How to Check a PDF Before Payment: 7-Step Checklist

Originally published at htpbe.tech. The version on htpbe.tech stays in sync with the latest detection algorithm — refer to it for the canonical text.

The moment before you click “Pay” is critical. Once funds are transferred, recovery becomes difficult or impossible. Yet many businesses process payments based on PDF invoices without fraud detection, trusting that what they see is authentic.

This trust is often misplaced. Invoice fraud through PDF modification is a growing threat, with criminals altering invoices to redirect payments to fraudulent accounts. According to the FBI Internet Crime Complaint Center, business email compromise attacks involving modified invoices resulted in losses exceeding $2.7 billion in 2022.

This article provides a practical 7-step checklist to check PDF invoices before making payments. Following this checklist can prevent devastating financial losses and protect your business from payment fraud.

The Moment Before You Click “Pay”

Payment processing is a critical business function, but it is also a prime target for fraudsters. The combination of trust in invoices, time pressure, and the difficulty of recovering funds makes payment fraud highly effective.

The problem:

• Invoices look official and are trusted
• Time pressure encourages skipping fraud detection
• PDFs can be modified without obvious signs
• Funds are difficult to recover once transferred

The solution:

• Systematic fraud detection before every payment
• Multiple fraud detection methods
• Independent confirmation channels
• Automated PDF tamper detection tools

As Ramp explains, fraud detection is not optional — it is essential for payment security.

Why Fraud Detection Matters

Understanding the risks helps justify fraud detection time:

Fraud Statistics

• Average loss: $150,000 per invoice fraud incident
• Recovery rate: Less than 10% of funds recovered
• Frequency: Increasing year-over-year
• Target: All businesses, regardless of size

Common Attack Methods

• Email interception: Criminals intercept legitimate invoices
• PDF modification: Bank account details changed in PDF
• Social engineering: Urgency created to bypass fraud detection
• Impersonation: Fake emails from compromised accounts

Consequences

• Financial loss: Direct theft of funds
• Operational disruption: Payment processing delays
• Reputation damage: Loss of vendor trust
• Legal issues: Compliance and regulatory problems

As Tipalti reports, fraud detection prevents the majority of payment fraud attempts.

The 7-Step Pre-Payment Fraud Detection Checklist

Use this checklist for every payment:

Step 1: Check Sender Email Address

What to check:

• Email address matches vendor records
• No slight variations (e.g., vendor@company.com vs vendor@cornpany.com)
• Email domain matches vendor website
• Sender name matches known contacts

How to check:

• Compare with vendor master file
• Check previous email correspondence
• Check domain through vendor website
• Contact vendor if email address changed

Red flags:

• New email address without prior notice
• Slight variations in domain name
• Email from personal account instead of business
• Unexpected sender name

Why it matters: Email compromise is the primary attack vector for invoice fraud. Checking sender identity is the first line of defense.

Step 2: Check PDF Metadata for Anomalies

What to check:

• Creation and modification dates
• Creator and producer applications
• Metadata consistency
• Unexpected applications

How to check:

• Open PDF Properties (File → Properties)
• Review creation and modification dates
• Check creator and producer fields
• Look for unexpected applications

Red flags:

• Recent modification of old invoice
• Invoice created in unexpected application
• Multiple producer entries
• Metadata inconsistencies

Why it matters: Metadata reveals document processing history. Anomalies can indicate PDF modification.

Automated option: Use HTPBE? to automatically check metadata and detect modifications — just upload the invoice PDF for instant analysis.

Step 3: Compare Bank Details with Records

What to check:

• Bank account number matches vendor records
• Routing number is correct
• Bank name matches expected institution
• SWIFT code (for international payments) is correct

How to check:

• Compare with vendor master file
• Check previous payment records
• Check bank details independently
• Confirm with vendor if details changed

Red flags:

• New bank account without prior notice
• Account number different from records
• Bank name changed unexpectedly
• Routing number does not match bank

Why it matters: Bank account changes are the primary goal of invoice fraud. Checking account details prevents payment redirection.

Critical: Never trust bank details from email alone. Always check through independent channels.

Step 4: Check Digital Signatures if Present

What to check:

• Digital signature presence
• Signature validity status
• Certificate validity
• Signature scope

How to check:

• Open PDF in Adobe Acrobat Reader
• Look for signature panel or field
• Click signature to view status
• Check signature validity

Red flags:

• Invalid digital signature
• Signature missing when expected
• Certificate expired or revoked
• Signature scope does not cover entire document

Why it matters: Digital signatures provide cryptographic proof of document integrity. Invalid signatures indicate modification.

Note: Not all invoices have digital signatures. When present, they provide strong authenticity proof.

Step 5: Call Vendor to Confirm (Use Known Number)

What to check:

• Invoice authenticity
• Bank account details
• Payment amount
• Payment timing

How to check:

• Call vendor using known phone number (not from email)
• Confirm invoice details
• Check bank account information
• Confirm payment amount and timing

Red flags:

• Vendor cannot confirm invoice
• Bank details do not match vendor records
• Vendor unaware of invoice
• Urgency pressure to skip fraud detection

Why it matters: Independent fraud detection through phone call prevents email-based fraud. Using known numbers prevents phone number spoofing.

Critical: Always use phone numbers from your records, never from emails or invoices.

As ResolvePay explains, fraud detection calls are essential for preventing payment fraud.

Step 6: Check for Duplicate Invoice Numbers

What to check:

• Invoice number matches records
• No duplicate invoice numbers
• Sequential invoice numbering
• Invoice number format consistency

How to check:

• Check invoice number against records
• Search for duplicate invoice numbers
• Check invoice numbering sequence
• Confirm invoice number format

Red flags:

• Duplicate invoice number
• Invoice number out of sequence
• Invoice number format changed
• Missing invoice numbers in sequence

Why it matters: Duplicate invoices can indicate fraud or processing errors. Checking invoice numbers helps detect both.

Step 7: Use automated fraud detection Tools

What to check:

• PDF modification detection
• Comprehensive analysis
• Confidence scoring
• Detailed reporting

How to check:

• Upload invoice PDF to fraud-detection tool
• Review analysis results
• Check confidence scores
• Examine detailed indicators

Benefits:

• Detects modifications manual review misses
• Provides confidence scores
• Analyzes multiple indicators
• Creates fraud detection records

Why it matters: Automated tools provide comprehensive analysis that manual review cannot match. They detect sophisticated modifications and provide objective assessment.

Integration: Use automated fraud detection as part of payment workflow for consistent application.

As PLANERGY notes, automated fraud detection tools are essential for modern payment security.

Red Flags That Should Stop Payment

Certain red flags should immediately halt payment processing:

Critical Red Flags

Stop payment if:

• PDF tamper detection shows modification
• Bank account details changed without prior notice
• Vendor cannot confirm invoice by phone
• Digital signature is invalid
• Multiple fraud detection failures
• Urgency pressure to skip fraud detection

Warning Signs

Investigate before payment:

• Sender email address changed
• Metadata shows unexpected modifications
• Invoice number is duplicate
• Payment amount is higher than expected
• Payment timing is unusual

When in Doubt

Best practice:

• Do not proceed with payment
• Investigate further
• Check through multiple channels
• Get management approval
• Document concerns

As InvoiceOwl explains, when in doubt, delay payment until fraud detection is complete.

What to Do If Something Seems Wrong

If fraud detection reveals problems:

Immediate Actions

1. Stop payment: Halt payment processing immediately
2. Document findings: Record all detection results
3. Notify management: Escalate concerns to management
4. Contact vendor: Check directly with vendor
5. Investigate further: Determine if fraud or error

Investigation Steps

1. Review detection results: Examine all indicators
2. Contact vendor: Check invoice authenticity
3. Check records: Compare with vendor master file
4. Review communication: Check email history
5. Document everything: Keep records of investigation

Resolution

If fraud confirmed:

• Notify law enforcement
• Report to FBI IC3
• Contact bank to attempt recovery
• Review security processes
• Update fraud detection procedures

If error confirmed:

• Process payment with correct details
• Update vendor records
• Document error resolution
• Review processes to prevent recurrence

As Xelix explains, quick action improves fraud prevention and recovery chances.

Creating a fraud-detection workflow

Implementing systematic fraud detection:

Workflow Design

Process steps:

1. Receive invoice
2. Check sender email
3. Check PDF metadata
4. Compare bank details
5. Check digital signature (if present)
6. Call vendor to confirm
7. Check invoice number
8. Use automated fraud detection
9. Approve payment if all checks pass

Automation Opportunities

Automate where possible:

• PDF tamper detection (automated tools)
• Invoice number checking (database lookup)
• Bank detail comparison (vendor master file)
• Email fraud detection (sender validation)

Manual steps:

• Phone call to vendor
• Management approval
• Exception handling

Documentation

Maintain records:

• detection results
• Phone call confirmations
• Exception approvals
• Fraud incidents

Audit trail:

• Complete fraud detection history
• Decision documentation
• Approval records
• Incident reports

Tools and Resources

Fraud Detection tools and resources:

PDF Tamper Detection

HTPBE? provides automated PDF tamper detection with confidence scores — upload any invoice PDF and get instant analysis showing whether the document has been modified. The free web interface requires no signup and processes documents in seconds.

Vendor Management

• Vendor master files: Centralized vendor information
• Contact databases: Known phone numbers and emails
• Payment records: Historical payment information

Communication Channels

• Phone fraud detection: Known vendor phone numbers
• Secure portals: Vendor document submission
• Encrypted email: Secure communication channels

Conclusion

Checking PDF invoices before payment is essential for preventing fraud. The 7-step checklist provides a systematic approach:

1. Check sender email address
2. Check PDF metadata for anomalies
3. Compare bank details with records
4. Check digital signatures if present
5. Call vendor to confirm (use known number)
6. Check for duplicate invoice numbers
7. Use automated fraud detection tools

Following this checklist prevents the majority of payment fraud attempts. When combined with automated fraud detection tools, it provides comprehensive protection against invoice fraud.

Remember: a few minutes spent checking an invoice can prevent devastating financial losses. When in doubt, delay payment until fraud detection is complete.