Income and document verification, explained.

Why a lender asks to see proof of the income you wrote on the application

The path of one referred application, in five steps

1. The applicant appliesOnline, on a Friday: $15,000 for home repairs, $84,500 a year stated, paid every two weeks.
2. The decision engine refers the fileThe credit report and stated income do not clear the automatic rules, so the file goes to a queue with a list of documents to request.
3. A person verifies the income and documentsPay stubs, W-2, bank statements, payroll record and ID read and compared. This is where Kayla Brandt's two August stubs with no deposit behind them are found, or missed.
4. The lender decidesApprove at the stated or the verified income, ask for a missing document, send the file to fraud, or decline with specific reasons.
5. The loan performs, or it does notAn income that was never real shows up months later as an early missed payment, and a loss.

Step 3 is the subject of this guide. The people, employers, banks and figures in the examples are fictional.

Income verification facts that surprise lenders

Referred file, verified income, stip and tamper signal

Fourteen terms are defined in the one-page summary.

Which personal loan and card applications get a person checking the income, and why most never do

In shortFederal rules ask card issuers to consider ability to pay and let them rely on stated income; no federal rule tells a personal lender how to verify. So lenders decide most files automatically and send a share to people, usually when the stated income is high for the credit profile, includes side or gig income, or disagrees with what the bureau and the data show.

Three products, three different starting points. A credit card issuer must keep "reasonable written policies and procedures" to consider the applicant's ability to make the minimum payments "based on a consumer's income or assets and a consumer's current obligations".1 An applicant under 21 must show "an independent ability" to pay. The issuer may rely on the stated salary, income or assets without further inquiry.2

A personal loan has no federal ability-to-repay rule; the rule that requires verified income, 12 CFR 1026.43, covers mortgages. A mortgage sold to Fannie Mae needs a pay stub "dated no earlier than 30 days prior to the initial loan application date" showing year-to-date earnings, plus W-2s.6

Many consumer lenders borrow that 30-day convention for their own pay stub rule.

Why a file gets referred

Each lender writes its own referral rules, so no public source says what share of consumer applications go to a person, as of October 2026. Common reasons, from lenders' policies and the files themselves:

• Stated income high for the credit profile. A $118,000 income with a 702 score, part of it from side work, for example.
• Income that is hard to see. Side, gig, self-employment, tips, overtime, bonus.
• Disagreements in the data. The address on the bureau differs from the application, the employer cannot be matched, the identity check came back weak.
• Size. Amounts above the limit the automatic rules may approve.
• Fraud scores. A device, email or phone signal that looks risky.

Your own number is easy to find: last quarter's referred files divided by applications. It sizes everything in Part C.

The federal rules that touch consumer income checks, and what moved between 2024 and 2026

In shortIncome verification for consumer credit sits between five bodies of rules: Regulation Z for cards, Regulation B for what income must count and how to tell an applicant what is missing, the Fair Credit Reporting Act for payroll and credit data, the IRS's consent rules for transcripts, and fraud law. Several pieces moved in 2024–2026: the open-banking rule was finished and then frozen, guidance was withdrawn, Regulation B was amended, 1099 thresholds rose and new model risk guidance replaced the old.

The 2024–2026 income-check rule changes, in plain words

Pay stubs, W-2s, bank statements, payroll data and tax transcripts: what each one can and cannot prove

In shortNo single document settles an income. A pay stub states current pay; a bank statement shows whether pay arrived; a payroll record confirms the job today; a W-2 or transcript shows what was reported to the IRS last year; an ID and selfie tie the file to a real person. Each has a weak spot, so lenders combine two or three and look for agreement.

Why combinations matter

A forger controls the documents they send. They do not control the bank's record of deposits, the employer's payroll system or the IRS. The strongest files pair a document the applicant supplied with data the applicant could not edit: a pay stub with the matching deposit, a W-2 with the payroll record, a stated address with the bureau and the bank. When the pairs agree, the analyst can stop. When they disagree, the disagreement is the finding.

Income that moves makes this harder. In the Federal Reserve's 2025 survey of household finances, 30% of adults said their income varied at least occasionally from month to month, and 11% struggled to pay bills because of it.27 For them a single pay stub is a poor guide, and two or three months of deposits say more.

Five arithmetic checks that a genuine pay stub always passes

In shortPayroll software computes; forgers estimate. So the checks are arithmetic: gross minus every deduction equals net to the cent; social security is exactly 6.2% and Medicare exactly 1.45% of the taxable wage; year to date equals pay per period times the pay dates so far; social security stops at the year's wage base; and two stubs from the same employer move forward the way the pay calendar says they must.

Take Desmond Merriwick's stub dated September 30, 2026, from the fictional example in Part B. He is an operations manager at Kessler Logistics Group, salaried at $96,000 and paid twice a month, on the 15th and the last day.

1. Gross to net. $4,000.00 gross, less federal tax $452.18, social security $248.00, Medicare $58.00, Ohio tax $108.40, Columbus city tax $100.00, 401(k) $240.00 and medical $186.24, totals $1,392.82 of deductions. $4,000.00 − $1,392.82 = $2,607.18, the net on the stub.
2. The two federal rates. The employee rates are "6.2% for the employee" for social security and "1.45% for the employee" for Medicare.28 6.2% × $4,000.00 = $248.00 and 1.45% × $4,000.00 = $58.00. Both match. Pre-tax benefit plans can lower the base; the 401(k) does not, and this stub takes its medical deduction after tax, so the full $4,000 is taxed here.
3. Year to date. September 30 is the 18th semi-monthly pay date of 2026, so the year-to-date gross must be 18 × $4,000.00 = $72,000.00. It is, and so is every deduction line: social security year to date is 18 × $248.00 = $4,464.00.
4. The wage base. Social security stops once wages for the year reach $184,500 in 2026; Medicare continues, with an extra 0.9% on wages above $200,000.28 A $240,000 earner paid semi-monthly hits the base on the 19th check; a stub that still shows a full social security line on the 20th was not made by a payroll system.
5. Stub against stub. Two consecutive stubs must differ by exactly one period in every year-to-date line, and their advice or check numbers must move forward.

What forgers get wrong

Vendors that sell fraud detection publish their red-flag lists: round figures ending in .00, the letter O where a zero should be, mixed fonts, gross and net that do not reconcile, tax lines that are near the statutory rates without matching them, missing year-to-date totals.29 Most of these are arithmetic.

A reviewer with a calculator can check each one in a minute, and software can check them on every page of every file. A stub that passes all five checks was made by a payroll system or by a careful forger; the next section shows how to tell the two apart.

Following each paycheck into the bank account, and reading 90 days of debits for debts the bureau has not caught

In shortMatch every pay date on the stubs to a deposit of the same net amount on the same day in the statements. Then read every debit: a recurring payment that is on neither the application nor the credit report is a debt the lender has not counted. The same statements show whether side income is as large as the applicant said.

Pay date by pay date

Kayla Brandt, in the example at the top of this page, is paid every two weeks: $3,250.00 gross, $2,410.00 net. From July to September there are seven pay dates. On five of them, July 3, 17 and 31 and September 11 and 25, Fernhill Savings shows a $2,410.00 deposit from her employer on the same day. On August 14 and August 28 the stubs show $2,410.00 each, and the bank shows nothing from the employer all month.

A deposit that does not match has innocent explanations: pay split between two accounts, a paper check, a change of bank. Each one leaves its own trace, a smaller deposit, a mobile check deposit, a new account number on the stub. Kayla's payroll record removes the doubt: unpaid leave from August 3 to 28, and 18 paid pay dates in 2026 where her stubs imply 20. The stubs describe pay that was never paid.

Side income, counted at what the evidence supports

Desmond Merriwick stated $118,000: $96,000 salary and $22,000 from freelance delivery. His 2025 1099-NEC from RouteBee Delivery shows $8,640. RouteBee paid $2,214.00 into his account from July to September, about $8,856 a year. The fictional lender's policy counts side income at the lower of last year's 1099 and current deposits, so $8,640 counts and $13,360 of the stated income does not.

Most of those loans never appeared in credit records, the CFPB found for 2022, which is why reading the debits matters. The method is simple to state: classify every outgoing payment in the statements, set aside the ones the application lists and the ones the credit report shows, and look hard at what recurs among the rest.

What an edited statement, a template pay stub and a made-up applicant leave behind

In shortAltered documents usually change the figures that matter: pay, deposits, balances. They leave traces in the file's history, its fonts, its arithmetic and its numbering, and they fail to match data the applicant could not edit. Made-up applicants, called synthetic identities, combine real and invented personal details and fail when the pieces are checked against each other and against the Social Security Administration.

How common, by the only figures published

There is no public, market-wide rate of altered documents in consumer lending, as of October 2026. Vendors that scan documents for lenders publish their own counts. Inscribe says about 6% of the documents across its network were flagged in 2025, "roughly 1 in 16", and that template-based fakes rose from 1 in 14 flagged documents in 2024 to 1 in 5 in 2025; AI-generated document fraud grew nearly fivefold from April to December 2025 while staying under 5% of the fraud it found.3

The same vendor reports that 91.2% of altered documents change financial details such as pay rates, deposits and balances.30 These are one company's clients and methods; treat them as a sign of direction.

The signs, and how much each one tells you

A signal is evidence for a person to weigh. Re-saving a PDF is something honest applicants do every day; a missing deposit, a frozen year to date and a reused advice number together are a different matter. Kayla Brandt's file had five signs on two pages. The fair response to five signs is a referral to the fraud team with the evidence attached, and a decision that rests on what the team confirms.

Synthetic identities and fake faces

The Federal Reserve defines synthetic identity fraud as "the use of a combination of personally identifiable information (PII) to fabricate a person or entity" for gain.31

TransUnion estimated US lenders' exposure to suspected synthetic identities at $2.4 billion at the end of June 2026, $1.5 billion of it in auto lending, as reported by Help Net Security.32 FinCEN warned in November 2024 that criminals use generative AI "altering or creating fraudulent identity documents to circumvent identity verification and authentication methods", and listed red flags such as inconsistencies among multiple identity documents and between the document and the rest of the customer's profile.8

Two public tools help. The Social Security Administration's eCBSV service (electronic Consent Based SSN Verification), with the person's signed consent, tells a financial institution whether a name, date of birth and SSN match its records; SSA says the answer "does not authenticate the identity of individuals".33 NIST's identity-proofing guidelines, revised in July 2025 (SP 800-63A-4), set the assurance levels many identity-verification services work to.34 Income checks help too: an invented person rarely has a payroll record, a W-2 on file with the IRS and years of ordinary bank activity that agree.

Consent and permissible purpose: what a lender needs before it pulls payroll, bank or IRS data

In shortDocuments the applicant uploads need no special permission. Data the lender pulls does. Payroll and employment data from a reporting company is a consumer report, so the lender needs a permissible purpose and owes adverse-action notices when it contributes to a no. IRS transcripts need the taxpayer's signed consent; SSN checks with SSA need written consent; bank data needs the applicant to connect the account.

The Fair Credit Reporting Act lets a lender obtain a consumer report when it "intends to use the information in connection with a credit transaction involving the consumer", or on the consumer's written instructions.21 The CFPB's 2025 list of consumer reporting companies includes employer-database and applicant-permissioned payroll services that provide "employment and income information" to "lenders reviewing applications for credit".26

If such a report contributes to an adverse action, the lender gives the notice section 615(a) requires: the credit score used, if any, the reporting company's name and contact details, a statement that it did not make the decision, and the right to a free copy within 60 days and to dispute.22 If information from someone other than a reporting company contributed, such as an employer's answer to a phone call, the applicant may ask within 60 days for "the nature of the information".22

Whatever the source, keep the consent with the file: who agreed, to what, when, and for which application. That record answers the examiner's first question and the applicant's.

Income a lender may not discount: part-time pay, retirement, public assistance and support payments under Regulation B

In shortRegulation B lets a lender weigh "the amount and probable continuance of any income", applicant by applicant. It forbids discounting income because it comes from part-time work, a pension, an annuity or retirement benefits, or a public assistance program, and, when the applicant relies on alimony, child support or separate maintenance, requires counting them to the extent they are likely to be paid consistently. It also sets the clock for a file that is missing a document.

The official interpretation adds that "a creditor need not consider income at all", and that if it does not evaluate every component of protected income for reliability it "must treat as reliable any component of protected income that is not evaluated".19

When a document is missing

A lender must notify the applicant within 30 days after receiving a completed application. If the file is incomplete, it may instead send a notice "specifying the information needed, designating a reasonable period of time for the applicant to provide the information", and saying the application will not be considered further without it.20 Regulation B sets no number of days for that period; lenders choose one and write it down.

If the lender declines, the reasons "must be specific": a reason such as "income could not be verified" names what failed, and "did not meet our internal standards" is insufficient.20

Fair lending after July 2026

The CFPB's Regulation B amendment, effective July 21, 2026, states that the Equal Credit Opportunity Act does not authorize disparate-impact liability; disparate treatment is still prohibited, and a lawsuit challenging the rule is pending.15 Income counting is where disparate treatment hides: one analyst accepts a support order on a payment history, another asks for a court decree. A written counting rule, applied the same way to every file, with each exception's reason on the record, is the defense under any reading of the law.

How often applicants overstate income, and how much more often those loans default

In shortNo regulator publishes a rate of income misstatement on consumer loans. A vendor's study of auto loans found a fifth to a quarter of applicants inflating income by 15% or more; studies of marketplace loans find round stated incomes predicting default even after verification, and loans with less checked information defaulting more. Overstated income is a credit loss waiting for the first missed payment.

The best evidence comes from three directions. A study of 1,584,127 Lending Club loans found that round and otherwise inaccurate stated incomes predicted default "even when the income is verified"; at the top of its inaccuracy index, loans were five percentage points more likely to default, about a quarter above a mean default rate near 20%, and "the additional default risk is not compensated by higher interest".37

A study of a Chinese lending platform from 2012 to 2015 found that borrowers with incomplete verification overstated income more and defaulted more.38 And in mortgages, Mian and Sufi showed that application incomes stopped tracking IRS incomes in low-score ZIP codes from 2002 to 2005, the areas that later defaulted most.39

Auto lending gives the clearest consumer numbers, from a fraud-analytics vendor: in about 1.2 million auto applications whose income lenders verified, 21% of borrowers inflated income by 15% or more in 2016 and 26% in 2017, and more than 40% of loans that defaulted in their first six months would have raised an income alert.36 The data is from auto loans and is several years old; it is the shape of the problem that carries over to personal loans and cards.

When the income was a lie

A knowingly false statement "for the purpose of influencing in any way the action of" a federally insured lender is a federal crime, punishable by up to $1,000,000 and 30 years.24 Banks report suspected fraud through suspicious activity reports, and FinCEN asks for the key term FIN-2024-DEEPFAKEFRAUD where deepfake media is involved.8 None of that recovers the money; a loss avoided at verification is worth more than any of it.

Record personal loan balances, and the applicants a slow referral queue loses to a faster lender

In shortUS personal loan balances reached a record $281 billion in mid-2026, with originations up almost a fifth in a year, and card balances stood at $1.14 trillion. Applicants can apply to several lenders in an evening, so a referred file that waits days for a person is a file another lender can fund first.

Credit cards drew 20.6 million new accounts in the most recent quarter TransUnion reports, up 11.8%.40 Card balances rose $21 billion, 1.7%, in the second quarter of 2026, and the New York Fed's "other" consumer balances, which include retail cards and consumer finance loans, reached $568 billion.41 Most of these accounts are approved automatically. The ones that are not, the referred files, carry the highest stated incomes and the most unusual income sources, which is why they reach a person.

Nobody publishes the minutes a referred file spends in a queue or how many applicants a lender loses while it waits. A lender can measure both: time from a complete file to a decision, and the share of approved referred applicants who never take the loan.

Software that reads, checks and matches, and the AI expectations a consumer lender answers to in 2026

In shortMost of the verification work is reading, arithmetic and matching, which software does reliably and on every page. The judgment calls stay with people: whether a gap has an innocent explanation, whether a signal is fraud, what income to count under policy. Regulators expect specific reasons for any decline, sound management of models and vendors, and, in Colorado from 2027, notice and review rights for automated decisions.

What examiners expect of automated income checks

Colorado's SB26-189 takes effect January 1, 2027 for automated decision-making technology in consequential decisions, which include lending.18 FinCEN's deepfake alert expects identity checks that can catch generated images and documents.8 What these rules ask of a lender is to know what its tools do, keep a person responsible for each decision, and explain it in plain terms.

What income verification software cannot prove

• Software cannot prove an employer exists by reading its stub; the payroll record, the deposit and the W-2 can.
• Bank data covers only the accounts the applicant links or sends, and unbanked applicants have none.35
• Payroll networks cover only employers that take part.
• A tamper signal is evidence; a person decides what it means.

How a referred-file desk works today, and where a verification analyst's hour goes

In shortThe decision engine refers a file, an analyst requests and reads the documents, compares them by eye, chases what is missing, sends anything suspicious to fraud, and decides within a signing limit, with a team lead for larger amounts. Most of the hour goes to opening, reading and comparing; the decision itself takes minutes.

Verification analyst, fraud analyst, team lead: who touches a referred file

Three people and several waits on a referred file

Reading and comparing: a verification analyst's hour on one file

Few analysts get an uninterrupted hour per file. The queue grows on Monday mornings and after marketing campaigns, and the files that wait longest are the ones with the most documents. One vendor's comparison puts manual review at "10-15 minutes" per document, its own figure with no published method.30

PDF checklists, payroll and bank data, or the whole file read

Desmond Merriwick's debt consolidation file: 12 documents lined up, three gaps found and an approval with one condition

In shortDesmond applied on Friday for $24,500 over 60 months to pay off three cards, stating $118,000. By Monday morning six agents have read his 12 documents, 31 pages, lined them up and found three gaps: side income far below what he stated, a new car loan the credit report does not show yet, and a missing statement page. Renée Okafor, the verification analyst, approves at the verified income with one condition and signs within her limit.

1

Every document in its own column, every fact as a row

Renée opens the file on the lineup. The application, the pay stubs, the bank statements, the payroll response, the W-2 and 1099, and the license and selfie sit side by side. Address, employer, salary and every pay date run across them as rows, joined in green where the documents agree.

The amber notes explain differences that are fine: Desmond moved to Westerville in June, so his license and 2025 W-2 still show Columbus; his 2025 W-2 shows $92,000 because his raise came on January 1. Six of six pay dates land in the bank on the day, $2,607.18 each.

2

Three gaps, each with its sources

Lower on the board the dashed red threads carry numbers. Side income: $22,000 stated, $8,640 on the 2025 1099-NEC from RouteBee Delivery, $2,214.00 in RouteBee deposits from July to September. A car loan: $486.00 to Varrowby Auto Finance on August 25 and September 25 after $3,000 to Halverwood Motors on July 28, too new for the credit report. A missing page: page 2 of 4 of the August statement.

Each gap names the documents behind it, one click from the page. The run log beside it shows the six agents finishing in 1 minute 12 seconds on this sample file.

3

Stated $118,000, verified $104,640

The verification workspace puts the four deciding numbers at the top. Stated income $118,000; verified $104,640, 11.3% below stated; debt-to-income 35.2% at the verified income with the car loan, inside the policy's 40%; fourteen of fourteen figures tied to a document.

Bramblewood's policy counts side income at the lower of last year's 1099 and current deposits, and re-decides a file at verified income when the gap is more than 10%. Both are settings its credit policy manager owns.

4

Approve at verified income, with one condition

The Decision tab walks from stated to verified income and lists the debts behind the ratio: rent $1,780.00, student loan $238.00, the car loan $486.00 and the new payment $563.62, $3,067.62 a month on $8,720 of verified monthly income. The three cards, $23,860, are paid off at funding and leave the ratio.

Approving at stated income is not offered: verified is more than 10% below stated. The recommended choice is approval at the verified income with a condition. Within her $35,000 limit, Renée's signature is the only one needed.

5

The request goes out in plain words

The condition is page 2 of the August statement, August 16 to 22, before funding. The request to Desmond is drafted in plain words, says which pages the bank already has and when the missing one is due, and goes out only when Renée sends it.

When the page arrives the file checks that its balances carry from page 1 to page 3 and clears the condition. If nothing arrives in ten days, Bramblewood's setting sends the notice of incompleteness Regulation B describes.

The solution's design target is about 15 minutes from a complete referred file to a signed decision, with every verified figure tied to the document and page it came from. Measure both on your own files.

Kayla Brandt's altered pay stubs, and the screens for each figure's proof, the fraud signals and the bank's verification rules

In shortDesmond's file is the honest case. Kayla's is the other kind: two August stubs whose pay never reached her bank, a year to date that stood still, reused advice numbers and a file history that shows an editor. The other screens show every figure and its proof, the documents and their checks, bank activity, identity, the queue, the signals, the results and the settings.

Select any screen to open it larger. The bank, applicants, employers, people and figures are fictional.

The verification analyst signs every income decision; the team lead co-signs above $35,000 and fraud takes every tamper signal

In shortEach agent has one job and limits it does not cross. None of them approves, declines, changes a figure, contacts an employer or reads beyond the documents the applicant provided. The verification analyst signs every decision; the team lead co-signs above $35,000 and on any decline for altered documents; every file with a tamper signal goes to the fraud analyst.

Six agents read, check, calculate and match each referred file

Who signs verified income, and who takes a tamper signal

Each agent step and each human decision is on the file's audit trail, with who, what and when. Changes to the credit policy settings are versioned. Adverse action and incompleteness notices follow Regulation B.

Renée Okafor's referred-file desk, by name

What income verification reads from the applicant's documents and your credit policy, and the sourced income it leaves on the file

In shortThe solution reads the documents and data you already collect and the credit policy you already write, and leaves behind a verified income with a source for every figure, the mismatches and tamper signals with their evidence, the request to the applicant, and a signed decision on the file. Your application system and decision engine stay where they are.

Decision engine, payroll, bank data and ID checks to connect

For each, check whether it has an API, a file feed or only screens, and who owns it.

Your decision engine, data services and credit policy stay in charge

Three rules every referred file follows

What slow referral queues and missed altered documents cost you in analyst hours, lost applicants and early defaults

In shortStart from your own numbers. No regulator or study publishes minutes per referred file, the share of referred applicants who walk away, or losses from misstated income on personal loans and cards. Three published figures frame them: what an analyst hour costs, how often vendors see altered documents, and how much more often loans with inaccurate stated income default.

Count your own referral queue costs in a week

Lost honest applicants, unexplained declines and other hidden costs

Analyst minutes per referred file and bad loans stopped: what faster income verification returns

In shortPut in your own numbers. The calculator starts from a published wage and asks for the rest: how many files you refer, minutes per file now and after, how many more bad files you expect to stop per thousand, what one of them costs you, and what the tool and your testing cost a year. Every default marked illustrative is an assumption to replace.

Lined-up files, checked deposits and one clear stip request

Price faster income verification on your own referrals

A lender referring 6,000 files a year passes the break-even easily if automation saves most of the reading. A lender referring 1,000 files a year with simple files saves less per file; it should weigh losses and speed before buying anything, and test on its own files first.

A readiness score for your referred-file desk: file shape, written income policy, fraud evidence and governance

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

What your referred-file desk should do next

Pay stub checks, deposit matching, consent and fair lending: eighteen things to ask a verification vendor

In shortAsk every vendor the same questions, us included. The answers show what the tool reads, which checks it runs, whether it ties pay to deposits, what evidence you keep, whose policy counts the income, how it treats consent and fair lending, and how you would test it on your own files.

We found no published independent test of any income verification or document fraud vendor's accuracy, as of October 2026. A test on your own closed files, with confirmed fakes and clean files, is the fairest comparison, and the same test measures your current process.

Testing income verification on your closed referred files and the fakes your fraud team already confirmed

In shortMeasure first, then test on your own files with the fakes your fraud team already confirmed, then run alongside your analysts, then decide with three numbers. None of these steps commits you to a vendor.

1. Time five referred files, one with gig income and one with three bank statements, by step. That is your baseline.
2. Pull last year's evidence: confirmed altered documents, early defaults on referred files, approvals never booked, requests per file.
3. Gather 80 closed referred files with their decisions, including every confirmed fake you kept, and an approval path to share them. Have the tool work them blind, without the decisions.
4. Run in parallel on live referred files for four weeks, with your analysts deciding and signing every one.
5. Decide with three numbers: catches by sign on the confirmed fakes, false alarms on clean files, and analyst minutes to a signed decision.

Catches by sign, false alarms and verified income difference

Proof of income for personal loans and credit cards: what applicants and analysts ask

In shortThe questions applicants, analysts and buyers search for, each answered on its own.