Sucks that I have to preface but people can be jumpy here. This is genuine curiosity, I’m actually asking, because it’s really probably something I should already know. Can you explain the nuance to me please?
My understanding, speaking mostly of apps/websites, I know jobs can be much different:
Most places have the first factor as a password.
First factor (or “login”) = username+password pair.
For the longest time that was all there was, “your login” was just a login, which meant a username and password combination. Then 2FA/MFA (“2 factor authentication / multi-factor authentication”) came along in the form of username+password combo plus SMS/email/Google Authenticator/Yubikey/etc to verify as the 2nd form of authentication. You can have 3FA 4FA 5FA whatever if you want and if it’s supported by the app/website. So 2FA is MFA, but MFA is not necessarily 2FA.
I know jobs can be set up a lot differently.
Unfortunately that wouldn’t work as this is information inside the PDF itself so it has nothing to do with the file hash (although that is one way to track.)
Now that this is known, It’s not enough to remove metadata from the PDF itself. Each image inside a PDF, for example, can contain metadata. I say this because they’re apparently starting a game of whack-a-mole because this won’t stop here.
There are multiple ways of removing ALL metadata from a PDF, here are most of them.
It will be slow-ish and probably make the file larger, but if you’re sharing a PDF that only you are supposed to have access to, it’s worth it. MAT or exiftool should work.
Edit: as spoken about in another comment thread here, there is also pdf/image steganography as a technique they can use.