App used by scammers

[kapoios79-dotcom]

Hello,

I’m not entirely sure if this is the right place to ask, but I thought I would start here.

A client of mine recently asked me to investigate a fraud incident involving their business. An unauthorized party sent an email to one of their customers requesting that banking information be updated for future invoice payments.

The email included a void cheque document as an attachment. Upon reviewing the file metadata, it appears the PDF was generated using pdf-lib.

I’m trying to determine whether there is any way to trace or identify the origin of PDFs created with this library. Specifically, are there any logs, records, or identifiable markers that could help determine who created the document or where it originated from?

For reference, here is the metadata from the PDF:

Any guidance or direction would be greatly appreciated.

Thank you.