How journalists verify a leaked document before publishing
How responsible journalists test a leaked document: provenance, consistency, metadata, public records, corroboration, source protection and honest disclosure.
Published 18 October 2026, Method
Why verification comes first
A leaked document can be the strongest evidence a story has. It can also be forged, altered, taken out of context or planted to mislead. Publishing a fake harms the people named, misleads readers and can expose the source. For these reasons, responsible newsrooms treat every leaked document as unverified until the evidence says otherwise. This guide explains how journalists test documents. It does not cover, and we will never advise on, obtaining documents unlawfully.
1. Provenance: where did it come from?
Start with the chain of custody. Who supplied the document? How did they come to hold it? Were they in a position to see it in the ordinary course of their work? Is this the original, a copy, a scan or a photograph of a screen? Each step away from the original adds room for error or tampering.
Ask the source to explain in their own words, and note what they say. A source does not need to prove everything, but their account should fit the document. If a junior clerk supplies a cabinet-level file, ask how they saw it. Be alert to documents that arrive unsolicited at a politically convenient moment.
2. Internal consistency
Read the document as an insider would. Forgeries often fail on small details.
- Format and layout. Compare letterhead, fonts, margins, crests and file-note layout with authentic documents from the same body and period.
- Reference numbers. Government files usually follow a numbering pattern by office, section and year. Check that the number fits.
- Dates. Does the date fall on a working day? Do the events described match what was public at the time? Were the officials named in post on that date?
- Signatures and designations. Compare signatures and titles with published orders or notifications. Note that a matching signature can be copied.
- Terminology. Ministries, ranks and units are renamed over time. A document using a name that did not exist yet is a serious warning.
- Language and logic. Does the content make sense for its stated purpose and audience?
3. Metadata
Digital files often carry hidden data: author names, organisation names, software versions, creation and edit dates, and for photos, device and location details. Journalists may examine metadata on a working copy as one more line of evidence. Metadata can be edited or stripped, so it supports or questions a document but cannot prove it on its own.
Metadata can also identify the person who handled a file. That is why sources should remove metadata before sharing, and why journalists must never publish original files without checking them. See how to remove metadata before sharing.
4. Image and PDF forensics, at a high level
Basic checks can reveal editing. Look for text in slightly different fonts or alignment, uneven backgrounds around edited areas, mismatched compression in parts of an image, and PDFs with several revision layers. Scans of printed pages can carry their own traces: some colour laser printers add tiny, nearly invisible tracking dots that can identify the printer. Use specialist help for anything beyond simple checks, and work only on copies.
5. Check against public records
Test every checkable fact in the document. Do the companies exist and match their registry entries? Do the contract numbers appear on a procurement portal? Does an audit report mention the same project? Were the officials named in the posts claimed on that date? See how to check company ownership, how to search public tenders and how to read an audit report. Our evidence page explains how we grade what we hold.
6. Corroboration
Look for a second, independent source: another person in a position to know, a separate document, or a public record that confirms the key facts. Independent means the second source did not get the information from the first.
Before publication, put the substance of the document to the issuing body and the people named, and invite a response. They may confirm it, deny it, or point to a later version. Describe the document carefully rather than sending the original, which could carry markings that identify a source. Our right of response policy sets out how we do this.
7. Protect the source while you verify
Verification can expose a source if done carelessly. Some documents are issued in numbered or slightly different copies, so a small detail may reveal whose copy it is. Limit who in the newsroom sees the original. Do not share the file with the subject of the story. When quoting, paraphrase where exact wording could identify the copy, and consider publishing a retyped extract rather than an image. Never use a work device or work network to contact a journalist, and journalists should not ask sources to. See source safety dos and don'ts.
8. Tell readers what you know and don't
Readers deserve to know how strong the evidence is. Say what checks were done, what corroborated the document and what could not be confirmed. Use precise language: “a document seen by” is different from “a document verified by”. Report the issuing body's response, including a refusal to comment. If new information later changes the picture, correct the story openly. See our standards and corrections policy.
Do
- Record the chain of custody from the start.
- Compare against authentic documents from the same office and period.
- Check every name, date and number against public records.
- Seek a second independent source and a response from those named.
- Work on copies and limit who sees the original.
- Tell readers what was and was not verified.
Don't
- Publish because a document “looks official”.
- Rely on metadata or a signature alone.
- Send the original file to the issuing body or the subject.
- Publish images that could reveal which copy was leaked.
- Ask a source to obtain more documents, break rules or take risks.
- Use work devices or networks for any contact with sources.
If you hold documents you believe show wrongdoing, read whistleblower laws in South Asia first, then use our secure tip form.
This is general information, not legal advice.
Frequently asked questions
How do journalists know a leaked document is real?
No single test proves it. Journalists combine provenance, internal consistency, comparison with authentic documents, checks against public records and independent corroboration, then seek a response from the issuing body.
Can metadata prove a document is genuine?
No. Metadata can be edited or removed, so it is only one line of evidence. It can also identify the person who handled the file, which is why sources should remove it before sharing.
Will a newsroom show my document to the organisation it came from?
A careful newsroom describes the substance of the document when seeking comment rather than sending the original, because the file or its markings could identify the source.
What if a document cannot be fully verified?
A newsroom may hold the story, seek more corroboration, or publish with clear wording about what was and was not confirmed. It should never present an unverified document as proven.
Should I send journalists the original file or a photo?
Read our guidance on removing metadata and on source safety first. Never use a work device or work network to contact a journalist.
Sources
- eff.org/issues/printers
- datajournalism.com/read/handbook/verification-2
- gijn.org/