How to spot a fake W-2: the box math, the IRS record and the file

Published 2026-10-20 How-toLending

A W-2 turns up wherever someone has to prove last year's income: a mortgage file, a rental application, a car loan, a new job that asks about salary history. It looks official, it carries a government form number, and most people who receive one read a single figure on it, the wages in box 1, and move on.

That is exactly why it gets forged. The layout is public: the IRS publishes the form, and employers are allowed to fill in and print the employee copies straight from IRS.gov. Online generators sell finished W-2s for the price of lunch. A fake W-2 looking like a real W-2 tells you nothing.

What a forger cannot easily fake is consistency. The boxes on a W-2 are tied to each other by tax rules, the same figures sit on the applicant's other documents, and the IRS keeps its own copy of every W-2 an employer files. This guide goes through those checks in the order that catches the most for the least effort.

Step 1: do the box math

Before you open the file's properties or call anyone, check whether the numbers on the form are possible. Payroll software computes them; a person typing a bigger salary into a template usually changes one box and forgets the rest.

Box 4 (social security tax withheld) is 6.2% of box 3 (social security wages) plus box 7 (social security tips). Allow a few cents of rounding across pay periods, not more. Some state and local government employees are not covered by social security, and their boxes 3 and 4 are empty.
Box 3 has a ceiling: $176,100 for 2025 and $184,500 for 2026. Box 4 therefore cannot exceed $10,918.20 for 2025 or $11,439 for 2026. A W-2 above the cap from a single employer is wrong.
Box 6 (Medicare tax withheld) is 1.45% of box 5 (Medicare wages), plus 0.9% of the part of box 5 above $200,000. Box 5 has no cap, so for high earners it will be larger than box 3.
Box 1 (wages, tips, other compensation) leaves out 401(k) deferrals; boxes 3 and 5 include them. If box 12 shows code D (or E or G, for 403(b) and 457(b) plans), box 1 should sit below box 5 by roughly that amount, and with code D or E the "Retirement plan" box in 13 is normally checked.
Box 2 (federal income tax withheld) should be plausible for box 1. Zero federal withholding on a high salary, or a perfectly round figure, deserves a question.
State boxes 15–17 should match where the person lived and worked. State income tax withheld for a state that has no wage income tax is a reason to ask why.

$A fictional W-2 for 2025: social security wages 66,000.00 with 4,092.00 withheld, which is 6.2%; Medicare wages 66,000.00 with 957.00 withheld, which is 1.45%; a 401(k) deferral of 4,750.00 under code D. Box 1 reads 86,000.00, higher than Medicare wages, so it does not fit the other boxes.$

The two tax lines agree with each other. Box 1 does not: with a 401(k) deferral it should be about 61,250.00, not more than Medicare wages.

The most common edit is the one in the picture: box 1 raised, because box 1 is the figure people read as "salary", while boxes 3 to 6 keep the original numbers. A W-2 where box 1 is higher than box 5 is not impossible, but it is rare enough that you should hear the reason.

Step 2: check the boxes that identify people

Box b, the employer's EIN, is nine digits written XX-XXXXXXX, and the IRS never allows it to be truncated. A masked or partly hidden EIN on a W-2 is a red flag.
Box a, the employee's Social Security number, may legitimately appear as ***-**-1234 or XXX-XX-1234 on the employee's copies. A truncated SSN is normal; ask for the last four digits to match the application.
Box c, the employer's name and address, should match a business you can find on your own: a Secretary of State registry, the company's own website, a phone number you looked up yourself.
The tax year printed on the form should be the one you asked for. Last year's W-2 with the year changed is a cheap edit.

Step 3: line the W-2 up with the other documents

One W-2 can be internally consistent and still invented. Several documents from the same year have to agree with each other, and that is much harder to arrange.

The last pay stub of the year: its year-to-date gross, less pre-tax deductions such as the 401(k), should come close to box 1, and its year-to-date social security and Medicare lines to boxes 4 and 6.
Bank statements: net pay should arrive on the employer's pay cycle in amounts that fit the W-2. A $90,000 salary with $1,800 deposits every two weeks deserves a question, unless pay is split across accounts.
The tax return: line 1a of Form 1040 is the total of box 1 from all the person's W-2s.
An employment letter, if you have one: start date, job title and employer name should be the same as on the W-2.

Step 4: let the IRS answer

Everything above tests the document. This step skips it. Employers file Copy A of every W-2 with the Social Security Administration, and the IRS shows that data on a transcript. If the wages on the W-2 you were handed are not on the government's record, the arithmetic is beside the point.

Lenders: if you are enrolled in the IRS Income Verification Express Service (IVES), or work with a company that is, you can order the borrower's tax return or wage transcripts on Form 4506-C. The IRS releases them only with the borrower's consent, which the borrower gives by signing the form or approving the request in their IRS online account.
Landlords and everyone else: ask the applicant for their Wage and Income transcript, which they can download from their IRS Individual Online Account or request with Form 4506-T. It lists the W-2s and 1099s filed with the IRS for that year.

Three things to know when you read a transcript. The IRS partly masks names, addresses and EINs on it, but the money amounts are shown in full, and those are what you compare. A transcript only shows forms that employers have actually filed, and the IRS says current-year information is generally available in the first week of February; before that, a missing record means "not posted yet", not "fake". And a transcript the applicant downloads and forwards is still a file in their hands: ask them to download it from their IRS online account during the appointment, or treat a forwarded copy as one more document to check.

Then the employer. Call a number you found yourself, never the one printed on the W-2 or in the applicant's email, and ask a narrow question: did this person work there during that year. Many larger employers answer through employment verification services such as The Work Number instead of HR. Our guide to verifying an employment letter covers that call in more detail.

Step 5: read the file, with care

A W-2 PDF records how it was made. File → Properties in most PDF readers shows the software that wrote it and the creation and modification dates. Read them, but know what a genuine W-2 can look like before you treat them as a verdict.

Genuine W-2s come from payroll portals, from tax software, and from small employers who fill in the IRS's own fillable form. A W-2 made on the IRS form is not fake for that reason alone.
A W-2 made on the IRS form will name a PDF program in its properties, and that alone means nothing. What is worth a question is a mismatch: a W-2 from a payroll portal whose properties name a consumer editor or design tool, or that was saved again long after the portal produced it; box 1 set in a different font or size from the other boxes; or box 1 alone refusing to select with the cursor while the other boxes do, because it was pasted over the page as an image.
Ask for the PDF exactly as it was downloaded. Printing it to a new PDF, re-saving it in a phone app or compressing it in an online tool all leave traces that can look like an edit.

Our free PDF metadata checker reads these fields for you; the file is parsed in your browser and never uploaded. What the fields can and cannot prove is in a separate post.

What none of this proves

A W-2 that passes every check above is consistent with the IRS record. It is not proof that the applicant earns that today: it describes last year, and the job may have ended in December. It is not proof that the W-2 belongs to the person in front of you either, since a genuine, unedited W-2 can be stolen. Match the name and the last four digits of the SSN to the applicant's ID, and ask for a recent pay stub for current income.

The reverse is true as well. A W-2 that fails the box math is not automatically forged; payroll errors happen and employers issue corrected forms, called W-2c. A failure is a reason to ask for the IRS transcript, not a reason to accuse anyone.

Where Atomara fits

Atomara answers one of these questions: was this PDF edited after it was made? It reads how the file was built (the software that wrote it, later saves, fonts and structure) and shows the evidence for each finding. It is not connected to the IRS, the SSA or any employer, so it cannot tell you whether the wages are true; only the transcript and the employer can.

It is useful when a W-2 PDF fails the box math and you want to see whether and where the file was edited, when you receive income documents in volume and need the same check on every file, and on the documents that come with a W-2, such as bank statements, pay stubs and employment letters. A W-2 sent as a photo or a scan is read as an image: the report says what kind of file it is, without a score.

Upload a PDF on the homepage; the full report is free for your first 3 checks. Related guides: detecting a fake pay stub, how to verify a pay stub, document checks for lenders and for landlords.

Checklist

Box 4 is 6.2% of box 3, box 6 is 1.45% of box 5 (plus 0.9% above $200,000), and box 3 is under that year's wage base.
Box 1 is below box 5 by about the 401(k) deferral in box 12; if it is higher, there is a reason.
The EIN is complete, the employer exists independently, and the tax year is the one you asked for.
The last pay stub, the bank deposits and Form 1040 line 1a agree with the W-2.
The IRS transcript, through IVES or from the applicant's own account, shows the same wages.
The PDF is the one downloaded from payroll, not a re-saved copy, and its properties do not name an editor.

Frequently asked questions.

How can you tell if a W-2 is fake?

Check the box math first: box 4 is 6.2% of box 3, box 6 is 1.45% of box 5, and box 1 is normally at or below box 5. Then compare the wages with the last pay stub, the bank deposits and Form 1040, and confirm them on the IRS Wage and Income transcript.

Can you verify a W-2 with the IRS?

Yes, with the person's consent. Lenders enrolled in the IRS Income Verification Express Service order wage or tax return transcripts on Form 4506-C. Anyone else can ask the applicant for the Wage and Income transcript from their IRS online account, which lists the W-2s filed for that year.

Is a W-2 printed from the IRS website fake?

Not for that reason. The IRS lets employers fill in and print the employee copies of Form W-2 on IRS.gov. What matters is whether the employer exists and the wages match the IRS record, not which software produced the form.

Is a masked Social Security number on a W-2 a red flag?

No. Employers may truncate the employee's SSN on the employee copies, for example to ***-**-1234. The employer's EIN, however, may never be truncated, so a masked EIN is a red flag.

Why is box 1 lower than boxes 3 and 5?

Because box 1 excludes pre-tax 401(k) deferrals, shown under code D in box 12, while boxes 3 and 5 include them. A W-2 with a large code D amount and identical boxes 1, 3 and 5 is wrong somewhere.

Can Atomara confirm that a W-2 is real?

No. Atomara checks whether the PDF was edited and shows the evidence. It is not connected to the IRS, the SSA or employers, so whether the wages are true is answered by the IRS transcript and the employer.