How to Spot a Fake Pay Stub: A Reviewer’s Guide

If you review pay stubs — screening tenants, underwriting a loan, checking a job applicant’s stated salary — you already have habits for spotting a bad one: you check the math, you look at the fonts, you squint at the alignment. Most of the time those habits work: a rushed forgery has a tell, and after a few hundred stubs the fake ones start to look wrong before you can say exactly why.

This guide collects that visual checklist in one place — the concrete things a reviewer can look for without any special tooling. It also says where that checklist stops working. A well-executed edit to an otherwise genuine pay stub can pass most of this list. That’s not a reason to skip the checklist — most fakes are still sloppy, and catching the sloppy ones by eye saves everyone time. It’s a reason to know what the checklist can’t see, and what does.

The Visual Checklist

Work through these in order. Each one takes seconds, and together they catch a meaningful share of low-effort forgeries.

1. Does the math actually add up?

Gross pay minus deductions should equal net pay, every time, on every line. Add up the year-to-date figures against the stub’s own pay-period math — if the stub shows a bi-weekly pay date, does the YTD gross look like a plausible multiple of the per-period gross for that point in the year? Fabricated stubs are often built by someone typing numbers into a template rather than running them through a real payroll calculation, and the arithmetic doesn’t always reconcile once you check it against itself.

2. Do the deductions make sense for the numbers shown?

Tax withholding, and other statutory deductions where applicable, should sit in a plausible range for the stated gross and the jurisdiction. A stub with a suspiciously round federal withholding, or a state tax line that doesn’t match the address on the document, is worth a second look. So is a stub with no deductions at all beyond taxes — real payroll runs almost always carry at least one benefit or retirement deduction line for a salaried employee.

3. Fonts and alignment

Open the stub at full zoom and look at every number field individually. A genuine payroll export is typographically uniform — a field that was retyped often sits slightly apart from its neighbors: a pixel or two off the shared baseline, a very slightly different font weight, or different character spacing. This is the single most useful thing a careful human eye can catch on a low-effort forgery.

4. Employer details that don’t line up

Cross-check the employer name, address, and any logo against what you can find publicly — a company website, a business registry, a LinkedIn page. A pay stub claiming to be from a company whose registered address doesn’t match, or whose logo is a stretched or low-resolution copy of the real one, is a red flag independent of anything on the numbers side.

5. Formatting that doesn’t match the claimed provider

Most employees are paid through recognizable payroll platforms — ADP, Paychex, Gusto, Workday, or an in-house system — each with a distinctive layout, header style, and footer disclaimer text. If you review pay stubs regularly, you’ll start to recognize these templates. A stub that claims to come from a well-known payroll provider but doesn’t match that provider’s actual layout is worth flagging. Generic “pay stub template” formatting — the kind sold on template marketplaces — has a look of its own once you’ve seen a few.

6. Inconsistent or implausible dates

Check that the pay period, pay date, and year-to-date figures are internally consistent with each other and with the calendar. A pay date that falls on a weekend for a company that pays biweekly on Fridays, or a YTD figure that doesn’t grow correctly across consecutive stubs from the same person, is a signal worth pursuing.

7. File metadata, if you can see it

Some PDF viewers expose basic document properties — right-click and look for “Document Properties” or similar. A stub whose stated creator or producer tool contradicts the claimed payroll provider (for example, a document that claims to be issued by a major payroll platform but whose metadata says it was produced by a generic PDF editor) is worth a second look. This is a coarse signal — plenty of legitimate documents pass through a compression or conversion step for unrelated reasons — but it’s a free check if your viewer shows it.

Where This Checklist Runs Out

Every item above is a content check — it asks whether what’s printed on the page looks right. A well-executed edit to an otherwise genuine pay stub can pass most of these checks.

When a forger works from a genuine document instead of a blank template, the visible layer is inherited rather than recreated — the typography, the employer block, the provider styling, and the surrounding dates were never the part that changed. Nothing on the page has to be rebuilt convincingly, so there’s little for the eye to compare against. A visual review is scoring the parts of the document a careful edit tends to leave alone.

This is the gap between “does this look right” and “was this file changed after it was issued.” Those are two different questions, and a visual review — however careful — is mostly answering the first one.

The Layer That Answers the Other Question

A PDF isn’t just the page you see. It’s a structured file that records how it was built and what happened to it after it was produced. Opening a genuine pay stub and saving an edit usually leaves traces in that internal structure, even when the visible numbers look convincing afterward.

HTPBE? is a self-serve API (and a free web check, for a one-off) that reads that structure and returns one of three verdicts, plus a list of named findings describing what it found:

• intact — no structural evidence the file was changed after it was created, and nothing in its origin blocks that reading. This isn’t proof the numbers on it are true — it’s the absence of structural evidence that the file was altered.
• modified — the file carries structural evidence that it was changed after it was first generated. This is the case a visual check can’t see: the visible page can look untouched while the file itself records that it was not.
• inconclusive — the file’s origin doesn’t give us an institutional baseline to check integrity against, which happens with consumer software, online editors, and scanners among others. This isn’t a pass and isn’t an automatic reject — it’s a routing signal. A stub claiming to be from a major payroll platform that comes back inconclusive is worth escalating with an employer confirmation regardless of the reason; a smaller employer running their own payroll often produces this result as a matter of course.

It never asks whether the salary figure is believable — that’s the content-review job the checklist above already does well. It asks whether the file’s own construction shows signs of change after issuance. That makes it additive: it sits alongside employer callbacks, income cross-checks, and the visual review above, covering the one case none of those were built to see — a well-executed edit to an otherwise genuine document.

You can try this directly: drop a pay stub into the free check on this site and get a verdict in a few seconds, no account needed — an intact or inconclusive result comes back as a full report; a modified result unlocks its detected-signal detail once you register. It’s the same engine behind the API, and it’s a fast way to check a single document before deciding whether to escalate it.

What This Doesn’t Solve Either

Two honest limits are worth naming. First, no structural check speaks to whether the numbers on the page are true. Structural analysis answers “was this file changed after it was issued,” not “is this claim real” — a document can be structurally unremarkable and still describe employment or income that never existed. That’s exactly why the visual checklist above stays in the process: content review and structural review answer different questions, and each is blind where the other isn’t.

Second, structural analysis can’t confirm employment or income independently — it can’t tell you the person actually works there or actually earns that amount. It tells you whether the file in front of you was changed after it left whatever system produced it. Employer verification, income cross-checks against bank records, and the visual review above all still matter. The point of adding a structural check isn’t to replace any of that — it’s to close the one gap none of it covers.

Building This Into a Review Process

For teams that want to add this as a routine step rather than a one-off check, the integration is small. Send the stub’s file location to the analyze endpoint:

curl -X POST https://api.htpbe.tech/v1/analyze \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-storage.example.com/paystubs/applicant-3391.pdf"}'

Fetch the result by the returned ID:

curl https://api.htpbe.tech/v1/result/<check-id> \
  -H "Authorization: Bearer YOUR_API_KEY"

Route on the verdict: modified goes to manual review and a request for a fresh copy pulled directly from the source system; inconclusive branches on the claimed provider, exactly as described above; intact proceeds to your normal content review — the checklist at the top of this guide.

Full documentation, including test keys you can try against sample documents before spending a credit, is at the API reference.

Related Reading

This checklist is deliberately general — for a US payroll platform still on file, see the dedicated fake pay stub use case; for mortgage underwriting specifically, see altered paystubs and W-2s; for hiring and background-verification workflows, see payslip fraud in HR.

The Short Version

Run the visual checklist first — it’s fast, and it catches most low-effort fakes. Check the math, check the fonts and alignment, check the employer details, check the provider formatting, check the dates. When a stub passes all of that and something still feels off, or when the document matters enough that “looks right” isn’t a good enough bar, add a structural check on top. The two layers catch different things, and neither one replaces the other.