TL;DR: An AI-generated PDF is a file whose pixels look institutional while its production history does not. Visual review fails against competent fakes. Detection reads metadata, empty Producer strings, timestamp trails, model artifacts, and whether a real document was edited after creation. The FBI's 2025 Internet Crime Report recorded 22,364 AI-related complaints and nearly $893 million in losses, including fake identification documents.
What an AI-generated PDF actually is
An AI-generated PDF is a portable document whose visible layout was synthesized by a generative model, then wrapped in PDF bytes. The page can look like a bank statement, pay stub, invoice, or certificate of incorporation. Creator, Producer, dates, fonts, and the trailer are the detector's working surface.
Two production methods sit under the same query. Generated-from-scratch files never existed as an issuer original: a model draws the page, a converter writes PDF objects, and the applicant submits the result. Edited-real files start as a genuine export. Someone then changes a balance, a date, a name, or a page of transactions and saves a new revision. Both look like PDFs. They leave different histories.
That distinction is what visual review cannot see. A generated-from-scratch fake often carries consumer converters, a blank Info dictionary, or image-layer artifacts from a model. An edited-real fake often keeps the issuer's original Producer, then adds a later ModDate, extra revisions, or a font on only the altered line. The first question is how the file was made, not whether the screenshot looks official.
In November 2024, FinCEN alerted financial institutions to deepfake media created with generative AI, including fraudulent identity documents used to circumvent identity verification. The FBI's 2025 Internet Crime Report added AI as a tracked descriptor for the first time: 22,364 complaints and nearly $893 million in reported losses, including fake identification documents. The method below is what to run on the file in the queue. The companion piece on generative AI document fraud as a compliance risk covers why looking harder is the wrong program response.
Tells that still work, and the ones that don't
Pixel-level tells still catch crude fakes: mismatched kerning, a seal off-grid, a logo that blurs when zoomed. Competent generators satisfy those heuristics. Detection has to move from the rendered page to the object graph that produced it.
ISO 32000 defines the document information dictionary most PDFs still carry: Title, Author, Creator, Producer, CreationDate, ModDate. Creator names the application that originated the content. Producer names the tool that last wrote PDF bytes. Institutional statements typically emit a reporting engine or a known server-side library. Consumer editors, browser print-to-PDF drivers, and many generative pipelines write something else.
Empty Producer and Creator strings are a class of signal, not a verdict. Real issuer pipelines almost always stamp software identity into those fields. Generative converters often leave them blank. Blank metadata on a claimed major-bank statement is a reason to escalate. Blank metadata on a developer invoice from a library that never populated Info fields is noise. The tell is claimed issuer plus missing institutional producer, not emptiness alone.
Timestamp trails still work when they contradict the story on the page. A statement covering March with a CreationDate in the same hour as submission can be a genuine online export. A CreationDate years before the statement period, followed by a ModDate minutes before upload, is a different story. Incremental updates and an XMP history block that lists a consumer editor mean the file was rewritten after it was born. Font checks still help on edited-real documents: a changed amount often introduces a second font subset that does not belong to the original production method.
What no longer works by itself: zooming on a seal photo, judging paper texture on a digital file, or treating a screenshot as the original PDF. Once the native file becomes a raster, Producer strings, xref chains, and signatures are gone. Intake that accepts photos of documents has already discarded the cheapest signals.
No single row is a detector. The Coalition for Content Provenance and Authenticity (C2PA) exists because origin and edit history are not visible on the canvas. Most bank-statement PDFs still will not carry Content Credentials. Until they do, read the Info dictionary, the XMP packet, and the revision chain. The same idea shows up in broader document fraud detection in banking: metadata and structure first, pixels last.
How detection actually works
Detection is six reads of the same file, weighed together so one oddity cannot convict a clean re-save.
Production method asks how the bytes were born. A core-banking renderer, a payroll engine, a browser print driver, a consumer editor, and a generative image-to-PDF pipeline write different object graphs. The check is whether the claimed issuer's usual production method matches the one in this file.
Timestamp trail asks when the file was created and when it was last written. Matching CreationDate and ModDate on a single-revision file is consistent with a one-shot export. A gap or a stack of incremental updates is consistent with post-creation editing. Legitimate signing workflows also add revisions, so the trail is history, not a fraud label by itself.
Issuer matching asks whether Producer, Creator, fonts, page size, and template family belong to the institution named on the page. Known-good samples from the same issuer make this check sharp. Without them, reject obvious mismatches: a statement produced by a slide deck, a registry extract whose fonts never appear on real filings.
Consistency asks whether the content agrees with itself. Running totals, date order, and repeating headers should reconcile. Generated pages often get the chrome right and the arithmetic almost right. Edited-real pages often get one field wrong while the original math still adds to the old total.
Model artifacts are computational residue in generated images: frequency-domain patterns, unnatural background uniformity, and image objects that were never captured by a scanner or a bank renderer. The check is strongest when the page is a raster pasted into a PDF, weaker on vector text from a library that never touched a diffusion model.
Recycled patterns ask whether this file, or a near copy, has appeared before: the same template farm, dummy transactions, logo crop, or metadata skeleton across unrelated applicants. One convincing PDF is an incident. The same production fingerprint on fifty applications is a typology.
Together those checks reconstruct the file's story. A generated-from-scratch fake typically fails production method, issuer matching, and model artifacts, sometimes with empty Producer strings as the first flag. An edited-real fake typically keeps the original Producer, then fails timestamp trail, consistency, or a localized font change. A single "AI score" hides the action: reject a synthetic original, or challenge a tampered genuine one.
What to do with a suspect file
Keep the original bytes. Do not print, screenshot, or flatten the PDF before the forensic pass. Flattening is how a useful Info dictionary becomes a picture of a statement.
Escalate when the file's story contradicts the claimed issuer: empty or consumer Producer on an institutional document, an unexplained ModDate gap, arithmetic that does not close, or model artifacts in an image layer. Route those files to fraud or EDD with the evidence attached.
Reject when the production method cannot be the issuer's, the applicant cannot supply a native export, or the same recycled pattern has already been seen. A re-download from the online banking portal is a fair break-test. A genuine customer can usually produce a second export whose Producer and timestamps look like the first. A generated file often cannot.
Break-test the intake path, not just the one file. If the queue accepts screenshots, the cheapest PDF tells never run. If it accepts native PDFs, check a document on a known-good issuer export and on the suspect file in the same session. Two x-rays beat a single score with no baseline.
Record the decision as production method plus evidence, not as AI yes or no. Examiners and SAR narratives need the file history: what the Producer said, what the revision chain showed, what failed consistency. That is also how Sphinx Doc Fraud presents a verdict: the manipulation highlighted, not a black-box probability.
Where Sphinx fits
Sphinx Watchdoc scores the file on arrival, then spends compute only where the story is messy. The six checks are weighed together so a re-save is not treated like a forgery. The x-ray shows why. Across more than 1 million documents processed, Sphinx reports a 94.3% correct verdict and 2.8x more forgeries caught than the review stack it replaces. Pricing is $0.45 per document, no seats and no platform fee. The Watchdoc playground is free for a first file, no email required, with a 50-document free tier. The same tells show up first on fake bank statements; industry volume is in the document fraud statistics page.
Frequently Asked Questions
How do you detect an AI-generated PDF?
Read the file history, not the screenshot. Check Producer and Creator against the claimed issuer, compare CreationDate and ModDate, look for extra revisions, test internal arithmetic, and scan embedded images for model artifacts. Competent fakes pass visual review and still have to write PDF bytes that usually disagree with an institutional origin story.
What does an empty Producer string mean on a PDF?
An empty Producer means the tool that last wrote the PDF did not stamp a software identity into the Info dictionary. On a claimed bank statement that is unusual, because issuer pipelines typically populate Producer. Empty fields are not proof of fraud. They are a reason to escalate when the page claims an institution that always leaves a fingerprint.
Is an AI-generated PDF the same as an edited real document?
No. A generated-from-scratch PDF never existed as an issuer original. An edited-real PDF started as a genuine export and was changed after creation. The first often fails issuer matching and model-artifact checks. The second often keeps the original Producer and fails the timestamp trail. Detection that only asks whether the file is AI misses the edit.
Can analysts spot AI-generated PDFs by looking at them?
Not reliably. FinCEN has already warned that generative AI is used to produce fraudulent identity documents that target financial-institution controls. Visual heuristics were built for clumsy composites. The working tells sit in metadata, revision history, and computational artifacts.
Should a suspect PDF be converted to an image before review?
No. Converting or screenshotting the file destroys Producer strings, xref chains, and signatures. Keep the original bytes, run a forensic pass, then decide whether to reject, request a native re-export, or file.
.png)
