Yes, you can verify site report files in two steps if the report came from Verafii. Scan the QR code on the PDF to open a public verification page, then drop in the file you received. The page tells you whether the file is untouched. You need no account and no app, and nothing is uploaded. This post is for clients, PMCs (project management consultants) and engineers who pay for work. It covers why files change, what a fingerprint is, how to check, what to ask for if it fails, and what a match cannot prove.
Why is a PDF or a photo easy to change?
A PDF or a photo is just a file, and many free tools can edit one without leaving a mark you can see. You receive only the final picture, so without a check built into the report you are trusting the sender.
Here are the ways a report reaches you, from the weakest evidence to the strongest.
1. A screenshot or a forward
Each copy is one step further from the original. WhatsApp and similar apps compress images and often drop location data from the file. Nobody can tell which step changed something. Our post on why WhatsApp isn't enough for progress photos explains this in detail.
2. An ordinary phone photo or an edited PDF
The date on a normal phone photo comes from the phone's own clock, which the user can change. A date, a measurement or a name in a PDF can be retyped in an editor, and the page still looks normal. An old photo from another site can also be placed into a new report.
3. A stamped photo with typed-in details
Some apps print a date and place on the picture, but the picture can still come from the gallery. The stamp then shows only what was typed or what the phone claimed.
4. A live-captured photo with a fingerprint on record
Here the photo is taken inside the camera, GPS and time are burned into it, and a fingerprint of the report is kept. Any later change shows up as a mismatch. This is the level the rest of this post explains.
What is a file fingerprint, in plain words?
A fingerprint is a short code worked out from the contents of a file. Change even one dot in a photo, and the code changes completely. Keep the file the same, and the code is always the same.
Think of it as a seal on a packet. The seal does not tell you what is inside. But if the packet is opened and resealed, it no longer matches the seal on record.
The technical name is a hash. Verafii uses SHA-256, a standard method published by the US standards body NIST in FIPS 180-4, the Secure Hash Standard. You do not need to know how it works to use it.
One SHA-256 fingerprint covers the PDF, every photo and every video in the report. The fingerprint is on record, so anyone can later work out the fingerprint of the file in front of them and compare the two.
The comparison is exact. A file that looks the same to your eye but was re-saved, compressed or edited will give a different code.
How do you check a Verafii report, step by step?
You need only the file and a phone or laptop with a browser.
How to check a Verafii report
- Open the PDF you received and find the QR code on the report.
- Scan it with your phone camera or any QR reader. It opens a public verification page. You do not sign in or install anything.
- Drop the file you received onto the page. It must be the same file the contractor sent, not a screenshot of it.
- Read the result. Your browser works out the fingerprint on your own device, and nothing is uploaded. A match means the file is untouched.
Verafii's own page on how to check a Verafii report covers the same steps.
If you are on a phone
Scan the QR from the printed report or from another screen. Then save the PDF to the phone and choose it on the verify page.
If you are on a laptop
Scan the QR with your phone to open the page, or open the link on the laptop, then drag the PDF in from your downloads folder.
If it came on WhatsApp
Download the PDF as a document if the app offers that choice. Then drop that file in. Opening the PDF and taking a screenshot gives a different file, and it will not match.
What does the verify page show, including a fake-location flag?
The report carries the location, device and time of the capture, with the customer's logo and a QR code. The verify page lets you confirm the file against the record and see whether anything was flagged.
- Location: where the photos were taken. Compare it with the site address you know.
- Device: the phone used for the capture.
- Time: when it was captured, stamped at the shutter rather than typed in later.
- Fake-location flag: if a photo was taken with a fake GPS app, it is flagged on the photo, the report and the verify page. This works on Android and iPhone.
Fake GPS is flagged, not made impossible, so read the page and do not treat a clean page as full proof.
GPS also drifts by tens of metres indoors, in basements and near tall buildings. A small gap between the pin and the site is common. Check the address before you doubt the crew.
What signs suggest something may be wrong?
Some signs appear before you even run the check. Look for these on any site report, from any sender.
- No QR code: the report has nothing you can check against.
- A cropped or covered QR: the code is cut off, blurred or pasted over.
- A screenshot instead of a file: the sender cannot give you the original.
- A fake-location flag: a photo is flagged on the report or the verify page.
- A location far from the site: the pin is many kilometres away, not just a few metres.
- A mismatch on the file check: the fingerprint does not agree with the record.
- The same scene in two reports: photos that repeat across dates or sites.
These are reasons to ask a question, not proof of wrongdoing. Many have an ordinary explanation.
If it doesn't match: what should you ask for?
A mismatch means the file you dropped is not exactly the file on record. The cause is often harmless. A PDF that was printed and scanned, re-saved, compressed by an email service or merged with other pages will no longer match.
Ask the contractor for these, in this order:
- The original PDF, sent as a document and not as a photo or screenshot.
- The report link or QR, so you can open the verify page directly.
- An explanation of any edits: did someone merge pages, compress the file or add a cover sheet?
- A fresh report from the same job, if the original cannot be found.
Ask before you accuse. If the contractor cannot produce a file that matches, you can treat the report as unverified and ask for other evidence, such as a site visit or a measurement check. What you accept is your decision, or your department's.
What can't a match prove?
A match proves one thing: the file is the same as when the report was made. It proves nothing beyond that.
- The work is good: a match says nothing about quality, strength or compliance with the specification.
- The scene was not staged: someone can photograph a prepared scene at the right place, and the photo will still match.
- What happened before capture: the report cannot show what was done to the site before the photo.
- Perfect GPS: GPS can drift, and a flag catches fake-location apps, not every trick.
- Acceptance: whether a department, insurer, court or client accepts a report is their decision.
Sound proof needs several things together: the original file, a record made at the time and place, and a way for a third party to check it. For work that matters, add a site visit, a measurement book check or a test certificate. The measurement book is the official record of measured quantities.
For contractors: how do you send reports clients can check?
If you are the contractor, make the check easy for the person paying you.
- Send the original PDF: attach it as a document. Do not screenshot it or paste it into another file.
- Keep the QR visible: do not crop or cover it when printing.
- Make the report on site: Verafii's one-tap report is made before you leave. See the GPS camera photo report page for how capture works.
- Tell the client how to check: one line is enough: "Scan the QR, then drop in this file."
- Keep comments separate: send notes in a message, not inside the PDF.
Verafii captures photos and video live in its own camera, with no gallery or file picker. It works offline and uploads when the phone is back online, and every photo, video and note lands in one numbered job record. A site inspection app built this way gives your client something to check.
Reports and photo watermarks are in English, even though the app has 11 languages.
Frequently asked questions
How do I verify a site report from a contractor?
If the report is from Verafii, scan the QR code on the PDF. It opens a public verification page with no sign-in. Then drop in the file you received. A match means the file is untouched since the report was made.
Is my file uploaded when I check it?
No. Dropping the file in works out its fingerprint inside your browser, and nothing is uploaded. You need no account and no app.
What is SHA-256 and who publishes it?
SHA-256 is a standard method that turns any file into a short code, so a changed file gives a different code. It is specified by the US standards body NIST in the Secure Hash Standard, FIPS 180-4. Verafii uses one SHA-256 fingerprint for the PDF, every photo and every video.
Why doesn't my WhatsApp copy of the report match?
A screenshot, a re-saved copy or a compressed forward is a different file, so it will not match. Ask the contractor for the original PDF sent as a document. A mismatch alone is not a reason to assume bad intent.
Does a match mean the work was done well?
No. A match shows only that the file is unchanged. It cannot show that the work is good or that the scene was not staged. Use it with a site visit or tests where the work matters.
Can Verafii detect fake GPS?
Verafii flags a photo taken with a fake location, on Android and iPhone. The flag appears on the photo, the report, the verify page and the dashboard. It is a prompt to ask a question, not proof by itself.
Will Verafii make sure my reports are accepted?
No. Whether a client, department or insurer accepts a report is their decision. Verafii shows what the report contains: location, device, time and a fingerprint anyone can check.
Send reports your clients can check
Try Verafii free for 30 days, with a call at the end to decide whether to continue. You can start the free trial today, or ask for a quote by replying to us. The price depends on your team: field agents, admin users, how long evidence is kept, and photo and video quality.
