Can a PDF be modified without detection?

Possibly, yes. No PDF checker can promise that every change to every file will be found. A result from HTPBE? is evidence about one file, not a guarantee about the document behind it. This page explains what a result does and does not claim, and what to do on top of it when the stakes are high.

What a result claims

• Modified means the analysis found evidence that the file was changed after it was created. It states a fact about the file, not about anyone’s intent. Many ordinary actions, such as re-saving or exporting, can also produce it.
• Intact means no evidence of modification was found in that file. It is not proof that the content is true, that the issuer produced it, or that nothing could have gone unnoticed.
• Inconclusive means the file comes from a source where integrity analysis does not apply, for example a scan or a screenshot. Such files are not certified as Intact, because any content can be put into them from the start.

What a result does not claim

• It does not read or judge the content, so it cannot tell whether the figures, names or dates are accurate.
• It does not tell you whether a document was invented from scratch. A file that was never altered after creation can still carry false information. See Can someone create a fake document from scratch?
• It does not replace the issuer. Only the organisation that issued a document can confirm that it is genuine.

What to do in addition

For anything that carries money, legal weight or a decision about a person, treat the result as one input among several:

1. Ask the source. Request the file directly from the issuer or from their portal, and compare it with what you were given.
2. Corroborate. Check that the document’s details agree with other records, such as account activity, registry entries, contact details you looked up yourself, or a second document from the same period.
3. Look at the whole result. The creation date, the software that produced the file and the listed findings should fit the story of where the document came from. A mismatch is a reason to ask questions even when the verdict is Intact.
4. Prefer originals. Ask for the original digital file instead of a scan, photo or screenshot of it.
5. Keep the check on record. Note the result link and the date alongside your decision, so the reasoning can be reviewed later.

Four situations where a clean result is still not enough

1. The document was false from the start. A pay stub typed in a word processor and exported has no later edit to find. The file is not Intact in any useful sense: it is Inconclusive, because anyone can produce it.
2. The change happened before the PDF existed. A spreadsheet edited and then exported by the issuer’s own system gives a genuine, unaltered PDF of wrong data.
3. The copy is not the file. A photo, screenshot or scan of a document is a new object. It never receives Intact, however good it looks.
4. The check could not be completed in full. The result then says so (analysis_incomplete) and an empty findings list means nothing.

How much to add, by size of the decision

• Low stakes (a receipt, a routine attachment): the verdict and a glance at the findings are usually enough.
• Medium (a tenancy, a small loan, an expense claim): add a source check, either a fresh download from the issuer or one corroborating record.
• High (a mortgage, an insurance claim, a hire, a legal filing): require the file straight from the issuer, confirm key facts by a channel you found yourself, and keep the result link with the case file.

Questions worth putting to the sender

• Where exactly did you get this file, and when?
• Did you open, fill in, merge, compress or re-save it before sending?
• Can you download it again from the portal while I watch, or ask the issuer to send it to me?

A person with a real document answers these in a sentence. Hesitation is not proof of anything, but it tells you where to look next.

When this does not apply

If you hold the issuer’s own original, delivered by the issuer to you directly, the realistic risk is much smaller, and the check works as a confirmation. The page above is about the case where the file has been through other hands.

How this differs from the other limits

The question of which kinds of change the checker covers is answered in Can the PDF authenticity checker detect all types of modifications? How to read each verdict is covered in How do I interpret the analysis results? This page is about the practical question behind both: how much to rely on a result, and what to add to it.

If you review documents regularly, read how PDF tamper detection works as a workflow, or add checks to your own process through the HTPBE? API. Plans and per-check prices are on the pricing page.

Related questions

• Can someone create a fake PDF from scratch?
• Does HTPBE? verify identity?
• How accurate is PDF modification detection?