Most fakes are edited real PDFs. One deposit added. One balance changed. The rest looks normal.
A checker tests math first. Opening balance plus every row must reach closing balance. Edits break the chain at the altered line.
Then document signals. Editor names in metadata. Modified dates before creation. Missing creator fields. Mixed fonts across pages.
Then payer reality. Inserted salary lines rarely match real descriptor cadence. Round numbers cluster. Dates fall out of order.
Run suspect files through a free bank statement analyser. It returns a 0-100 score with each trigger named. Keep the report with the file.