To tell if a document has been altered, compare it against what an untouched version should look like and hunt for the traces tampering leaves behind: mismatched ink or paper on a physical page, off metadata or broken signatures on a digital file, and inconsistencies in layout, fonts, or compression on either. Some checks need nothing beyond good light and a magnifier. Others need free software or, when the stakes are high, a certified forensic examiner.
Red Flags on a Paper Document
Start with the ink. Text added after the fact rarely matches the original. Look for differences in color, sheen, or line thickness within the same page. Ballpoint ink darkens and settles over time, so a fresh addition next to old writing often looks subtly brighter or glossier. Pen pressure matters too. A forger retracing an existing line presses differently than someone writing naturally, and the result looks stiff or uneven under close inspection.
Erasures are harder to hide than most people think. Chemical erasure, using solvents to dissolve ink, tends to thin the paper and disturb its surface texture, leaving a slightly translucent patch you can see when you hold the page up to a light. Mechanical erasure, scraping or rubbing, damages paper fibers and creates a roughened area that accepts fresh ink differently. Even correction fluid, obvious in the original, often disappears in a photocopy where the texture flattens out.
Layout tells its own story. Additions squeezed into margins, wedged between existing lines, or crammed at the end of a paragraph suggest afterthoughts or deliberate insertions. Compare spacing, slant, and baseline alignment throughout the document. If one section drifts noticeably from the pattern set by the rest, look closer. At the page level, misaligned staple holes, pages with different paper weight or texture, and perforations that don’t line up all suggest pages were swapped or reassembled.
Signatures deserve special attention because they carry outsized legal weight. A traced signature often shows unnaturally slow, even pen strokes with none of the speed variation that comes from writing your own name hundreds of times. Forged signatures may start confidently and then hesitate mid-stroke, or show obvious pen lifts where the original flows continuously. Stamps and embossed seals can be altered too. Watch for impressions that are unusually shallow, poorly aligned, or angled inconsistently with how the issuing office normally places them.
Simple Tools That Reveal Physical Tampering
A 10x jeweler’s loupe costs under $15 and reveals far more than the naked eye. Ink inconsistencies, fiber damage from erasure, and overwriting all become obvious at magnification.
Ultraviolet light is one of the most effective checks. Chemical erasure agents fluoresce differently than untouched paper under UV, often producing a bright spot exactly where the alteration happened. UV also shows whether security features, like the fluorescent fibers embedded in checks and official stationery, are disturbed or missing. Handheld UV flashlights made for document inspection are widely available.
Holding the page against a strong backlight exposes thinned paper, cut-and-paste seams, and watermark irregularities. If a watermark appears only on certain pages of a multi-page document, or if the pattern breaks in one area, that is worth investigating.
Red Flags in a Digital Document
Metadata That Does Not Match the Story
Every digital file carries metadata: when it was created, when it was last modified, what software produced it, and sometimes who authored it. Casual tampering rarely accounts for it, which is why this is the first place to check. A PDF whose creation date is months after its supposed signing date, or a Word document listing an unexpected author, raises immediate questions. The software field is equally useful. If a contract was supposedly generated by your company’s standard tools but the metadata names a PDF editor, someone likely opened and changed the original.
On most computers, you can view basic metadata by right-clicking a file and selecting Properties on Windows or Get Info on Mac. For PDFs, opening the file in Adobe Acrobat and pressing Ctrl+D (Cmd+D on Mac) shows creation and modification dates side by side. Command-line tools like pdfinfo display more granular metadata, including the exact software version used to create and modify the file.
One caveat: metadata can be deliberately spoofed. A knowledgeable person can change timestamps and author fields without leaving obvious traces. Inconsistent metadata is strong evidence of alteration; clean metadata is not proof the file is untouched.
Visual and Structural Inconsistencies
In images and scanned documents, look for localized blurring or pixelation, areas that look slightly softer or more compressed than their surroundings. When someone edits part of an image and re-saves it, the edited region compresses differently than the rest of the file. Mismatched lighting and shadows in a photograph, one object casting a shadow to the left while another’s falls to the right, are classic signs of compositing.
In text documents, font inconsistencies are a giveaway. A paragraph in a slightly different typeface, size, or weight suggests content was pasted in from elsewhere. Character spacing and line height can also shift when text is edited in a different application than the one that created the original.
File size can be informative when you have a baseline. A one-page letter saved as a 15 MB PDF may contain hidden layers, embedded images, or remnants of editing. A format mismatch, like a “PDF” that is actually a flattened image with no selectable text, may mean someone converted the document to destroy the edit trail.
Error Level Analysis for Images
Error Level Analysis re-compresses a JPEG and highlights areas where compression artifacts differ from the rest of the file. In an unedited photo, the entire image should show roughly uniform error levels. If one region lights up brighter or darker than its surroundings, that region was likely edited after the original compression. Free online tools perform ELA automatically. It isn’t foolproof (multiple re-saves degrade its reliability), but it catches a surprising number of amateur edits.
Digital Signatures and Hash Values
A digital signature does more than mark that someone signed a file. It cryptographically locks the contents at the moment of signing. Change a single character afterward and the signature breaks. In Adobe Acrobat, open the Signatures panel and select Validate All Signatures. A valid signature confirms the content hasn’t changed since the signer applied it; an invalid one means something was altered.
Hash values work on the same principle without needing a signature. An algorithm like SHA-256 converts a file into a unique 64-character fingerprint. Change one byte and the hash changes completely. If someone sent you a document along with its hash value, generate the hash on your copy and compare. A mismatch means the file was altered in transit or after delivery.
What About AI-Altered Text
Alteration now increasingly involves AI tools that generate convincing text, rewrite paragraphs, or fabricate entire sections. Detection is harder than spotting an erasure, but patterns exist. AI-generated writing tends toward uniform sentence length and structure, overly formal phrasing, and a kind of relentless coherence that lacks the natural variation of human writing. It often hedges heavily and reads as competent but oddly impersonal.
Several online services analyze text for machine-generated patterns using metrics like perplexity (how predictable the word choices are) and burstiness (variation in sentence length and complexity). Human writing tends to be less predictable and more varied; AI output is smoother. No detector is perfectly reliable, especially on short passages or heavily edited text, but the result adds a useful data point when authenticity is in question.
Preserving the Document Once You Suspect Alteration
How you handle a document after spotting something suspicious matters as much as what you found. Mishandling can make it inadmissible in court or destroy the clues an examiner would rely on.
For a physical document:
- Stop handling it. Place it in a clean, clear plastic sleeve. Fingerprints, moisture, and repeated folding all degrade forensic evidence.
- Don’t mark it up. Don’t circle suspicious areas or write notes on the document itself. Any mark you add makes the examiner’s job harder.
- Photograph it immediately with good lighting: the full page plus close-ups of suspect areas. These photos establish the document’s condition at the time you noticed the issue.
- Record the chain of custody. Write down how the document came to you, who else has handled it, how it’s been stored, and every transfer since, signed and dated by each person.
For a digital file:
- Don’t open it more than necessary. Some formats update “last opened” timestamps automatically, which can muddy the alteration timeline.
- Copy the file to a separate storage device without opening it. This preserves the original metadata and file structure.
- Generate a SHA-256 hash right away and record it. That creates a verifiable fingerprint of the file’s condition when you received it. If the file is accidentally modified later, the original hash protects you.
- Preserve the delivery method: the email, text message, or file-sharing link that carried the document. Transmission metadata can establish when the file was sent and by whom.
Professional labs work only on copies, never the original. That principle applies to you too. Once the original is secured, any further examination should happen on a duplicate.
When to Bring in a Forensic Document Examiner
The techniques above catch obvious alterations, the kind made by someone who didn’t think anyone would look closely. Sophisticated alterations need professional analysis. If the stakes are high, such as litigation, a disputed will, or a fraud investigation, or if you spotted something wrong but can’t pin down exactly what, a forensic examiner is worth the cost.
Physical document examiners use stereo microscopes, infrared and ultraviolet spectral imaging, and chemical analysis of inks and paper. They determine whether entries were added at different times, whether signatures are genuine, and whether pages have been substituted. Digital forensic specialists handle the electronic side, recovering deleted metadata, analyzing file structures, and tracing edit histories that standard software won’t display.
Certification matters when you choose an examiner. The American Board of Forensic Document Examiners is the primary credentialing body. Certified examiners must pass a four-phase assessment covering credentials review, a written exam with a minimum 70% score, practical casework evaluation, and an oral board examining their reasoning and methodology.1American Board of Forensic Document Examiners. Certification An ABFDE-certified examiner’s testimony carries significantly more weight in court than that of a self-described expert with no board certification.
Cost varies by complexity. A straightforward signature analysis runs roughly $1,500 to $2,000 as a flat fee, with additional questioned documents adding several hundred dollars each. Court testimony adds substantially, typically $2,000 or more per day, plus preparation fees. Rush analysis on a 24 to 48 hour turnaround usually carries a 50% to 100% surcharge.
Legal Consequences and Where to Report
Altering a document is a crime in many contexts. At the federal level, knowingly altering or falsifying any record to obstruct a federal investigation or proceeding is punishable by up to 20 years in prison.2Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records Fraud involving identification documents, such as altering a driver’s license, birth certificate, or passport, carries penalties of up to 15 years for a single offense and up to 30 years if the alteration facilitates terrorism.3Office of the Law Revision Counsel. 18 U.S. Code 1028 – Fraud and Related Activity in Connection With Identification Documents Every state also has its own forgery and fraud statutes, and many treat document alteration as a felony when the purpose is financial gain or legal harm to someone else.
In civil cases, an altered contract is generally unenforceable against the party who didn’t consent to the changes, and the party that made the changes can face liability for fraud and court sanctions.
If you believe a document has been criminally altered, your first stop is usually local law enforcement, especially when there’s direct financial loss or personal harm. For fraud involving digital documents, online scams, or cyber-enabled schemes, the FBI’s Internet Crime Complaint Center accepts reports and serves as the federal hub.4Internet Crime Complaint Center. IC3 Home Page For altered identification documents, contact your local FBI field office or file through tips.fbi.gov. If the alteration involves a government-issued benefit, tax document, or immigration paperwork, the issuing agency will have its own fraud reporting channel as well.