How to spot a fake pay stub: the arithmetic that cannot be faked

To spot a fake pay stub, stop looking at the paper and recompute it. Four tests catch most fabricated stubs in under a minute each: does year to date divide into a whole number of pay periods that matches the pay date, do Social Security and Medicare come out at 6.2% and 1.45% of gross, does net pay equal gross less the deductions the stub itself lists, and does the bank statement show payroll arriving at all. Botminds' Auto Loan Fraud Detection runs all four on every stub in a funding package before a fraud analyst opens the case, alongside a forensics read of the file itself, so the first thing the analyst sees is the finding rather than the document.

The worked example below is sample data in Auto Loan Fraud Detection, on a fictional applicant and a fictional employer. The rates and the pay-period figures come from the IRS and the Bureau of Labor Statistics, linked where they appear.

How to spot a fake pay stub: start with the arithmetic

Fabricated stubs are made to look right, and they usually do. The generators are good: the layout is a real payroll template, the fonts are consistent, the employer logo is in the corner, the figures are plausible for the job title. What they are bad at is internal consistency, because a person typing a target net pay into a form is working backwards from the number they need and the template fills the rest.

That is why the order of the tests matters. A visual inspection asks "does this look like a stub", which a good forgery passes. Arithmetic asks "can these numbers all be true at once", which a forgery almost always fails. And arithmetic has a second advantage in a fraud file: it is reproducible. An analyst who writes "year to date is 14 pay periods and 30 September is the 18th" has stated a fact a second signer can check in ten seconds, which is worth more at a funding desk than a note that the stub looked wrong.

The Red Flags Rule's own illustrative list puts the same two documents side by side: red flag 5 is that "documents provided for identification appear to have been altered or forged", and red flag 9 is that "an application appears to have been altered or forged, or gives the appearance of having been destroyed and reassembled" (16 CFR 681, Supplement A). Both are detection duties, and the programme the rule requires is where a lender writes down how it will meet them.

What does year to date mean on a pay stub, and why it is the first test

Year to date is the running total of a figure — gross pay, a tax, a deduction — from the first pay date of the calendar year to the one on the stub in your hand. It is the first test because it is the only line on a stub that has to agree with the calendar, and a calendar is not something an applicant controls.

The arithmetic is division. Take year-to-date gross, divide by the gross for the period, and you have the number of pay periods the stub claims have been paid. Then count the pay dates that had actually occurred by the date on the stub. If the two numbers differ, either the pay rate changed during the year — which the stub should show, and the applicant can explain — or the figure was typed.

In the sample case the stub is dated 30 September and the employer pays semi-monthly, on the 15th and the last day of the month. Nine months of that calendar is 18 pay dates. Year-to-date gross is $61,250.00 and gross for the period is $4,375.00, which divides into 14. Fourteen periods, not 18: four pay dates, $17,500.00 of gross, that the stub says were never paid in a job the application describes as four years and two months long.

Counting pay dates needs the pay frequency, and that is worth asking for rather than assuming. Across US private establishments the Bureau of Labor Statistics measured biweekly as the most common at 43.0 percent, with weekly "almost as common, with 27.0 percent of private establishments paying employees each week", semimonthly at 19.8 percent and monthly at 10.3 percent in February 2023 (BLS, Current Employment Statistics). Biweekly and semimonthly are the pair that trips analysts up: 26 pay dates a year against 24, and a stub built on the wrong one is off by two periods before anybody lies.

How much social security is withheld from a paycheck, and what the stub should show

The two payroll taxes on a US pay stub are set by statute, so they are the easiest lines on the document to check and the ones forgeries most often get wrong. IRS Publication 15 for 2026 states it plainly: "The rate of social security tax on taxable wages is 6.2% each for the employer and employee. The social security wage base limit is $184,500. The Medicare tax rate is 1.45% each for the employee and employer, unchanged from 2025. There is no wage base limit for Medicare tax" (IRS Publication 15). Above $200,000 of wages in a year, an employer also withholds the 0.9% Additional Medicare tax (IRS Topic no. 751).

So on gross of $4,375.00 the employee's Social Security line should read $271.25 and Medicare $63.44. The sample stub shows $262.50, which is 6.0% — not a rate any employer uses, and not a rounding error. Two things follow. First, the figure was chosen rather than computed, and the direction tells you why: $8.75 less withheld is $8.75 more net pay, and net pay is the number a forger is working backwards from. Second, every other deduction on that stub is now unverified, because the one line with a legally fixed answer got the wrong one.

Three cautions before treating a tax mismatch as a finding. Social Security stops at the wage base, so a high earner late in the year legitimately shows no Social Security withheld at all. Medicare never stops. And some workers — certain state and local government employees, some students, some religious exemptions — are genuinely outside one or both taxes, which the stub will usually show as a zero line rather than a wrong rate.

Does net pay equal gross less the deductions shown?

This is the test that costs nothing and is skipped most often. A stub lists gross, then a column of deductions, then net. Add the column and subtract. On a real stub the three numbers reconcile to the cent, because a payroll system produced all three from the same calculation. On a fabricated stub they reconcile only if the forger did the subtraction, and the figure they most want to control is net.

The $8.75 is small and that is the point. It is not an amount anybody is trying to steal; it is the signature of a number that was entered rather than calculated. A fraud file built on "the Social Security line is withheld at 6.0% and net pay is $8.75 higher than the correct line produces" is a file that survives a second signature, an audit and a conversation with the dealer.

Does the bank statement show payroll at all?

A stub says what an employer paid. A bank statement says what arrived. The second is better evidence, because the applicant does not author it, and in the sample case it is the finding that settles the file.

The fictional Lakeview Community Credit Union statement has no edits at all: one typeface, one compression level, every running balance ties. What it shows is the problem. The pay arrives as $3,140.00 transfers through a consumer payment app, described as "from B LOGISTICS", not as a payroll direct deposit — and each one is $80 less than the stub's net pay. Over two periods a month that is $6,280 deposited, against $6,440 of net pay on the stubs and $8,750 of gross income on the application — and none of it labelled as payroll.

App transfers are not proof of fraud. Small employers pay people that way, and a genuine worker at a three-person firm may never have seen a payroll deposit. What the pattern does is move the burden: the stub is no longer corroborated by anything the applicant did not make, and the lender has to get income from a source the applicant cannot edit.

A genuine statement, and no payroll on it

How to tell if a PDF pay stub has been edited

Arithmetic catches the numbers. The file catches the editing, and a PDF carries more about its own history than the person who altered it generally realises. Four signals do most of the work.

Text that was re-set. Characters typed over an existing document rarely match the surrounding text exactly: a different typeface, a size out by a fraction of a point, a baseline a pixel above the line. In the sample stub net pay of $3,220.00 is set in a different typeface, 0.4 pt larger and 1 px above the line of the figures around it.

Areas saved separately from the page. A scanned stub is one image at one compression level. When a region has been replaced, it is usually saved at a different quality from the page it sits in, and the boundary is visible as a rectangle under analysis even when it is invisible to the eye. In the sample case the employer logo was pasted on top and the net pay area is at a different compression from the rest of the page.

Objects and layers that should not exist. A payroll system's PDF has a predictable structure. Editing tools leave their own: annotation objects, incremental saves, form fields where there should be flattened text, white rectangles covering an older figure.

The document's own metadata. Producer and creation and modification times do not prove anything on their own — a legitimate stub downloaded and re-saved by the dealer will show both — but a creation time after the pay date, or a producer that is a consumer image editor, is a question worth asking.

The edits a person reading a PDF cannot see

How do you verify an employer is real?

A stub from an employer that does not exist is a harder fabrication to unwind than a wrong tax line, because the fraud has built the whole context. Three public checks, in this order, settle most cases.

When was the company formed? State business registries are public and dated. In the sample case the fictional Brightwater Logistics LLC was formed in Wyoming on 9 June 2026, four months before an application that claims four years and two months of employment there. That single date is the strongest fact in the file: it is not an opinion about a document, and it comes from a source neither the applicant nor the dealer wrote.

How old is the website? Domain registration dates are public. A company with a four-year payroll and a two-month-old domain is possible and not common; in the sample case the domain was registered on 21 August 2026.

What kind of phone is it? The number on the application is not evidence of anything, and this is the rule worth writing into policy: an applicant who supplies both the employer and the employer's phone number has supplied one fact, not two. In the sample case the number given, an internet line, goes to voicemail. A call for verification goes to a number found independently — from the registry, the state licence, the company's own public listing — and the solution's income and employment agent is explicitly barred from treating the application's own phone number as proof, and from making the call itself.

The Red Flags Rule anticipates the same family of signals from the other direction. Supplement A's illustrative list includes a phone number that "is invalid, or is associated with a pager or answering service", an address that "is fictitious, a mail drop, or a prison", and a phone number "the same as the number provided on a fraudulent application" (16 CFR 681, Supplement A). An employer check is a red-flag detection step whether or not a programme calls it one.

Form 4506-C, and how lenders verify pay stubs they cannot trust

When a stub fails, the answer is not a better stub. It is income from a source the applicant cannot edit, and there are two: the employer's own payroll data, and the IRS.

The IRS route is the Income Verification Express Service. "The IRS Income Verification Express Service (IVES) lets you authorize banks and lenders to access your tax records when you apply for a mortgage, loan, or other service. The IRS only provides tax records to a third party with the consent of the taxpayer," and lenders "submit transcript requests online or by fax with Form 4506-C, IVES Request for Transcript of Tax Return" (IRS, Income Verification Express Service). Three things about it matter at an auto funding desk: it requires the applicant's signed consent, it returns what was filed rather than what is being earned now, and it takes days rather than minutes — which is why it belongs in a stipulation policy at a stated-income threshold, not in every deal.

In the sample lender's settings, stated income above $6,000 a month requires payroll data or an IRS transcript, with "two pay stubs and a bank statement" and "IRS transcript only" as the alternatives, and the pay-stub arithmetic tolerance is $5 per line. Those are policy choices, not findings, and they are the two settings most worth arguing about when choosing a fraud system: a $25 tolerance passes the sample stub's $8.75 Social Security error, and a $1 tolerance will flood the desk with rounding.

What to do when a stub fails

A failed stub is a request, not a decision. The deal is not declined because arithmetic did not tie; it is declined, or funded, on whether income can be verified from somewhere the applicant does not control. Keeping those two sentences apart is what makes the file defensible.

The practical sequence is short. Write the finding as arithmetic, with the two numbers and the rule that produced them. Raise the stipulation your policy requires at that stated income. Verify the employer from a number you found yourself. If the income cannot be verified, the adverse action reasons are about verification, not about forgery — Regulation B requires the reasons to be "specific and indicate the principal reason(s)", and says a statement that the applicant "failed to achieve a qualifying score on the creditor's credit scoring system" is insufficient (12 CFR 1002.9(b)(2)). "Unable to verify income" is a reason. "Fraud score 912" is not.

And keep the criminal question where it belongs. Knowingly making a false statement on a loan application to influence a federally insured bank or credit union carries up to $1,000,000 and up to 30 years under 18 U.S.C. §1014 — a matter for prosecutors, not for a funding desk at 15:00. Where the pattern is bigger than one deal, the referral goes to the team that files suspicious activity reports, and the credit history on the same application is usually where the second half of the story is.

To see the recomputation, the forensics lens and the employer checks on one package, start from Auto Loan Fraud Detection.

Questions people ask

Can you tell a fake pay stub from a real one just by looking?

Not reliably, and it is the wrong question to ask of a document. Modern stub generators reproduce real payroll layouts, and the visual cues analysts are taught — misaligned columns, a wrong logo, a spelling error — appear in genuine stubs from small employers too. What a forgery cannot do is make four independent calculations agree: year to date against the pay calendar, the two statutory tax rates, net pay against the deduction column, and the stub against the bank.

What is the single fastest check on a pay stub?

Divide year-to-date gross by gross for the period and compare the answer with the number of pay dates that had been paid by the stub's date. It takes one division, uses only figures printed on the document, and in the sample case it returns 14 against 18 — a $17,500 discrepancy found before anything else is opened. Its one prerequisite is knowing the pay frequency, because 26 biweekly dates and 24 semimonthly dates give different answers.

Is a bank statement better evidence than a pay stub?

For income, usually yes, because the applicant did not write it. A statement shows what arrived, with running balances that have to tie, and payroll deposits that name the employer. Its limits are real: it shows net rather than gross, it misses income paid in cash, and it can itself be fabricated — which is why the first thing to test on a statement is whether every running balance reconciles, as it does on the genuine statement in the sample case.

Does a lender have to call the employer?

No rule requires it, and whether it is worth doing depends on what the call can establish. A call to a number the applicant supplied proves nothing; a call to a number found in a state registry or a public licence confirms that the employer exists and, sometimes, that the person works there. In Auto Loan Fraud Detection the agents never make the call: they assemble the independently found number and the formation, domain and phone-type evidence, and a person decides whether to dial.

What is Form 4506-C, and how long does a transcript take?

Form 4506-C is the IRS request that lets a lender obtain a borrower's tax transcript through the Income Verification Express Service. It needs the taxpayer's consent — the IRS "only provides tax records to a third party with the consent of the taxpayer" — and it returns filed history, so it answers "what did this person earn last year" rather than "what are they earning now". Turnaround is measured in days, which is why most auto lenders apply it above a stated-income threshold rather than on every deal.

What happens to an applicant whose stub fails the arithmetic?

In a well-run file, they are asked for something better before anything else happens. A stub that does not tie can be a payroll error, a mid-year pay change or a poorly produced copy, and the request — payroll data, a transcript, two more stubs — resolves most of them. Where income still cannot be verified, the decision and the notice should both say that, and nothing more: the reasons an applicant receives have to be the reasons the lender actually relied on.