How to identify fake pay stubs: eight checks, in order

To identify fake pay stubs, stop looking at the stub and start testing its numbers. Four arithmetic checks catch most forgeries in under a minute — gross pay minus the deductions must equal net pay to the cent, social security must be exactly 6.2% and Medicare exactly 1.45% of taxable pay, year-to-date totals must fit the number of pay dates that have passed, and the social security line must stop when annual pay crosses the wage base. Four more checks finish the job: the dates on the stub, the file’s own typography and history, the employer, and the bank. Botminds’ Income and Document Verification runs all eight on every page of a referred consumer loan or card file and shows its working beside the page, because a forged stub that satisfies the eye usually fails the fifth decimal place.

The worked examples below come from the fictional sample files the solution ships with: Marcus Ellery, a salaried applicant whose documents all pass, and Kayla Brandt, whose August stubs do not. People, employers and banks named here are invented. The research figures and the tax rates come from the agencies that publish them, linked under each figure.

What a fake pay stub is, and who makes one

A fake pay stub is a document that looks like an employer’s payroll statement but was produced by someone else: generated by one of the many online stub builders, edited from a genuine stub in a PDF editor, or assembled in a spreadsheet. It is the cheapest piece of credit fraud there is. The builders cost a few dollars, ask for a name, an employer and a salary, and produce something that prints convincingly.

Two different people send them. The first is committing first-party fraud: a real applicant, usually with a real job, inflating real income to clear a debt-to-income limit or to qualify for a larger loan. The second is using a stolen or invented identity, where the stub is one prop among several. The checks below catch both, but they tell you different things, and the second kind usually fails the identity and bank checks long before the arithmetic.

The reason arithmetic works is that a payroll system is a calculator. It computes net pay from gross pay and a fixed set of statutory percentages, it carries year-to-date totals forward from the last cheque, and it stops taking social security tax when the year’s wage base is reached. A forger has to reproduce all of that by hand, on every stub, consistently across stubs — and most do not try.

Check 1: does gross minus deductions equal net pay?

Add up every deduction on the stub and subtract the total from gross pay for the period. The answer must equal net pay exactly. This is the check forged stubs fail most often, because a stub builder lets the buyer type a salary and a take-home figure independently, and a human editing a real stub changes the gross and forgets the net, or changes both and forgets one deduction line.

Do it on the period figures, not the year-to-date column, and do it to the cent. A discrepancy of a few dollars is not a rounding artefact: payroll systems round each tax line to the cent and then subtract, so the identity holds exactly. If the stub shows a net figure that is not the difference, either a deduction line has been removed from the page or one of the three numbers was typed.

Note what the check does not require: you do not need to know the applicant’s tax situation. Federal withholding depends on the form they filed with their employer, state tax depends on where they live, and benefit deductions depend on what they elected. None of that is knowable from outside. The subtraction is knowable, and so are the next two lines.

Check 2: are social security and Medicare exactly 6.2% and 1.45%?

These two are fixed by statute and published by the IRS. “The current tax rate for Social Security is 6.2% for the employer and 6.2% for the employee, or 12.4% total,” the IRS states; “the current rate for Medicare is 1.45% for the employer and 1.45% for the employee, or 2.9% total” (IRS Topic no. 751). The employee half is what appears on a stub. On taxable pay of $4,000.00 that is $248.00 and $58.00 — and a forged stub is far more likely to show $248.40 or a round $250.00 than the right figure, because it was estimated rather than computed.

Two refinements save a false alarm. First, the base for each tax is taxable wages, not gross pay, and a pre-tax deduction — a retirement contribution, a health premium taken before tax, a transit benefit — reduces the social security and Medicare base. If a stub shows pre-tax deductions, compute the rates against gross less those lines before calling a mismatch. Second, some wages are exempt: a few categories of student, religious and non-resident employment do not pay these taxes at all, and a stub with no social security line is not automatically false.

What is never right is a percentage that is close but wrong. A stub showing 6.5% or 1.5%, or showing the combined employer-and-employee 12.4% as an employee deduction, is a document nobody’s payroll system produced.

Check 3: does year to date fit the pay calendar?

Year-to-date gross is the arithmetic a forger finds hardest, because it ties the stub to a calendar. Take the per-period gross, multiply by the number of pay dates that have passed in the year up to this stub’s pay date, and compare. On a semi-monthly calendar — the 15th and the last day of each month — a stub dated 30 September is the eighteenth pay date of the year, so $4,000.00 a period must show $72,000.00 year to date.

The trap is that the answer depends on the pay frequency, and the four frequencies give four different answers at the same point in the year. Someone paid every two weeks has had twenty pay dates by late September, which is 76.9% of a twenty-six-period year, not the 75% a calendar quarter suggests. A forger who divides the annual salary by four and multiplies by three gets a plausible-looking number that is wrong by nearly $1,900 on a $96,000 salary.

Overtime, bonuses, commission and unpaid leave all break the clean multiplication, which is why the check produces a question rather than a verdict. The useful form of the question is arithmetic too: does the gap between the year-to-date total and the calendar expectation equal something the stub itself explains? A year-to-date figure $4,820.00 above expectation on a stub with no overtime line is a gap nobody has accounted for. A year-to-date figure that does not move at all between two stubs a month apart is the opposite problem, and it is the one in the sample file.

In the solution’s second sample file, Kayla Brandt’s 28 August stub and her 25 September stub both show year-to-date gross of $58,500.00. Two pay dates apart, on a two-weekly calendar, the figure cannot be the same: either no pay was earned between them — which the stubs themselves deny, since each shows a full period of pay — or the second stub was made by copying the first and changing the dates.

Check 4: has the wage base or the extra Medicare threshold been crossed?

Social security tax applies only up to an annual wage base. “For earnings in 2026, this base limit is $184,500,” the IRS states, while Medicare has no ceiling; instead, “employers are responsible for withholding the 0.9% Additional Medicare tax on an individual’s wages paid in excess of $200,000 in a calendar year” (IRS Topic no. 751). Both rules leave a visible signature on a high earner’s stubs, and a forged stub almost never has it.

Take an applicant on $240,000 a year, paid semi-monthly at $10,000. Through the eighteenth pay date their year-to-date gross is $180,000, and social security is withheld in full at $620.00 a period. On the nineteenth, year-to-date gross reaches $190,000, but only the first $4,500 of that cheque is below the $184,500 base — so social security is $279.00, not $620.00. From the twentieth cheque to the end of the year the line is $0.00. Medicare keeps running at 1.45%, and once year-to-date wages pass $200,000, at the twentieth cheque, the rate on the excess becomes 2.35%.

Check 5: the dates on the stub, against the lender’s document rules

A stub has at least three dates: the pay period it covers, the pay date, and the date the document was produced. They have to agree with each other — a pay date before the end of the period it pays for is a mistake no payroll system makes — and the pay date has to be recent enough for the lender to rely on.

The mortgage rulebooks set the sharpest version of that second test, and consumer lenders generally borrow it. Fannie Mae requires that “the most recent paystub must be dated no earlier than 30 days prior to the initial loan application date” and that “it must include all year-to-date earnings” (Selling Guide B3-3.1-02). The same guide is realistic about the format: “documents must be computer-generated or typed by the borrower’s employer(s), although paystubs that the borrower downloads from the Internet are also acceptable.” A self-service payroll portal is the normal source of a genuine stub, so “downloaded by the applicant” is not itself a signal.

The outer limit comes from the age rule: credit documents “must be no more than four months old on the note date,” where credit documents means “credit reports and employment, income, and asset documentation” (Selling Guide B1-1-03). A referred file that sits for weeks while a document is chased can age past its own evidence, which is why a verification queue that measures waiting time is a fraud control as well as a service one.

Check 6: typography, alignment and the file’s own history

The checks that look at the document rather than its numbers are weaker evidence on their own and stronger in combination. Three are worth running on every page. A genuine payroll document is laid out by one template in one or two font families; a page edited after the fact usually carries a third, because the editor substituted a font for the changed figure. Columns of figures in a generated report are aligned by the generator; a hand-edited figure sits a fraction out. And a PDF carries its own creation and modification history, so a document created by a payroll system on the 1st and re-saved by an editing tool on the 6th has been through something between.

None of these is conclusive. Scanning, photographing, printing to PDF and emailing through systems that re-compress attachments all rewrite the file’s history innocently, and a legitimate employer may well produce stubs in a tool that reports itself oddly. Treat the three as what they are: reasons to look harder, which is exactly how the solution presents them — as signs listed beside the page, each with the figure it rests on, never as a conclusion.

Every check beside the page it was run on

Checks 7 and 8: the employer, and the bank

The last two checks leave the document. Asking the employer is the most conclusive and the least available: payroll data networks cover large employers well and small ones poorly, and a direct call to a small employer’s owner proves little when the owner is the applicant’s relative. When a payroll response does come back, it settles the salary and the employment dates, and the solution puts its figure beside the stub’s so the two can be compared rather than merged.

The bank check is the one that is almost always available, and it is the hardest to defeat. Net pay on a stub is a specific amount that should have arrived in the applicant’s account on a specific date. A forger can get every tax line right and still not make money appear in a bank account. In the sample file, Kayla Brandt’s two-weekly net of $2,410.00 lands in her account on five of seven pay dates, and the two August stubs have no deposit behind them at all: the stubs claim $4,820.00 of pay in August and the statements show $0.00. The method, including the five honest reasons a stub can legitimately have no matching deposit, is worked through in pay stub verification against bank deposits.

The order of the eight checks is a cost argument as much as an evidence one. The OCC’s examiners put it in terms of risk rather than effort: “banks relying on customer assertions rather than direct verifications face greater uncertainty, assume an inherently higher quantity of credit risk, and should have enhanced risk management practices to compensate,” and the information they expect to see verified directly includes “current employer, primary income (amount, frequency, and type)” and “supplemental sources of income (source, amount, and likely recurrence)” (OCC, Retail Lending, version 2.0). Doing the four arithmetic checks first means the expensive outside verifications are spent on the files that still need them.

What a failed check does not prove

A failed check is a signal, not a finding, and the distinction decides what a lender may do next. Arithmetic that does not add up has innocent explanations: a payroll correction, a mid-period rate change, a retroactive adjustment, a stub reprinted after an amendment, a partially scanned page. The applicant who sends it may have no idea.

So nothing is declined on a signal. In the solution a tamper signal holds the file and refers it to a fraud analyst with every sign attached, and clearing a signal takes a written reason that a second person reads. That sequence also protects the lender in the other direction. Federal law makes a knowing false statement to a lender a serious crime — whoever does it “shall be fined not more than $1,000,000 or imprisoned not more than 30 years, or both” (18 U.S.C. § 1014) — and an accusation that rests on a font is not one anybody should make.

The regulatory side pulls the same way. Regulation Z, writing about mortgages, tells a lender to verify income “using third-party records that provide reasonably reliable evidence of the consumer’s income or assets” (12 CFR 1026.43(c)(4)). The standard is reasonable reliability, not certainty — which is why the honest output of these checks is a verified figure with the page it came from, plus a short list of what does not add up. Which documents meet that standard, and which settle a disagreement, is set out in how lenders verify income.

Where the checks run on their own

The eight checks are not hard; they are tedious, and tedium is why they go undone on a Friday afternoon with eleven files in the queue. A referred consumer file holds a dozen documents and thirty-odd pages, and the arithmetic has to be redone for every stub, against every pay calendar, in both the period and the year-to-date column.

That is the part Income and Document Verification automates: six agents read the file, run the seven document checks and the deposit match on every page, and put the result on one screen with each figure linked to the page it came from. The tamper checker never declines a file and never calls it fraud — it raises the signal and shows the arithmetic — and the analyst decides. What that costs, what it saves and how to test it before you buy anything is in income verification software: nine questions before you buy.

A signal, with the five signs behind it

Questions people ask

How much is social security and Medicare withheld from a paycheck?

The employee’s share is 6.2% of taxable wages for social security and 1.45% for Medicare, each matched by the employer, per IRS Topic no. 751. Social security stops for the year once wages reach the annual base — $184,500 for earnings in 2026 — while Medicare has no ceiling and gains an extra 0.9% on wages above $200,000 in a calendar year. On a $4,000.00 semi-monthly cheque with no pre-tax deductions, that is $248.00 and $58.00.

How do you calculate year to date pay from a stub?

Multiply the gross for the period by the number of pay dates that have passed in the calendar year up to and including this stub’s pay date. The count depends on the frequency: at 30 September a weekly employee has had about 39, a two-weekly employee 20, a semi-monthly employee 18 and a monthly employee 9. Overtime, bonuses and unpaid leave move the total, so treat a gap as a question for the applicant rather than a verdict.

What does a fake pay stub look like?

Usually, entirely normal. The tells are in the figures rather than the design: a net figure that is not gross minus the listed deductions, statutory taxes that are near but not exactly 6.2% and 1.45%, a year-to-date total that no pay calendar produces, social security still being withheld after the wage base, or two stubs a month apart with the same year-to-date figure. Mixed font families and a re-save by an editing tool add weight but prove nothing alone.

Can you verify a pay stub with the employer?

Sometimes. A payroll data network will answer for many large employers, returning the salary and the employment dates directly; coverage of small employers is thin, and a direct approach to a very small employer is worth less, because the person answering may not be independent of the applicant. That is why the bank deposit behind the stub does more work in practice: it needs nobody’s cooperation but the applicant’s, who already sent the statements.

Is it illegal to use a fake pay stub to get a loan?

Yes. Knowingly making a false statement to influence a federally insured lender’s decision on a loan application is a federal crime under 18 U.S.C. § 1014, carrying a maximum of a $1,000,000 fine and 30 years’ imprisonment, and state fraud and forgery laws apply as well. Prosecutions of individual applicants are uncommon; the ordinary consequence is a declined application and, where the lender is required to, a report of the suspicious activity.

How many pay stubs should a lender ask for?

Two is the common floor, covering 30 days, because one stub shows a single period and two show whether year to date advances the way the calendar says it should. The sample lender in the solution sets exactly that, with the alternatives — one stub within 30 days, or two stubs and a W-2 — as settings its credit policy manager owns. Asking for two also gives the year-to-date comparison that caught the sample file’s copied stub.