A bank statement can look polished and still deserve review. The opposite is also true: a legitimate statement can have unusual metadata after printing, combining pages, adding a signature, or downloading through third-party software. The goal is not to hunt for one “tell.” It is to collect independent evidence and decide what the file still cannot establish.

A clean PDF is not proof that the statement is authentic. A modified PDF is not proof that it is fraudulent.

1. Ask for the strongest available source

An original, digitally downloaded PDF usually preserves more useful structure than a screenshot, phone photo, scan, or printed-and-rescanned copy. If your policy permits it, ask the applicant to download the statement directly from the institution’s portal. Do not ask for credentials or require unsafe account sharing.

  • Prefer the original PDF over an image or printout.
  • Confirm the statement period and account suffix are visible.
  • Request adjacent months when continuity matters to the decision.
  • Record the exact file reviewed with a cryptographic fingerprint.

2. Inspect file structure and metadata

A PDF may identify the software that created it, its creation and modification timestamps, incremental revisions, embedded scripts, attachments, and signature containers. Compare those facts with the claimed workflow. A statement created by design software deserves an explanation; it does not justify an automatic accusation.

Signals worth documenting

  • The declared file type does not match its binary signature.
  • General-purpose editing software appears as the creator or producer.
  • Modification time substantially follows creation time.
  • Multiple revision pointers appear in a file presented as an untouched download.
  • Scripts or embedded attachments are present without a clear business reason.

Ocolta’s free bank statement checker surfaces these supported signals locally, reconciles the statement summary, and explains benign causes to consider.

3. Recompute the statement math

At minimum, the summary relationship should reconcile:

Opening balance + credits − debits = closing balance

The free math panel checks that relationship for you. Then spot-check the running balance on transaction pages. A forged number may change a deposit or closing balance without updating every downstream total. Rounding, pending transactions, and bank-specific presentation can create legitimate differences, so document the formula and the exact discrepancy.

4. Compare periods and adjacent evidence

For consecutive statements, the previous closing balance should generally agree with the next opening balance. Dates should progress normally, account suffixes and account holder names should remain consistent, and recurring income should align with other authorized evidence such as pay dates and net pay. None of these checks confirms ownership or issuer authenticity on its own.

5. Verify at the source when the impact is high

File forensics is a triage layer. If a material question remains, use an authorized source-verification method or request an issuer-downloaded original under a written policy. In housing workflows, apply consistent criteria and obtain legal review before using document findings for eligibility or adverse action.

Use the result responsibly

Do not tell an applicant that a document is “fake” based only on metadata. State the observation, request the same follow-up your policy requires in comparable cases, and preserve an unable-to-determine outcome.