How to Verify a Signed Document Someone Sent You

The side of signing nobody writes about

Almost everything written about e-signatures assumes you are the sender — you built the envelope, you watched it complete, you trust it because you ran it. But half the time you are on the other side: a vendor, a counterparty, or a new hire emails you a PDF that says "signed," and you are being asked to rely on a document you did not create and did not watch get signed. How do you know it is genuine, unaltered, and signed by the person it names — and not a doctored copy or an outright fabrication?

This is the recipient's checklist: how to verify a signed document someone hands you, using the evidence baked into a properly executed e-signature rather than a hopeful glance at a signature image.

Why "it looks signed" proves nothing

Start by discarding the instinct that a visible signature means anything. A signature image — a cursive name on the page — is trivial to copy, paste, or generate. Anyone can drop a picture of a signature onto a PDF in a free editor. The visual mark is the least trustworthy part of an e-signed document, which is exactly the opposite of how it feels. As the difference between an electronic signature and a digital signature makes clear, the trust does not come from the mark; it comes from the cryptographic and procedural evidence wrapped around it.

So when someone sends you a "signed" PDF, the real question is not "does it have a signature on it?" It is "what evidence travels with it, and does that evidence check out?"

Ask for the audit certificate

The single most useful thing you can ask for — and should expect with any serious agreement — is the audit certificate, the evidence package that a real signing platform generates when an envelope completes. This certificate is the verification artifact. A properly produced one records:

• Who signed, with the email, name, and any identity-verification step that was applied.
• When each event happened — sent, viewed, signed — as a timestamped sequence.
• From where — the IP address and device for each action.
• The document's fingerprint — the SHA-256 hash of the exact file that was signed.

If the document came with no certificate and the sender cannot produce one, that is your first red flag. It does not prove fraud, but it means you are being asked to trust a bare image with nothing behind it.

Check that nothing changed since signing

The certificate's hash is what lets you confirm the file you are holding is the file that was actually signed — not a version altered afterward. The principle is simple: the SHA-256 hash is a fingerprint of the exact bytes of the signed PDF. Re-compute the hash of the file you received and compare it to the hash recorded in the certificate (or in the platform's verification page, where one exists). If they match, the document is byte-for-byte what was signed. If they differ — even by a single character changed in the body — the hashes will not match, and you know the file was tampered with after signing.

This is the heart of why an audit trail holds up: it converts "trust me, I didn't change it" into something you can independently check, without trusting the sender at all.

Verify the signer actually had authority

Integrity is not the only question. A document can be unaltered and genuinely signed and still not bind the other side — if the person who signed lacked the authority to. When the counterparty is a company, confirm the signer was someone who could commit it, the way our guide to signing on behalf of a company lays out: the right title, a proper signature block naming the entity, and — for anything significant — evidence they were authorized to sign for it. A junior employee's valid signature on a contract their company never empowered them to sign is a real exposure, and it is one only you, the recipient, are positioned to catch.

A recipient's verification checklist

Put it together into a habit you can run on any signed document handed to you:

• Ignore the signature image. It proves nothing on its own.
• Get the audit certificate. No certificate, no verifiable signature — ask for it.
• Confirm the hash matches. Re-compute or use the platform's verify page to prove the file is unaltered since signing.
• Read the trail for "who" and "when." Check the signer's email, the identity method used, and that the timestamps make sense.
• Confirm authority. Make sure the signer could actually bind the party they signed for.
• Keep the verified package. Once it checks out, archive the PDF and its certificate together so you can prove what you relied on, years later.

The takeaway

Verifying a signed document you received is not about squinting at the signature — it is about checking the evidence around it. Demand the audit certificate, confirm the SHA-256 hash matches so you know nothing changed since signing, read the trail to see who signed and how their identity was checked, and make sure that signer actually had authority to bind their side. A document that passes all four is one you can rely on with confidence; one that fails any of them deserves a question before you act on it. When you are the one sending, run signing on a platform that produces this evidence by default — so the people relying on your documents can verify them the same way.

This article is general guidance, not legal advice. For questions about a specific document's enforceability or a signer's authority, consult qualified counsel.