Document verification for businesses: how to check a file someone sent you

Document verification is how a business decides whether a document it received is what it claims to be. Three questions cover almost every case: did the party named on it really issue or sign it, has it changed since, and is the person sending it entitled to? A supplier's invoice, a contract that came back signed, an ISO certificate in a tender pack, a candidate's degree, a passport copy from a new director. Different paper, same three questions.

Most pages ranking for the term answer a narrower question. Identity-verification vendors write them, and to them document verification means a customer photographing an ID card at onboarding. That's one row of the table below; most documents a business receives never pass through anyone's KYC flow.

Worth saying early: verification produces evidence, not certainty. A validation report can prove a PDF hasn't changed since a certificate signed it. It can't prove the invoice inside is honest. You stack checks until the risk that's left is one you can carry. For a signed PDF, the first check takes two minutes: verify a digital signature online and keep the report.

Document authentication is a different check

In US usage, document authentication usually means an official act: a state authority or the State Department confirming the seal and signature on a public document so it can be used abroad. Between members of the Hague Apostille Convention, that confirmation is an apostille. It certifies who signed, in what capacity and under whose seal, and says nothing about whether the contents are true.

The types of document verification differ less by technology than by where the truth lives. For a signed PDF, the proof is inside the file. For an invoice, it's in your own vendor records. For a certificate or a degree, it sits with the issuer, and only a check against that issuer counts.

Identity document verification is the odd one out. The document is a passport or an ID card, and the question is whether the live person in front of you matches it. That needs specialist tooling, which reads the machine-readable zone (MRZ) and the chip and runs a liveness check, so most businesses only run it on the person signing a high-value deal.

A validator answers one question: does this signature hold, and under which rules? For qualified signatures in the EU, Article 32 of eIDAS sets the list. Validation must confirm that the certificate was qualified, issued by a qualified trust service provider and valid at signing; that a qualified signature creation device made the signature; that the signed data hasn't been compromised; and that the signer's details reach you correctly, with any pseudonym flagged.

EU validators, the European Commission's DSS library included, follow ETSI EN 319 102-1. One procedure covers PAdES (signatures inside PDFs), XAdES (XML), CAdES (.p7m and .p7s files) and ASiC containers, and it ends in one of three verdicts. Tools word them differently; underneath, it's always one of these.

Valid isn't the same as qualified

A report can say TOTAL-PASSED for a signature that's advanced, not qualified. Qualified status is a lookup: is the issuer on the EU Trusted List as a qualified provider? ETSI's own note warns that a pass doesn't necessarily make a signature useful for a particular purpose. So read two lines: did it validate, and at what level. If a contract needs a qualified signature, you can check XAdES, CAdES and ASiC files against the EU Trusted List as well as PDFs.

One habit pays off: save the report the day you run it. Revocation data for signatures that don't embed it can disappear later, and today's report beats a re-run in two years.

A hash is a short fingerprint calculated from every byte of a file. NIST's Secure Hash Standard states the purpose plainly: digests detect whether a message has changed since the digest was made. Change one comma and the SHA-256 value changes completely.

That makes hash comparison the cheapest way to verify document authenticity between two copies. Ask the sender to read you the hash of the file they sent, over the phone, and compare it with the one you recorded in step two. Same value, same file. US courts lean on the same logic: the 2017 committee notes to the Federal Rules of Evidence say identical hash values reliably show that a copy and an original are exact duplicates.

The limit is just as plain. A matching hash proves the copy is identical. It doesn't prove the original was honest.

You can check the two brands behind most signed PDFs without an account with either.

DocuSign. First, make sure the envelope really came from DocuSign. DocuSign's own safety guidance says to confirm the email comes from an official domain such as @docusign.net, and to open the document on DocuSign's site with the security code from the email rather than through a link. Then look at what you were sent:

• The completed PDF, which opens in any validator like any other signed PDF.
• The DocuSign certificate of completion: the vendor's record of the envelope, with the envelope ID, each signer and the timestamped events of the signing. It's an audit record, not the PDF's digital signature, so treat the two as separate evidence.
• The envelope ID printed on the pages, a reference to quote when you ask the sender for the certificate.

Adobe Acrobat. Open the Signatures panel, pick the signature and validate it. Acrobat decides trust from its own trust settings, which don't match an EU validator's, so a signature can pass in Acrobat and come back unqualified elsewhere, or the reverse. If you're staring at a yellow banner, here's what Acrobat's yellow warnings mean.

Honestly, the most common failure here isn't fraud. It's a document someone tidied up after signing.

KYB (know your business) is the company-level version of KYC. For banks it's a legal duty: under 31 CFR 1010.230, US financial institutions must identify and verify the beneficial owners of business customers, meaning anyone owning 25 percent or more plus one person who controls the company. EU obliged entities get a single rulebook, Regulation (EU) 2024/1624, from 10 July 2027. For everyone else, KYB verification is ordinary prudence and cheaper than it sounds:

1. 1.
   Find the company in the official register yourself. In the UK that's Companies House, where identity verification for directors and people with significant control became a legal requirement on 18 November 2025. Every EU member state's business register has been searchable together through the e-Justice portal since June 2017. In the US, use the business search of the Secretary of State where the company is registered.
2. 2.
   Match the legal name, registration number and address on the document to the register. A trading name on the invoice and another legal entity on the contract deserve a question.
3. 3.
   Check who's entitled to sign. Directors and registered officers are on file; a "head of partnerships" usually isn't.
4. 4.
   Don't count on a US beneficial-ownership filing. Since March 2025, FinCEN has exempted companies created in the United States from reporting beneficial owners under the Corporate Transparency Act.
5. 5.
   If the company has a Legal Entity Identifier (LEI), look it up as a second record that someone else maintains.

Then the person. For a large deal, add KYC document verification: run identity checks on the person signing, with an ID document, a liveness check and sanctions and PEP screening.

Our piece on verifying a client before you sign covers who's legally required to and who simply should.

Forged paper gets the attention, but the biggest documented losses come from real documents, or real conversations, with one detail changed. The FBI's 2024 Internet Crime Report logged 21,442 business email compromise complaints and $2.77 billion in losses, out of $16.6 billion reported that year. Inside companies, fraud runs long: the ACFE's 2026 Report to the Nations, built on 2,402 cases, puts the median loss at $104,000 and the typical scheme at 12 months before detection.

Patterns worth training your team on:

• Changed bank details. A genuine supplier thread, a genuine-looking invoice, a new account. It's the most expensive pattern and the easiest to stop, with one phone call.
• An edited PDF that still shows a signature. A PDF can carry revisions appended after signing, so a signature may be valid for an earlier revision while the page you're reading came later. Validators report which revision each signature covers. Read that line.
• A pasted signature image, which looks like signing and carries no cryptography.
• A look-alike domain: one swapped letter in the sender's address, often on a thread that started legitimately.
• A real certificate that isn't theirs, edited to show a different company name or scope. The issuer's register catches it.
• Generated IDs and payslips. Spotting those is a job for specialist tooling, and we've covered what AI models look for in a forged ID separately.

None of these beat a document verification routine that checks the channel and an independent source. They beat people in a hurry.

A validation report is evidence about a signature. How much it weighs depends on where you'll use it, and on what happened to the file before you checked it.

In the EU, Article 25(1) of eIDAS says an electronic signature can't be denied legal effect or admissibility as evidence just because it's electronic or isn't qualified. That opens the door. Article 33 adds a higher tier. Only a qualified trust service provider may run a qualified validation service for qualified signatures, validating under Article 32 and returning the result in an automated form that carries the provider's own advanced signature or seal. A report like that is harder to argue with than a screenshot of a green tick.

American courts start from Rule 901(a) of the Federal Rules of Evidence: whoever offers an item must produce enough to support a finding that it's what they claim it is. Since December 2017, two paragraphs of Rule 902 have let electronic evidence authenticate itself through a qualified person's certification, with no witness on the stand. One is a record generated by an electronic process or system that produces an accurate result (902(13)). The other is data copied from a device or file and authenticated by a process of digital identification (902(14)); the committee notes name the hash value as the usual method. There's a catch in 902(11): you must give the other side reasonable written notice before trial and let them inspect the record and the certification.

Two caveats, and both matter. Authentication isn't truth. A report proves the file and the signature, not the facts written in them, and the other side can still argue hearsay or relevance. And none of this is legal advice for your dispute; it's the frame a lawyer starts from. Fair warning: if the original was edited before anyone hashed it, no rule repairs that, which is why document verification starts the moment a file arrives.

Chaindoc sits on both sides of the document verification process, so it's worth being exact about each.

For files you receive, Chaindoc's verification service runs the checks from the report section on PDF, XML, CAdES and ASiC signatures. You confirm your email with a one-time code before the first check. Validation runs on the European Commission's DSS library, trust is anchored in the EU Trusted List plus the large commercial certificate authorities, and integrity and trust come back as separate results, so an untrusted issuer doesn't read as a tampered document. For a qualified validation in the Article 33 sense, you'd go to a qualified trust service provider that offers one.

Send a document through Chaindoc and the server hashes the file on upload. Publishing it for signing writes that version's hash to a public blockchain, and each signer's proof is recorded there when they complete. Identity checks on signers are optional and come with the paid plans, so you can switch them on for the documents that justify them.

What Chaindoc doesn't do is the phone call in step three or the register lookup in step five. Those stay with you. If you're comparing document verification services, that's a fair test for any of them: which steps the tool covers, and which it quietly leaves to your team.

Print it, pin it in the finance channel, adapt it. A document verification routine only works if it runs on the boring Tuesday invoice as well as the big contract.

• Original saved untouched, hash recorded
• Sender, domain and request normal for this counterparty, or confirmed through a known contact
• Signature validated, report saved, level checked against what the deal needs
• Content matched to an independent source: issuer register, business register, vendor file
• Company found in its official register, and the signer entitled to sign
• Identity check on the signer where the value of the deal justifies it
• Everything filed together, with who confirmed what and when

If a step can't be done, write down why. A gap you've recorded is a decision. A gap nobody noticed is how the expensive cases start.