| Issuing software | Creator and Producer compared with the utility's billing chain | Word, Canva, a PDF editor or an online template instead of the utility's chain |
| File dates | Creation and modification dates, compared with the statement date | A file created or edited after the statement date, rewritten or missing dates |
| Saved versions | Versions appended at the end of the file, dormant objects | The old address or name stays in the file: Koncile rebuilds the before and after |
| Fonts | Embedded fonts, subsets and encoding, compared with bills from the same utility | An address retyped in another font, or embedded differently from the rest |
| File writing style | Object order, cross reference table, stream compression | pypdf, MuPDF or a Python script instead of the utility's chain |
| Text layer | Match between the displayed text and the encoded text | Visible text that differs from the extracted text, an old address still in the layer |
| Bill dates | Statement date, service period, meter read dates and due date | A newer statement date that no longer fits the service period or the due date |
| Account number and totals | Account number format, usage, rates, fees and taxes recalculated | A number in the wrong format, a total that does not add up |
| Holder and service address | Name and service address compared with the ID document and the rest of the file | An address that changes from one document to the next, a P.O. box or a mail drop |
| Image | On a scan or a photo: edited areas and AI generated parts, with K-Detect | A white patch under the address, text laid over the original image |