What Fonts Give Away: Typography as Forensic Evidence

In 2017, a prime minister's corruption case turned partly on a font: documents dated 2006 were set in Calibri, a typeface that didn't ship to the public until 2007. The document claimed a history its own letterforms contradicted. That case made "font forensics" briefly famous, but the underlying discipline is broader and quieter: every document carries a typographic fingerprint, and editing almost always smudges it.

Key takeaways

• Fonts are historical artifacts — a typeface that postdates a document's claimed date is a hard contradiction, not a style note.
• Edited fields betray themselves through substitution: the editor's system silently swaps a near-match when the original font isn't installed.
• Sub-visual metrics — baseline position, kerning, letter spacing, stroke weight — drift measurably where text was replaced.
• In PDFs, the font list is machine-readable: duplicate subsets of the same face are a classic edit trace no eyeball is needed for.

The impossible typeface

The bluntest typographic tell is anachronism. Typefaces have release dates; corporate templates adopt them on knowable schedules. A 2004 contract in a font first distributed in 2010 is making an impossible claim, full stop. This category also includes subtler impossibilities: a government form set in a face the agency never used, a bank statement in a font that bank's template history doesn't contain, a "typewritten" 1980s letter with the perfectly uniform strokes only a digital font produces.

Substitution: the editor's silent tell

Here's what actually happens when someone edits a real document. The original was produced with the issuer's fonts — often licensed, often subsetted into the PDF. The fraudster opens it on a machine that doesn't have those fonts. The editor substitutes the nearest available face and, on save, the edited text is re-set in the substitute. To a casual eye, Helvetica-for-Arial-for-Liberation passes. To comparison, it doesn't: different glyph widths reflow the line, terminal strokes differ, the lowercase "a" and "g" are shaped differently, digits sit at different widths.

The practical consequence: the edited field is typographically foreign to its own document. An amount in a font 2% wider than the identical labels around it. A name whose baseline sits a pixel high because the replacement text box didn't align. Spacing that's suddenly metric where the rest of the page is optical.

What the file admits outright

With PDFs you don't have to squint — the file declares its fonts. Two patterns matter most:

• Duplicate subsets. A PDF produced in one pass embeds one subset per face. Editing then re-saving commonly produces two subsets of the same font — the original text's and the edit's. Two subsets of the same face in a "never touched" document is a structural edit trace.
• Producer/typeface mismatch. The fonts embedded should be consistent with the software that claims to have produced the file. A statement "generated by" a bank's rendering system, carrying fonts only a desktop editor bundles, is contradicting itself — the same class of tell as the metadata contradictions we've covered before.

Standards for long-lived documents (PDF/A) actually require full font embedding for exactly this reproducibility reason (iso.org) — which means archival-grade documents give the forensic examiner more material, not less.

Comparison is the method

Typography forensics rarely convicts on one glyph. The method is differential: compare the questioned region against the document's own baseline (same page, same field type), against a known-genuine exemplar from the same issuer, and against the claimed production story. One field set differently from fifty identical siblings is signal. A whole document in a plausible-but-wrong face needs the exemplar. And a face that didn't exist yet needs only a calendar.

From squinting to measuring

Everything above can be done by eye with patience, a zoom tool, and reference specimens — document examiners did it for decades. What's changed is that the measurable parts (embedded font inventories, duplicate subsets, per-span face and size comparison, baseline geometry) are now machine-checkable in seconds across every page, which is precisely the kind of tireless comparison an automated forensic document scan performs as a matter of course. The fraudster has to match the fingerprint perfectly. The examiner only has to find one smudge.

Frequently asked questions

Can font analysis alone prove forgery?

An anachronistic typeface can, on its own, prove a date is false. Substitution and spacing anomalies are strong corroborating evidence rather than standalone proof — real-world workflows do occasionally re-set text innocently. The strength comes from convergence with metadata and structural findings.