Authenticity signals

Every read document carries authenticity: what the file's own history and its figures say about whether it was altered. Each signal is a reason to look at the file. None of them proves fraud.

A high-risk document

"authenticity": {
  "risk": "high",
  "signals": [
    { "code": "edited_with_software", "message": "The PDF was last written by Adobe Acrobat Pro, not by the bank's statement system." },
    { "code": "modified_after_creation", "message": "The PDF was modified 9 days after it was created." },
    { "code": "balances_do_not_reconcile", "message": "The printed balances do not follow from the transactions (difference 150.00)." }
  ],
  "producer": "Adobe Acrobat Pro 2024",
  "createdAt": "2026-04-01T06:02:11.000Z",
  "modifiedAt": "2026-04-10T19:44:03.000Z"
}

Signals#

Code	Means	Also happens when
`edited_with_software`	The PDF was last written by a PDF editor or a document authoring program, such as Acrobat Pro, Word or an online PDF tool.	Somebody merged two statements into one file, compressed it, or added a note. Saving a statement through the browser's print dialog is not flagged.
`modified_after_creation`	The PDF records a save more than a minute after it was created.	The file was annotated or signed after download.
`balances_do_not_reconcile`	The printed balances do not follow from the transactions, by more than 1.00 and more than 0.5% of what the balance moved.	A row was misread. `verification.issues` says what did not add up.
`duplicate_file`	Your account was sent this exact file before. The message names the earlier document.	The same applicant resubmitted, or your system retried with a new idempotency key.
`image_only`	The file was read from page images: a scan or a photo. There is no text layer to check, so an edit leaves fewer traces.	Almost always. A scan is a normal way to send a statement.

Exports have no file history, so they never carry edited_with_software or modified_after_creation, and their producer and dates are null.

Risk#

`risk`	When
`high`	The file's history (`edited_with_software` or `modified_after_creation`) and its figures (`balances_do_not_reconcile`) both point at an edit.
`medium`	One of the two does.
`low`	Neither does. A document whose only signals are `duplicate_file` or `image_only` is `low`.

Using it#

`high`: put the file in front of a person before relying on it. Open the PDF and compare the rows the balances do not explain.
`medium`: look at the file when the decision matters. Read the signal's message to see which one fired.
`low`: proceed on the figures, after checking verification.reconciled.
`duplicate_file`: check the earlier document it names. One statement on two applications is worth a call.
Never decline automatically on signals alone. Show the message of each signal to the reviewer and let them decide.

File details#

Field	Holds
`producer`	The program the PDF says made it. A bank's statement system usually names itself; compare it with `issuer.name`.
`createdAt`	When the PDF says it was created. ISO 8601.
`modifiedAt`	When the PDF says it was last saved. ISO 8601.

All three are what the file records about itself, and a determined forger can rewrite them. A clean record means nothing was found.

Testing#

Send X-Test-Scenario: suspicious with a test key for a document with risk: "high" and three signals. See Test mode.

Something wrong or missing on this page? [email protected]