Most fakes are edited real PDFs. One deposit added. One balance changed. The rest looks normal.
A checker tests math first. Opening balance plus every row must reach closing balance. Edits break the chain at the altered line.
Then document signals. Editor names in metadata. Modified dates before creation. Missing creator fields. Mixed fonts across pages.
Then payer reality. Inserted salary lines rarely match real descriptor cadence. Round numbers cluster. Dates fall out of order.
Recompute the running balance on suspect files. A converter that reconciles every row catches broken chains. Keep the spreadsheet with the file.