# Authenticity signals

> The signs of an edited or resent statement on every document, what each one means, and how to act on risk.

Section: Guides
Source: https://statementbear.com/docs/authenticity
Product: StatementBear statement parsing API, $0.08 per page, 200 pages free.

---

Every read document carries `authenticity`: what the file's own history and its figures say about whether it was altered. Each signal is a reason to look at the file. None of them proves fraud.

A high-risk document:

```json
"authenticity": {
  "risk": "high",
  "signals": [
    { "code": "edited_with_software", "message": "The PDF was last written by Adobe Acrobat Pro, not by the bank's statement system." },
    { "code": "modified_after_creation", "message": "The PDF was modified 9 days after it was created." },
    { "code": "balances_do_not_reconcile", "message": "The printed balances do not follow from the transactions (difference 150.00)." }
  ],
  "producer": "Adobe Acrobat Pro 2024",
  "createdAt": "2026-04-01T06:02:11.000Z",
  "modifiedAt": "2026-04-10T19:44:03.000Z"
}
```

## Signals

| Code | Means | Also happens when |
| --- | --- | --- |
| `edited_with_software` | The PDF was last written by a PDF editor or a document authoring program, such as Acrobat Pro, Word or an online PDF tool. | Somebody merged two statements into one file, compressed it, or added a note. Saving a statement through the browser's print dialog is not flagged. |
| `modified_after_creation` | The PDF records a save more than a minute after it was created. | The file was annotated or signed after download. |
| `balances_do_not_reconcile` | The printed balances do not follow from the transactions, by more than 1.00 and more than 0.5% of what the balance moved. | A row was misread. `verification.issues` says what did not add up. |
| `duplicate_file` | Your account was sent this exact file before. The message names the earlier document. | The same applicant resubmitted, or your system retried with a new idempotency key. |
| `image_only` | The file was read from page images: a scan or a photo. There is no text layer to check, so an edit leaves fewer traces. | Almost always. A scan is a normal way to send a statement. |

Exports have no file history, so they never carry `edited_with_software` or `modified_after_creation`, and their `producer` and dates are null.

## Risk

| `risk` | When |
| --- | --- |
| `high` | The file's history (`edited_with_software` or `modified_after_creation`) and its figures (`balances_do_not_reconcile`) both point at an edit. |
| `medium` | One of the two does. |
| `low` | Neither does. A document whose only signals are `duplicate_file` or `image_only` is `low`. |

## Using it

- **`high`**: put the file in front of a person before relying on it. Open the PDF and compare the rows the balances do not explain.
- **`medium`**: look at the file when the decision matters. Read the signal's `message` to see which one fired.
- **`low`**: proceed on the figures, after checking `verification.reconciled`.
- **`duplicate_file`**: check the earlier document it names. One statement on two applications is worth a call.
- **Never decline automatically on signals alone.** Show the `message` of each signal to the reviewer and let them decide.

## File details

| Field | Holds |
| --- | --- |
| `producer` | The program the PDF says made it. A bank's statement system usually names itself; compare it with `issuer.name`. |
| `createdAt` | When the PDF says it was created. ISO 8601. |
| `modifiedAt` | When the PDF says it was last saved. ISO 8601. |

All three are what the file records about itself, and a determined forger can rewrite them. A clean record means nothing was found.

## Testing

Send `X-Test-Scenario: suspicious` with a test key for a document with `risk: "high"` and three signals. See [Test mode](https://statementbear.com/docs/test-mode).

---

All documentation: https://statementbear.com/docs/llms.txt
Questions: support@statementbear.com