How to verify a pay stub, step by step

Published 2026-08-27 How-toRental

A pay stub is the single most forged document in consumer lending and rental screening, for a reason that has nothing to do with sophistication: generators that produce a convincing one cost less than a cinema ticket, take ninety seconds, and let the buyer type whatever salary they need. Meanwhile the person receiving it usually gives it fifteen seconds and a glance at the net figure.

The good news is that the same speed cuts both ways. Most fabricated stubs fail a check that takes about three minutes, and the checks are worth doing in a specific order — cheapest and most decisive first.

Step 1: do the arithmetic

Before you look at the file, look at the numbers. This costs nothing, needs no tools, and catches more fabrications than anything else on this page, because generators are built to look right rather than to add up.

Gross minus the itemised deductions must equal net. Exactly. Not close.
Year-to-date figures must be consistent across two consecutive stubs: this period's YTD minus last period's YTD should equal this period's gross.
The tax withheld should be plausible for the gross and the jurisdiction. A stub showing a flat, round percentage where a real payroll system would produce an odd number is worth a second look.
The pay period dates should follow the employer's stated cycle without gaps or overlaps, and the pay date should fall after the period ends, not inside it.
Hours multiplied by the rate should reconcile to gross, including any overtime line.

Ask for two consecutive stubs rather than one. A single stub can be internally consistent by luck; two that have to agree with each other are much harder to fake, and the YTD column is where the failure usually shows.

Step 2: read the file, not the page

A PDF records how it was made. Open it and look at its properties — File → Properties in most readers — and read four fields:

Producer and Creator: the software that wrote the file. Real payroll output names a reporting engine — the kind of string that comes out of an enterprise system. "Microsoft Word", "Canva", "Photoshop", "iLovePDF" or an online PDF editor means the document was assembled by hand, not issued by a payroll run.
Creation date and modification date: software that generates a document writes both within seconds. A modification date hours or days later means the file was reopened and saved again.
Fonts: a document produced in one pass embeds a small, consistent set. A patchwork suggests text was pasted in from elsewhere.
Page count: fabricated stubs are often one page duplicated with the numbers swapped, which shows up as identical structure across supposedly different pay periods.

You can also try to select the amounts with your cursor. Figures that look printed but will not select cleanly have been painted over the page as an image — which is what happens when someone covers the original number with a box and types a new one on top. Our free PDF metadata checker reads these fields for you in the browser; the file is parsed on your own machine and never uploaded.

Step 3: check the employer exists, separately

This is the step people skip, and it is the only one that produces a real answer. Look up the employer independently — company register, their own website, a phone number you found yourself — and call the main line. Never the number printed on the stub: if the document is fabricated, so is the contact on it, and the person who answers will confirm anything you ask.

Ask a narrow question that a payroll or HR desk can answer without breaching anything: is this person currently employed, and does the stated employment start date match. You are not asking them to confirm a salary; you are asking whether the relationship the document describes exists at all. Where the employer is a one-person company or a very small business, check the register for incorporation date and registered address — freshly incorporated entities with a residential address, created shortly before the application, are a pattern worth pausing on.

What none of this proves

Clean metadata does not mean a document is genuine. Metadata can be stripped or forged outright; plenty of legitimate stubs get re-saved by an employee's phone, an email gateway or a portal before they reach you, and that re-save leaves exactly the same trace as an edit would. The Producer field is evidence, not a verdict.

Correct arithmetic does not prove much either — the better generators do the maths properly. What the arithmetic gives you is a cheap filter that removes the careless majority, so your attention goes to the documents that survive it.

The only check that genuinely settles the question is the one that goes around the document entirely: an independent confirmation that the employer exists and the person works there, or a bank-verified income connection where the data comes from the bank rather than from a file the applicant hands over.

When to escalate

Two or more of these together justify asking for a different form of proof rather than arguing about the stub: the arithmetic does not close, the file names a design or editing tool as its producer, the modification date sits well after creation, the employer cannot be found independently, or the stub arrives as a photograph of a screen. At that point the right request is not "explain this" but "send the original as your payroll system produced it, or connect a bank income check instead".

If you would rather not do the file step by hand, upload the PDF on the homepage for a full forensic check — your first one is free. The related guides go deeper: detecting a fake pay stub, verifying an employment letter, and screening tenant documents.