SUSPICIOUS

statement_signed_then_edited.pdf

statement 1 page(s) PDF evidence score 0.99 (not a probability) sha256 ae00f4cc948c9767…

High-severity evidence of tampering (TL-LOGIC-001, TL-REV-002, TL-SIG-002).

Where

page 1

Findings (9)

#1 high TL-SIG-002 Changes after signing are not permitted whole file · structure · confidence 0.90

The document was changed after 'IssuerSignature' signed it, and the changes are not of a kind a signature permits (form filling, annotations or validation data).

Evidence

{
  "coverage": "ENTIRE_REVISION",
  "docmdp_ok": false,
  "field": "IssuerSignature",
  "modification_level": "OTHER"
}

#2 high TL-LOGIC-001 Running balance does not reconcile page 1 · logic · confidence 0.90

Row 5 on page 1: previous balance 15,931.14 - debit 1,250.00 + credit 0.00 = 14,681.14, but the statement shows 9,610.39 (difference -5,070.75).

Evidence

{
  "credit": 0.0,
  "debit": 1250.0,
  "expected": 14681.14,
  "previous": 15931.14,
  "row": 5,
  "stated": 9610.39
}

#3 high TL-REV-002 Later revision rewrote page content page 1 · revision 3 · structure · confidence 0.90

Revision 3 replaced the drawing instructions of page 1, which already existed in revision 2. The visible content of this page was changed after the file was first produced.

Evidence

{
  "previous_revision": 2
}

#4 medium TL-FONT-002 Font used only for a few characters page 1 · content · confidence 0.90

On page 1, the font ArialMT is used for only 8 characters, almost all digits (1,250.00), while the rest of the page uses other fonts. Numbers typed in afterwards often look like this.

Evidence

{
  "characters": 8,
  "font": "ArialMT",
  "values": [
    "1,250.00"
  ]
}

#5 medium TL-OVL-001 Filled shape covers text page 1 · content · confidence 0.85

On page 1, the text '6,320.75' is covered by a filled shape, and '1,250.00' is drawn on top of it.

Evidence

{
  "hidden_by": "shape",
  "hidden_text": "6,320.75",
  "visible_text": "1,250.00"
}

#6 medium TL-GEO-002 Inconsistent typeface or size in a column of values page 1 · geometry · confidence 0.75

On page 1, the value '1,250.00' is set in ArialMT while 3 other values in its column use BitstreamVeraSans-Roman, the font of the rest of the page.

Evidence

{
  "column_font": "bitstreamverasans",
  "font": "ArialMT",
  "text": "1,250.00"
}

#7 medium TL-REV-003 Later revision added fonts to an existing page page 1 · revision 3 · structure · confidence 0.65

Revision 3 added font(s) ArialMT to page 1.

Evidence

{
  "added_fonts": [
    "ArialMT"
  ],
  "same_typeface": false
}

#8 low TL-META-004 Producer changed between revisions whole file · revision 2 · structure · confidence 0.50

Revision 1 was written by 'ReportLab PDF Library - (opensource)' and revision 2 by 'ReportLab PDF Library - (opensource); pyHanko 0.37.0'.

Evidence

{
  "after": "ReportLab PDF Library - (opensource); pyHanko 0.37.0",
  "before": "ReportLab PDF Library - (opensource)"
}

#9 info TL-REV-001 Document has incremental updates whole file · structure · confidence 0.95

The file contains 3 revisions: it was saved 2 more time(s) after it was first written.

Evidence

{
  "linearized": false,
  "revisions": 3
}

Checks

Detector	Layer	Status	Findings / reason
signatures	structure	ran	1
revisions	structure	ran	3
metadata	structure	ran	1
edit-markers	content	ran	0
fonts	content	ran	1
overlays	content	ran	1
alignment	geometry	ran	1
statement-logic	logic	ran	1
invoice-logic	logic	skipped	document type is statement, not an invoice
identifiers	logic	ran	0
jpeg-grid	image	skipped	no raster images to analyse
copy-move	image	skipped	no raster images to analyse

Read this before acting

Findings are evidence for a human reviewer, not proof of fraud.
A document rebuilt from scratch in the issuer's own software leaves few structural traces.
Edits made before the PDF was generated (for example in a spreadsheet) cannot be detected from the file structure.

Generated by tamperlint 0.1.0.dev0 on 2026-09-28 06:47 UTC. Report schema 1.0. Findings are evidence for a human reviewer, not proof of fraud.