A forged pay stub or proof-of-income document is one of the most common pieces of financial fraud submitted to lenders and landlords. The motive is straightforward: inflate the salary, shrink the deductions, or invent an employer entirely. On a printed or emailed PDF the result can look convincing at a glance.
The checks below work through the main tells — employer verification, PDF metadata, the arithmetic of gross and net pay, cross-referencing against bank statements, and visual inconsistencies in fonts and layout. Work through them in order: the first two catch most casual forgeries before you read a single number.
What income documents look like in the US
In the United States, proof of income most commonly takes the form of a pay stub issued by an employer or a third-party payroll provider such as ADP, Gusto or Paychex. A genuine pay stub lists the pay period, employer name and EIN, gross earnings, itemised deductions (federal and state income tax, Social Security, Medicare, any voluntary withholdings) and the resulting net pay — plus year-to-date totals for each line. Self-employed applicants typically provide bank statements showing recurring direct-deposit credits, 1099 forms, or a signed letter from their accountant.
Each format carries its own conventions: payroll-software vendors embed their name in the PDF metadata, standard field labels are well-established, and the arithmetic relationship between gross pay, deductions and net pay is fixed by law. A forger who edits one figure — raising gross earnings or reducing a deduction — rarely updates every dependent total consistently, which is the first thing a systematic check will catch. A recent bank statement showing the employer's direct-deposit credits is the single strongest corroborating document to request alongside any pay stub.
1. Verify the employer exists and matches
Before looking at any numbers, check that the employer named on the document actually exists. Search the company register for the country (UK Companies House, KRS for Poland, the Ukrainian Unified State Register). Confirm the registration number on the document matches, that the company is active, and that its registered address and activity match what is described. A phantom company — or one dissolved years ago — is the clearest sign of a fabricated certificate. Also confirm the employer's name, address, phone and email on the document against their official website or register entry: forgers often reuse a real company name with invented contact details to avoid verification calls reaching the genuine employer.
2. Metadata and software traces
Open the PDF's properties (Adobe Reader: File → Properties) and read the Producer, Author and Creator fields. A payslip generated by payroll software typically carries that software's name (e.g. Sage, Enova, SAP). If you see Adobe Acrobat, Microsoft Word, LibreOffice or a PDF printer, the file was composed or edited by hand outside any payroll system — a strong signal that it was not produced by an employer's automated process. Also check the creation date and the last-modified date: if the document is dated for one month but the PDF metadata shows it was last saved weeks later, someone reopened and resaved it. All files submitted to Atomara are handled under strict security and deleted after review.
3. Re-check the maths: gross, deductions, net
Gross pay minus all deductions should equal net pay. This is the single most reliable arithmetic check. Forgers typically edit one figure — raising the gross or reducing a deduction — and fail to cascade that change through every dependent total. Add the listed deductions yourself and subtract from gross: if the result differs from the stated net pay by more than a rounding penny, the document has been altered. Do the same for any year-to-date totals if they appear. A spreadsheet takes two minutes and catches a large proportion of edited documents.
4. Cross-check against bank statements
The stated net salary should appear as a regular credit in the applicant's bank statement — from the same employer, at roughly the same date each month, for the same amount. If the monthly credits do not match the net pay on the payslip, one of the documents is wrong. Common mismatches: the pay stub claims a net of $2,400 but the bank statement shows monthly credits of $1,600; or the employer named on the certificate does not match the reference line on the bank transfer. Check that the bank statement itself is genuine — presenting a forged payslip alongside a forged statement is a well-known combination. See also our guide on document fraud in lending for a broader picture of how fraudsters combine documents.
5. Fonts, alignment and template tells
Employers who produce payslips consistently use one font family throughout. A figure that was pasted in from a different source often carries a slightly different typeface, weight or letter-spacing. Zoom to 200–400% and scan each column of figures: one number sitting half a baseline above its neighbours, or whose digits look slightly fatter or thinner, points to a paste-in.
Template inconsistencies are equally telling. Every line of a real payslip is uniformly spaced; an inserted line often breaks the rhythm. The employer's logo, if present, should be sharp — a logo that looks blurry or has colour banding was lifted from a screenshot rather than embedded as a vector. If the document is supposed to carry a stamp and signature, inspect them at full zoom: real ink bleeds into paper fibres; a copied image of a stamp looks flat and crisp in an unnatural way.
When to verify forensically
The checks above depend on a forger making mistakes. A careful edit — or a document generated entirely from a blank template — can pass all visual and arithmetic tests while still carrying traces in its internal PDF structure: edit layers, font substitution records, object-creation timestamps and compressed stream differences invisible to the eye. When the decision is worth more than a few minutes of caution — a loan approval, a long-term tenancy, a high-value contract — submit the file for forensic verification. Our forensic analysis reads the parts of the document a person never opens and weighs them against how genuine payroll documents are structured, reporting a finding and confidence score.
What forensic verification adds
Manual checks are a good first filter. Forensic verification goes further: it inspects the PDF object tree, incremental-update history, embedded font fingerprints and metadata streams that no viewer exposes, and checks whether the document's internal construction is consistent with the payroll software it claims to come from. The method is universal — it needs no template for your employer's payroll provider — and every result carries a confidence score. Return to the guides hub for related checks on bank statements, invoices and payment confirmations, or read about verifying a tenant's documents. Your files are handled under strict security and GDPR controls and deleted after review.
Frequently asked questions.
How can I tell if a pay stub is fake?
Verify the employer exists and matches the application, check the PDF metadata for editing-software traces, and recompute the maths: gross minus deductions must equal net. Stubs from online generators routinely fail the metadata and maths checks.
Do landlords and lenders actually verify pay stubs?
Yes. Fake pay stubs are among the most common documents in rental and lending fraud, so income is cross-checked against bank-statement deposits and the file itself is examined for edit traces.
What should I do if a pay stub turns out to be fake?
Decline the application and keep the file and your findings as evidence. If you have already suffered a loss, report it to the police and, where relevant, to the platform or agency that introduced the applicant.
Checking these documents inside your product?
The same check runs as a REST API for software that receives documents from its users:
