Security
How banks, HR teams and landlords can check a signed PDF before accepting it
Check every signed PDF in the same four steps: confirm whether it has a digital signature or only a picture of one; if digital, confirm it is intact and nothing was added after signing; check who issued the signer's certificate; then confirm the contents with the issuing organisation through a channel you found yourself. Save a verification report with the file so the check can be shown later.
Loan officers, HR teams, letting agents, landlords, procurement staff and university admissions all see the same thing every day: PDFs that are supposed to be official: bank statements, pay slips, employment letters, references, certificates, invoices, guarantees. Some are digitally signed. Many are not. A few are forged.
This is a routine you can apply to every document, whoever you are, in a few minutes.
The short answer: four checks
- What kind of signature is it? Digital (certificate-based) or a picture?
- If digital: is it intact, and was anything added after signing?
- Who issued the signer's certificate? Does it fit the organisation?
- Does the issuing organisation confirm the contents? Through a channel you found yourself.
Then record what you checked.
Check 1: digital signature or picture?
Upload the file to Verify PDF Signature. It lists every digital signature, or tells you there are none, and points out signature images, drawings, stamps and unsigned signature fields, with the page they are on.
- Digital signature present: go to Check 2.
- None found: the visible signature is a picture. That is normal for many documents (plenty of genuine pay slips and letters are signed this way) but it cannot prove the content is unchanged. Go straight to Check 4, and weight it more heavily.
Check 2: intact, and nothing added?
For each signature, read the verdict line:
- Unchanged since [name] signed it: good.
- …Only permitted additions were made afterwards: later signatures or form entries the document allowed. Usually fine.
- Signed by [name], but the file was changed after signing: read the list of changes. An added text box over a salary figure or an account number is exactly what a forger does. Use Compare the changed pages.
- This signature is broken: the content changed after signing. Do not accept it as it stands.
A tip for teams: insist on the file exactly as the applicant received it. Ask them not to merge, compress, "print to PDF" or combine documents before sending. Those steps strip digital signatures, turning a verifiable document into an unverifiable one.
Check 3: who issued the certificate?
Open Certificate details:
- Issued to: name, organisation, country. Does it match the bank, employer or institution?
- Issued by: the authority vouching for them. Is it one you would expect for that organisation or country?
- Certificate chain and Trust: does it chain to a recognised root? Not trusted is common for company and some national certificates, so it is a prompt to look closer, not an automatic rejection.
- Self-signed: the signer vouches for themselves. For an official document from a large organisation, that is a red flag.
- Revocation: Revoked is a red flag.
For organisations you deal with often (a big employer, a university, a bank) keep a note of the certificate details (issuer and SHA-256 fingerprint) from a document you have confirmed as genuine. Next time, comparing is instant.
Check 4: confirm with the source
No file check replaces confirmation from the issuer, especially for documents without a digital signature:
- Many official documents carry a QR code or verification code that is checked on the issuer's own website. Scan or enter it, but check the web address that opens is really the issuer's, because forgers print QR codes too.
- Call or email the issuer using contact details you looked up yourself, never those printed on the document.
- For bank statements, many lenders prefer to get transaction data directly from the bank through the applicant's consent rather than rely on a PDF at all. Where that is available, it is stronger than any document check.
- For employment, confirm with the employer's HR department directly, not with the "manager" named on the letter.
Check 5: record what you did
Download report (PDF) in Verify PDF Signature saves every signature's result, every check, any changes after signing and the certificate details, with the file's name, size and SHA-256 fingerprint. Store it with the document. If the decision is ever questioned, you can show exactly what the file proved at the time and that the report refers to that exact file.
A note on privacy: files you check are processed to produce the result and not kept. Still, follow your organisation's own rules for personal data. Some teams must use only approved tools for applicants' documents.
Quick reference by document type
| Document | Commonly digitally signed? | Best extra check |
|---|---|---|
| Bank statement | Sometimes, depending on the bank | Direct bank data or bank confirmation |
| Pay slip | Rarely | Employer HR or payroll confirmation |
| Employment / offer letter | Sometimes | Employer HR, via its public switchboard |
| Government certificate | Often, varies by country | The issuing office's verification service |
| University degree / transcript | Increasingly | The university's verification service |
| Invoice | Varies; e-invoices often use QR or platform checks | Supplier confirmation, by a known phone number |
| Signed contract (DocuSign etc.) | Platform seal on the final file | Certificate of Completion / audit report |
When to ask for more
- The file was clearly re-saved (no signature where you expected one).
- Changes after signing that the sender cannot explain.
- A self-signed or unexpected certificate on a document from a major institution.
- A verification code that leads to a site that isn't the issuer's.
- Anything involving a change of payment details.
Common questions
How can I check whether a bank statement PDF is genuine?
If it has a digital signature, check it is intact, that nothing was added after signing, and that the certificate belongs to the bank. Whether or not it is signed, the strongest confirmation comes directly from the bank, through the applicant's consent to share data, or a call to a number you looked up yourself.
An applicant's documents have no digital signature. Should I reject them?
Not automatically: many genuine documents are signed with a picture. It just means the file cannot prove it is unchanged, so rely more on confirmation from the issuer.
Why do applicants' signed PDFs lose their signatures?
Because they merge, compress, print to PDF or combine documents before sending. Those steps rebuild the file and strip the digital signature. Ask for each document exactly as it was downloaded from the issuer.
How do I keep a record of the check?
Download the verification report. It includes each signature's result, any changes after signing, the certificate details and the file's SHA-256 fingerprint, so it can be tied to that exact file later.
The certificate says “Not trusted”. Should I reject the document?
No. That often only means the issuer is not on the checker's list, which is common for company and some national authorities. Check who the issuer is and whether it fits the organisation, and confirm with the source.