SUSPICIOUS

statement_edited.pdf

statement 1 page(s) PDF evidence score 0.96 (not a probability) sha256 89835027bb850796…

High-severity evidence of tampering (TL-LOGIC-001, TL-REV-002).

Where

page 1

Findings (8)

#1 high TL-LOGIC-001 Running balance does not reconcile page 1 · logic · confidence 0.90

Row 4 on page 1: previous balance 29,713.20 - debit 99,999.00 + credit 0.00 = -70,285.80, but the statement shows 15,931.14 (difference +86,216.94).

Evidence

{
  "credit": 0.0,
  "debit": 99999.0,
  "expected": -70285.8,
  "previous": 29713.2,
  "row": 4,
  "stated": 15931.14
}

#2 high TL-REV-002 Later revision rewrote page content page 1 · revision 2 · structure · confidence 0.90

Revision 2 replaced the drawing instructions of page 1, which already existed in revision 1. The visible content of this page was changed after the file was first produced.

Evidence

{
  "previous_revision": 1
}

#3 medium TL-FONT-002 Font used only for a few characters page 1 · content · confidence 0.90

On page 1, the font ArialMT is used for only 9 characters, almost all digits (99,999.00), while the rest of the page uses other fonts. Numbers typed in afterwards often look like this.

Evidence

{
  "characters": 9,
  "font": "ArialMT",
  "values": [
    "99,999.00"
  ]
}

#4 medium TL-OVL-001 Filled shape covers text page 1 · content · confidence 0.85

On page 1, the text '13,782.06' is covered by a filled shape, and '99,999.00' is drawn on top of it.

Evidence

{
  "hidden_by": "shape",
  "hidden_text": "13,782.06",
  "visible_text": "99,999.00"
}

#5 medium TL-GEO-002 Inconsistent typeface or size in a column of values page 1 · geometry · confidence 0.75

On page 1, the value '99,999.00' is set in ArialMT while 11 other values in its column use BitstreamVeraSans-Roman, the font of the rest of the page.

Evidence

{
  "column_font": "bitstreamverasans",
  "font": "ArialMT",
  "text": "99,999.00"
}

#6 medium TL-REV-003 Later revision added fonts to an existing page page 1 · revision 2 · structure · confidence 0.65

Revision 2 added font(s) ArialMT to page 1.

Evidence

{
  "added_fonts": [
    "ArialMT"
  ],
  "same_typeface": false
}

#7 low TL-META-004 Producer changed between revisions whole file · revision 2 · structure · confidence 0.50

Revision 1 was written by 'ReportLab PDF Library - (opensource)' and revision 2 by 'ReportLab PDF Library - (opensource); pyHanko 0.37.0'.

Evidence

{
  "after": "ReportLab PDF Library - (opensource); pyHanko 0.37.0",
  "before": "ReportLab PDF Library - (opensource)"
}

#8 info TL-REV-001 Document has incremental updates whole file · structure · confidence 0.95

The file contains 2 revisions: it was saved 1 more time(s) after it was first written.

Evidence

{
  "linearized": false,
  "revisions": 2
}

Checks

Detector	Layer	Status	Findings / reason
signatures	structure	skipped	document is not digitally signed
revisions	structure	ran	3
metadata	structure	ran	1
edit-markers	content	ran	0
fonts	content	ran	1
overlays	content	ran	1
alignment	geometry	ran	1
statement-logic	logic	ran	1
invoice-logic	logic	skipped	document type is statement, not an invoice
identifiers	logic	ran	0
jpeg-grid	image	skipped	no raster images to analyse
copy-move	image	skipped	no raster images to analyse

Read this before acting

Findings are evidence for a human reviewer, not proof of fraud.
A document rebuilt from scratch in the issuer's own software leaves few structural traces.
Edits made before the PDF was generated (for example in a spreadsheet) cannot be detected from the file structure.

Generated by tamperlint 0.1.0.dev0 on 2026-09-28 06:47 UTC. Report schema 1.0. Findings are evidence for a human reviewer, not proof of fraud.