Learn · when a document is false

Fake pay stub consequences: the law, and what a lender does

The statute reaches a million dollars and thirty years. The procedure that actually governs a found document is narrower and far more consequential: a hold, a second pair of eyes, a confidential report, and a reason somebody has to write down.

Updated · 12 min read

The consequences of a fake pay stub arrive in two very different registers. In statute, knowingly making a false statement to influence a federally insured lender is a felony carrying up to a million dollars and thirty years, and submitting an altered document to obtain credit can also be charged as bank fraud. In practice, what happens to almost every forged stub is procedural: the file stops, a fraud analyst reads the evidence, a second person signs any decline, a confidential report may be filed that the applicant will never be told about, and the application ends with a specific written reason. Botminds’ Income and Document Verification is built around that second register — it raises the signal with its working attached and holds the file, and a named person decides what the consequence is.

This page describes the law and the procedure. It does not offer a figure for how often an individual consumer-credit applicant is prosecuted, because no public series counts that, and a number invented for the purpose would be the least useful thing on the page. The worked example is a fictional sample file the solution ships with.

What the law says about a false statement to a lender

The central federal provision is 18 U.S.C. § 1014. It reaches “whoever knowingly makes any false statement or report, or willfully overvalues any land, property or security, for the purpose of influencing in any way the action of” a long list of federal and federally insured institutions, where the statement is made “upon any application, advance, discount, purchase, purchase agreement, repurchase agreement, commitment, loan, or insurance agreement or application for insurance or a guarantee, or any change or extension of any of the same” (18 U.S.C. § 1014). The penalty is a fine of up to $1,000,000, imprisonment of up to 30 years, or both.

Four words in that sentence carry almost all the weight, and they are the words a lender’s own procedure has to respect.

What the statute requires, and what a tamper check can and cannot establish

The elementWhat it meansWhat a document check establishes about it
KnowinglyThe person knew the statement was false when they made itNothing. Arithmetic cannot distinguish a forgery from a payroll correction the applicant never looked at
False statement or reportThe document or assertion is untrue in factA great deal — a net figure that is not gross minus deductions is wrong as a matter of arithmetic
For the purpose of influencingIt was made to move a credit decisionPartly: a stub sent with a loan application was plainly sent to support it
The institutionOne of the listed federal or federally insured lenders, or a federally related mortgage loanNothing — this is a fact about the lender, not about the document
Read down the last column and the limit of any automated check is obvious: it can be very good at the second element and is silent on the first and the fourth. That gap is the entire reason a signal is not a finding, and why the procedure below exists.

A second statute covers the same conduct from a different direction. Bank fraud reaches whoever “knowingly executes, or attempts to execute, a scheme” to defraud a financial institution, or “to obtain any of the moneys, funds, credits, assets, securities, or other property owned by, or under the custody or control of, a financial institution, by means of false or fraudulent pretenses, representations, or promises”, with the same maximum of $1,000,000 and 30 years (18 U.S.C. § 1344). Where § 1014 is about the statement, § 1344 is about the scheme, and an application supported by several manufactured documents is more naturally described as the latter.

Is a fake pay stub illegal, or only a declined application?

Illegal, and the two are not alternatives. Making the document, sending it and the lender’s decision to decline are separate events with separate consequences, and the ordinary applicant experiences only the last one.

The distinction underwriters most often get wrong is between the stub and the statement it supports. Generating a template that looks like a payroll document is not, by itself, the offence described in § 1014 — the offence is making a false statement to a covered lender for the purpose of influencing its decision. The document is the instrument; the application is the statement. That is why a lender’s evidence is never the file history alone, and always the combination of the document, the figure it asserts and the application it arrived with.

It is also why the covered-institution element is not academic. A lender that is not federally insured and is not making a federally related mortgage loan is outside § 1014, though state fraud, forgery and false-pretences statutes apply to it, and § 1344 turns on whether a financial institution is involved. None of this changes what the lender does next — but it changes who, if anyone, would ever prosecute.

Can you go to jail for a fake pay stub?

The statutory maximum is thirty years, and the honest answer is that the maximum and the usual outcome are a long way apart. Federal maxima describe the ceiling available for the worst conduct a statute covers — in § 1014’s case, conduct that has included multi-million-dollar schemes against insured institutions — and are not an estimate of what follows an individual’s inflated stub on a personal loan application.

What this page will not do is put a probability on it. No published series counts prosecutions of individual consumer-credit applicants for a single altered pay stub, and the responsible thing to say to someone searching this question is: the exposure is real, it is a felony, the ceiling is severe, and the far more likely immediate consequences are the ones in the rest of this page — a declined application, a specific reason on record, a confidential report you are not told about, and a lender that remembers.

For a lender the asymmetry runs the other way, which is worth saying out loud to any team that handles these files. An accusation of a federal felony is not something to make on the strength of a font. The evidential standard that governs a decline is the lender’s own, it is lower than a criminal standard, and the two should never be confused in the words anybody writes down.

Why a signal does not decline a file

Because the check establishes the wrong element. Every integrity test — gross to net, the statutory tax rates, year-to-date against the pay calendar, balances carried from page to page, a re-save by an editing tool — tests whether a figure is consistent. Consistency failures have innocent causes: a payroll correction, a retroactive adjustment, a stub reprinted after an amendment, a partially scanned page, a document photographed instead of downloaded.

So in the solution a tamper signal does one thing: it holds the file and sends it to the fraud analyst with the evidence. Clearing a signal takes a written reason, and the fraud analyst reviews every cleared signal. Nothing is declined by a check, and no notice goes to the applicant until fraud has decided. The eight checks themselves, and the arithmetic each one runs, are set out in how to identify fake pay stubs; how to measure how often those checks flag a document that turns out to be genuine is in automated income verification.

  1. Agent

    Check

    Runs the integrity checks on every page and raises a signal with the figure or date each sign rests on.

    Never: Never declines or calls fraud — a person decides

  2. Agent

    Hold

    Stops the file where it stands. No decision is issued and no communication goes to the applicant.

  3. A person decides

    Fraud analyst reviews

    Reads every sign against the pages behind it, and decides whether there is a finding or not.

  4. A person decides

    Clear, with a reason

    If the signs are explained, the analyst writes why, and the file resumes. The fraud analyst reviews every clearance.

  5. A person decides

    Or decide against the file

    The verification analyst declines on a specific stated reason, at the verified figures.

  6. A person decides

    Second signature

    Above the analyst’s limit, and on every decline for altered documents, the underwriting team lead co-signs.

  7. A person decides

    Report, where required

    A suspicious activity report is filed if the bank’s thresholds are met — confidentially, and never disclosed to the applicant.

The path a held document takes in Income and Document Verification. Only the first two steps are automatic, and the second of them does nothing except stop. Every consequence that touches the applicant is produced by a person whose name is on it.

Hold, refer or clear: the three ways out

A held file has exactly three futures, and the discipline is that each produces a different artefact. A hold that produces nothing is the state to avoid, because it is indistinguishable from a file nobody opened.

The three outcomes, what each requires, and what each leaves behind

OutcomeWhat it requiresWhat the applicant experiencesWhat stays on the record
ClearedA written reason, reviewed by the fraud analystA short delay, then the file proceeds normallyThe reason, the reviewer and the date — so clearances can be counted
Declined on the documentsA finding by the fraud analyst and a co-signature from the underwriting team leadA decline with a specific principal reason, within the notification periodThe finding, both signatures, the evidence and the reason given
Decided on the merits insteadEnough verified information to decide without relying on the disputed documentAn ordinary decision at the verified figuresWhy the disputed document was not relied on
The third row is the one teams forget. Where a file can be decided without the questionable document at all — because the bank deposits, the payroll response and the tax forms already settle the income — the cleanest route is often to decide on what is proved and never to rest a decision on the disputed page.

Clearances deserve counting for the same reason exceptions do. The OCC’s examiners expect documentation exceptions to be tracked with “appropriate reporting to identify and track exceptions and appropriate analysis to determine causes, impact, and any need for corrective action” (OCC, Retail Lending, version 2.0). A rising clearance rate on one product, or on one analyst’s files, is exactly the kind of pattern that reporting is for.

What does a lender do when it finds a fake document?

Five things, in roughly this order, and only the first is about the document.

What to do, and what to keep, when a document is held

  1. Preserve the document exactly as received

    The original file, with its own internal history intact — not a printed copy, not a re-saved version, not a screenshot of a viewer.

  2. Record the signs with the figures behind them

    “Year-to-date gross identical on two stubs a month apart” is a record. “Tamper suspected” is not.

  3. Decide whether the file can be decided without it

    Where the deposits and the payroll response settle income on their own, the disputed page need not carry any weight.

  4. Apply the reporting thresholds

    A suspicious activity report is a regulatory question with its own thresholds and clock, decided separately from the credit decision.

  5. Write the reason the applicant will receive

    Specific, principal, and capable of being read by someone who may be able to explain it.

The first item is the one most often lost. A document opened, printed and re-filed has had its own history overwritten, which removes the evidence that raised the question in the first place.

Where the loan was nonetheless made and the fraud is discovered afterwards, there is an accounting consequence too: the OCC’s classification guidance is that “fraudulent loans should be classified loss and charged off no later than 90 days from discovery or within the time frames specified in the classification policy, whichever is shorter” (OCC, Retail Lending, version 2.0). Discovery starts a clock in the finance function as well as in the fraud one.

Does a lender tell you it found a fake document?

It tells you the decision, in specific terms. It does not tell you about the report, and it is forbidden to.

On the decision, Regulation B requires that a statement of reasons for adverse action “must be specific and indicate the principal reason(s) for the adverse action”, and that statements resting on “the creditor’s internal standards or policies” are insufficient (12 CFR 1002.9(b)(2)). The Official Interpretations add a point that matters whenever a credit report or any outside source contributed: disclosing that a credit report was obtained and used “does not satisfy the ECOA requirement to disclose specific reasons”, and nor does disclosing the key factors that affected a credit score (Official Interpretations to 12 CFR 1002.9(b)(2)). The two disclosure regimes sit side by side and neither substitutes for the other.

On the report, the position is the opposite of transparent, deliberately. A national bank files a suspicious activity report when it detects a known or suspected federal criminal violation against it or through it, at an aggregate of $5,000 or more “where the bank has a substantial basis for identifying a possible suspect”, or $25,000 or more “regardless of potential suspects” (12 CFR 21.11(c)). And then: “no national bank, and no director, officer, employee, or agent of a national bank, shall disclose a SAR or any information that would reveal the existence of a SAR”, with the rule expressly conditioned on the principle that “no person involved in any reported suspicious transaction is notified that the transaction has been reported” (12 CFR 21.11(k)).

The credit decisionthe applicant is told, specifically
Hold and fraud review
Decision, co-signed
Notice with a specific principal reason, inside the notification period
  • Hold and fraud review
  • Decision, co-signed
  • Notice with a specific principal reason, inside the notification period
The report, if thresholds are metthe applicant is never told
Initial detection of the facts
30 calendar days to file
A further 30 days only if no suspect was identified at detection
  • Initial detection of the facts
  • 30 calendar days to file
  • A further 30 days only if no suspect was identified at detection
Two clocks that start from the same morning and never meet. The reporting rule requires filing no later than 30 calendar days after initial detection, extendable by 30 more only where no suspect had been identified, and in no case beyond 60 days. The thresholds and timing here are the OCC's rule for national banks; the other banking agencies maintain parallel requirements for the institutions they supervise.Source: 12 CFR 21.11, Suspicious Activity Report

Two consequences follow for the people doing this work. Front-line staff must never hint at a report, in a call, an email or a decline letter — the prohibition covers “any information that would reveal the existence of” one. And the credit decision has to be able to stand on its own stated reason, because that reason is the only thing the applicant will ever be given.

The second signature, and why it is on the decline

In the sample lender, the underwriting team lead co-signs above the analyst’s $35,000 limit and on every decline for altered documents, regardless of amount. The second condition is the interesting one, because it is not about exposure. A large approval is co-signed because the money at risk is large. A decline for altered documents is co-signed because the consequence to a person is severe and the evidence is interpretive.

That is the right instinct and it has a straightforward justification: the error that costs most here is not the forgery that gets through, which is a credit loss the lender can size and price, but the honest applicant refused on a misread document, which is a harm the lender cannot see and the applicant cannot appeal. A second reader is the cheapest control against it, and the only one that works on a judgement rather than on a number.

Signing the decision, with the meaning recorded

Signing screen in Income and Document Verification: the analyst signs a decision to approve at verified income with one condition before funding, with the meaning of the signature recorded alongside her name as 'I reviewed the verified figures and decide this application', and a note that a second signature is required above her approval limit.
The signature records a meaning, not just an assent — which is what makes it possible, months later, to tell the person who decided from the person who merely processed.

Is altering a bank statement a crime?

Submitting one to a lender to obtain credit raises the same two statutes as a forged pay stub. An edited statement sent in support of an application is a false statement made “for the purpose of influencing in any way the action of” the institution under § 1014, and a scheme that uses several such documents to obtain money from a financial institution is the conduct § 1344 describes. The medium is irrelevant: a PDF edited in a browser, a spreadsheet printed to look like a statement and a genuine statement with one line painted over are the same act.

For the lender, the practical difference is evidential rather than legal, and it favours the statement. A pay stub asserts a payment; a bank statement is the record of whether that payment happened, which means an altered statement usually has to be altered consistently in several places at once — the transaction line, the running balance, the carried balance on the following page, and the totals. That is why the carried-balance check is so productive, and why the deposit behind each stub is the hardest thing in a file to fake; the method is in pay stub verification against bank deposits.

Five signs, each naming the figure or date it rests on

Tamper signals screen for a flagged sample file: two August pay stubs shown with each sign marked on the page — no deposit in the bank for August, an identical year-to-date gross of $58,500.00 on the 28 August and 25 September stubs, a payroll response recording unpaid leave from 3 to 28 August, advice numbers repeated from July and September, and both stubs re-saved by an online PDF editor on 6 October at 22:51 — with two actions offered, refer to fraud or clear with a written reason.
Five independent signs on one file, three of which come from outside the document. That combination is what a fraud analyst can act on; any one of them alone is a question for the applicant.

Questions people ask

What are the consequences of a fake pay stub?

In law, exposure under 18 U.S.C. § 1014 for a false statement to a federally insured lender, and potentially under § 1344 for bank fraud, each carrying up to $1,000,000 and 30 years. In practice, the immediate consequences are a declined application with a specific written reason, a lender that keeps the evidence, and — where the bank’s thresholds are met — a confidential report to the authorities that the applicant is not told about and that the bank is forbidden to mention.

What is the penalty for loan application fraud?

Under § 1014 the statutory maximum is a fine of not more than $1,000,000 or imprisonment of not more than 30 years, or both; § 1344 carries the same ceiling for a scheme to defraud a financial institution. These are maxima for the whole range of conduct the statutes cover, not an estimate of what follows a single inflated stub, and state fraud and forgery laws apply alongside them.

What does a lender do when it finds a fake document?

It holds the file and refers it to a fraud analyst with the evidence attached. The analyst either clears the signs with a written reason or makes a finding; a decline for altered documents is co-signed by a second person; the reason sent to the applicant must be specific and principal. Separately, and on its own clock, the bank decides whether its suspicious-activity reporting thresholds are met. Where the loan was already made, the OCC expects a fraudulent loan to be charged off no later than 90 days from discovery.

Does a lender tell you it found a fake document?

It tells you the decision and the specific principal reason for it, because Regulation B requires that. It does not tell you about any report. The reporting rules prohibit a bank and its staff from disclosing a suspicious activity report “or any information that would reveal the existence of” one, expressly so that no person involved in a reported transaction learns it was reported.

Can a lender decline an application for a fake pay stub?

Yes — and the reason has to be stated specifically. A decline resting on “our internal standards” is insufficient under Regulation B, and disclosing that a credit report was used does not satisfy the requirement either. In many files the cleaner route is to decide on what is actually proved: where the bank deposits, the payroll response and the tax forms settle income between them, the disputed page need not carry the decision at all.

Does a lender report document fraud?

A national bank must file a suspicious activity report when it detects a known or suspected federal criminal violation involving $5,000 or more where it has a substantial basis for identifying a possible suspect, or $25,000 or more regardless of suspects, no later than 30 calendar days after initial detection — extendable by 30 more only where no suspect had been identified, and never beyond 60 days. The filing is confidential, and management must promptly notify the board or a designated committee.

Income and Document Verification.
See it on your own files.

An agentic solution from Botminds. Every pay stub, bank statement and ID checked against each other in minutes, with what does not add up shown on the page. Book a demo, or explore how it works.