Short answer: the content that was signed no longer matches the file you have. Someone, or some software, changed signed content after the signature was applied. VeriPatra reports "The document was changed after it was signed", and the result is Could not be verified. The signature can no longer vouch for what you are reading.
What it means
When a PDF is signed, the signing software takes a fingerprint (a "hash") of the exact bytes being signed and locks that fingerprint with the signer's private key. Change one figure, one name or one date and the fingerprint changes. The locked fingerprint no longer matches, and every checker can see it.
There is no "slightly changed". The numbers either match or they do not. Why a digital signature is not a picture of your name explains the idea step by step.
Allowed additions and disallowed changes
A PDF can be saved in a way that adds to the file instead of rewriting it. This is called an incremental update: the new material goes on the end of the file, and the bytes that were signed stay untouched. It is how a second person can sign a PDF after the first, without breaking the first signature.
So VeriPatra asks separate questions:
- Were the signed bytes changed? If yes, you see "The document was changed after it was signed". Nothing can make that acceptable.
- Does the signature cover the whole file? If material was added after a signature, you see "The signature does not cover the entire document". That addition is not vouched for by that signature.
- Were later additions permitted? When a document is certified, the certifier decides what may be added later: nothing at all, or certain additions such as further signatures. VeriPatra reports "Changes after signing stayed within the allowed rules" or "went beyond the allowed rules".
How it happens
- Someone edits a signed letter to change a name, an amount or a date. It is the easiest way to misuse a real signed document, and the arithmetic catches it.
- A PDF editor re-saves the whole file instead of adding to it. That can rewrite signed bytes even when nobody meant to change anything.
- Someone adds an ink-signature image or a stamp to a signed PDF with a tool that rewrites the file.
What to do
1. Do not act on the content
Treat every figure, name and date in this copy as unconfirmed, however official it looks.
2. Ask for the original file
Ask the sender to send the PDF exactly as it was signed, as a file attachment, without opening and saving it in an editor first.
3. If you edited it yourself, go back to the copy you received
Check the copy you were sent, not the one you saved. If you need to add your own mark, VeriPatra's Sign & Seal warns you before it would break an existing signature and leaves the original untouched.
4. Confirm the details directly
If the document asks you to pay, sign or share anything, confirm with the issuer through contact details you found yourself.
Common questions
Does "changed after signing" prove someone committed fraud?
No. Software can cause it by accident. But you cannot rely on the changed copy, whatever the reason.
Can the changed document be repaired?
Not by you. Only the signer can sign the corrected version again.
Two people signed the PDF. Why is that fine?
Because the second signature was added as an incremental update, after the first signed bytes, and nothing in the document forbade it. That is an addition, not a change to what the first person signed.
Related reading: Valid signature, unknown signer and Why a photo of a signed PDF cannot be verified.
Drop a PDF in and see the eight checks for yourself. No account; the PDF is not retained.