PDF, compressing, or passing a file through a document management system. Odd metadata warrants a closer look; clean metadata proves nothing.
What to look at on the page
| Check | What a forgery often shows |
|---|---|
| Font consistency | One field in a slightly different face or weight |
| Baseline alignment | An amount or date sitting fractionally high or low |
| Character spacing | Uneven kerning where a number was replaced |
| Background patterns | A pattern interrupted behind altered text |
| Logo quality | A logo at lower resolution than the rest of the page |
| Arithmetic | Totals that do not sum, or balances that do not carry |
| Reference formats | An account or certificate number in the wrong format |
Arithmetic is the most productive check on financial documents and the most often skipped. Altering a single figure in a statement means correcting every running balance below it, and forgers frequently do not — which turns verification into addition rather than judgement.
Optical security features
Physical documents carry features designed to survive inspection and fail reproduction. They exist precisely because they cannot be copied by a scanner or a printer.
These are worth knowing because they are the reason a photocopy of a certificate proves very little, and why originals are demanded for anything consequential.
- Watermarks — pressed into the paper, visible against light, not printable.
- Microprinting — text too small to resolve, appearing as a line until magnified; a copier renders it as a smudge.
- Optically variable ink — changes colour with viewing angle. Cannot be scanned at all.
- Guilloche patterns — fine interwoven lines that alias badly when copied.
- Security threads and holograms — embedded in the substrate.
- UV features — invisible under normal light, fluorescing under ultraviolet.
- Intaglio printing — raised ink you can feel. Flat on any copy.
Two of these need no equipment: tilt the document under a light to check for optically variable ink, and run a finger over the printing to feel for intaglio. A copy of a document carrying either will be visibly and tangibly flat.
Official versus unofficial transcripts
A distinction that causes real confusion, because both are genuine and only one is accepted.
An official transcript is issued by the institution and transmitted in a way that establishes it came from them — a sealed envelope sent directly to the recipient, or a secure electronic delivery from the registrar or an approved clearinghouse. An unofficial transcript has the same academic content, downloaded by the student from a portal.
The difference is chain of custody, not content. An official transcript that the student opened, printed and re-sent has become unofficial — the seal is the point. This is also why "unlock this transcript so I can edit it" is a request nobody legitimate makes: the protection is what gives the document its value, and an employer verifying it will contact the institution regardless.
Verify at the source
Every visual check above narrows the question. None of them settles it. A capable forgery passes visual inspection, and a genuine document can look wrong after a poor scan or an odd reprint.
The only conclusive step is contacting the issuer — and doing it independently.
- Find the issuer's contact details yourself. Never use a phone number or link printed on the document being checked.
- Use the verification service if one exists — most universities, professional bodies and clearinghouses run one.
- Check the document reference against the issuer's records.
- For banks, ask the applicant for a statement delivered directly, or use open banking rather than a supplied file.
- Record what you checked and when, which matters if the decision is later questioned.
The first point is the one that gets skipped under time pressure, and it is the one that matters most. A forged document carrying a forged phone number is trivially easy to produce and will confirm itself enthusiastically.
Judgement, and fairness
Verification affects real people, and the error in the other direction has consequences too. Genuine documents look irregular for many innocent reasons: an old certificate in a discontinued format, a scan from a bad copier, a name legitimately changed, an institution that has since rebranded.
Treat an anomaly as a question to ask rather than a conclusion to reach. Ask the person about it; most discrepancies have an ordinary explanation and they can usually supply it in a sentence.
Where a decision genuinely turns on authenticity — employment, tenancy, credit, immigration — verify with the issuer and decide on that, rather than on an impression formed from a scan. That is fairer to the applicant and considerably more defensible if the decision is ever challenged.
Frequently asked questions
What is the fastest check on a suspicious PDF?
Open document properties and look at the Producer, Creator and dates. A bank statement produced by a photo editor, or a transcript created after its stated issue date, is an immediate signal. It is evidence rather than proof — metadata is easily edited and often innocently stripped.
What visual signs suggest a document has been altered?
Inconsistent fonts or weights in a single field, text sitting fractionally off the baseline, uneven character spacing, background patterns interrupted behind altered text, and a logo at lower resolution than the rest of the page. On financial documents, check that the arithmetic actually sums.
What is optical document security?
Physical features designed to fail reproduction — watermarks, microprinting, colour-shifting ink, guilloche patterns, security threads, UV features and raised intaglio printing. They are why a photocopy proves little and originals are demanded for consequential decisions.
Which security features can I check without equipment?
Tilt the document under a light to see whether optically variable ink shifts colour, and run a finger over the printing to feel raised intaglio. A copy will be visibly and tangibly flat in both cases.
What is the difference between an official and unofficial transcript?
Chain of custody, not content. An official transcript travels from the institution to the recipient in a way that proves its origin — a sealed envelope or secure electronic delivery. One a student downloaded, printed and forwarded is unofficial, even though the academic content is identical.
How do I verify a document conclusively?
Contact the issuer using contact details you find independently — never a number or link printed on the document itself, since a forged document can carry a forged phone number. Most universities, professional bodies and clearinghouses run verification services.
What if a genuine document looks irregular?
That happens often — old certificates in discontinued formats, poor scans, legitimate name changes, rebranded institutions. Treat an anomaly as a question to ask the person rather than a conclusion, and verify with the issuer before any decision that turns on it.