Pay-stub generator sites churn out plausible PDFs in seconds — and visual review cannot tell the difference
Property managers screening rental applications, auto-loan underwriters, and HR teams onboarding new starters all see the same pattern: an applicant runs a free pay-stub generator, types in a desired employer and gross, downloads the PDF. Or they take a real ADP/Gusto/Paychex stub and edit the figures before uploading. Visual review passes either way.
htpbe? analyzes the structural layer of the PDF file — the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. If your fraud problem is a digitally fabricated or tampered pay stub, we’re the most specific tool for it.
When htpbe? returns INCONCLUSIVE on a pay stub, that’s itself a fraud signal in this context — real pay stubs always come from a US payroll system, never from a desktop tool or generator site.
One REST call, one deterministic verdict
Upload the PDF. The API returns INTACT, MODIFIED, or INCONCLUSIVE with named markers — in about three seconds.
How fake and tampered pay stubs actually look
Three real fraud mechanics we catch at the structural PDF layer.
Generator-tool fabrication
Free online pay-stub generator sites produce a plausible-looking PDF for any employer name and gross the user types in. These tools leave a recognisable producer signature (often Chrome Headless or a specific PDF library) and miss the institutional metadata real payroll exports carry. Producer mismatch is unambiguous.
Real pay stub edited after issuance
Authentic pay stub from a US payroll system (ADP, Paychex, Gusto, QuickBooks Payroll, Workday, Rippling, Square Payroll, Justworks). The applicant downloads it, opens it in any PDF editor or spreadsheet, edits Gross or YTD, exports as PDF. Producer field changes from the payroll engine to whichever editor was used.
Multiple "monthly" stubs batch-created in one session
Six monthly stubs for January through June, all carrying creation timestamps within minutes of each other and identical font subset prefixes. Real monthly issuance produces dates a month apart. Cross-document timestamp clustering exposes the batch.
The scale
Why your existing checks miss this
Open Banking shows the income. It only works when the applicant connects.
Applicants who fabricated the stub rarely connect the bank.
Tenant-screening platforms (Snappt, The Closing Docs, RentSpree) and lending-tech vendors verify income through Open Banking (Plaid, Finicity, MX) when the applicant agrees to connect — applicants who fabricated the pay stub rarely do. VOE services (The Work Number, manual employer calls) work but are slow and partial. htpbe? catches the pay stub PDF the applicant uploaded at the moment of intake — standalone, no Open Banking consent, no employer call required.
Five forensic layers, one deterministic verdict
Every PDF we receive passes through the same structural pipeline — no model training, no thresholds to tune.
Metadata analysis
Creation and modification timestamps, producer and creator fields, XMP metadata — the first layer exposes basic tampering.
File structure
Xref tables, trailer chain, incremental updates. Any edit after export leaves a structural fingerprint here.
Digital signatures
Signature chain integrity and post-signature modifications produce deterministic markers. Certainty-level signal.
Content integrity
Fonts, objects, embedded content, page assembly. Multi-session edits and inserted objects are visible at this layer.
Verdict with markers
Deterministic output: INTACT / MODIFIED / INCONCLUSIVE, with named markers for every finding — suitable for audit trail.
Pay stub and adjacent income-proof PDFs we check
Every type listed below is analyzed at the structural file layer — not the rendered image.
Detection capabilities
Deterministic structural signals. No probabilistic scores, no model training.
Producer signature mismatch
Authentic pay stubs carry the producer signature of US payroll software (ADP, Paychex, Gusto, QuickBooks Payroll, Workday, Rippling, Square Payroll, Justworks). When the producer is Microsoft Excel, Microsoft Word, LibreOffice, Chrome Headless, or a generic PDF library, the document was edited or fabricated on a desktop or generator tool.
Generator-tool fingerprint detection
Pay-stub generator sites typically render PDFs through headless browsers or specific PDF libraries. Their producer signatures and document structure differ from authentic payroll exports — a clean detection signal.
Incremental update trail
A clean payroll export has one cross-reference table. Re-saves through any editor append a second xref — visible structural evidence of post-issuance editing.
Gross-to-net arithmetic
Line arithmetic across the stub (Gross → federal tax → Social Security → Medicare → state tax → net) is verified row by row. Edited gross figures break the chain unless every dependent field is also adjusted.
Cross-document timestamp clustering
When multiple "monthly" stubs arrive together, the API surfaces creation timestamps for each. Real monthly issuance produces dates a month apart; batch-fabricated sets cluster within minutes — combined with identical font subsets, the batch pattern is unambiguous.
Modification timestamp gap
A real stub from March has CreationDate ≈ ModDate in March. A months-later modification on a "fresh" stub is a high-confidence flag for post-export editing.
Two HTTP calls to verify any pay stub
Buyers can skip this section — developers, the integration is two HTTP calls.
Step 1 — submit the PDF
curl -X POST https://api.htpbe.tech/v1/analyze \
-H "Authorization: Bearer $HTPBE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "https://your-storage/applicant-paystub.pdf"}'Step 2 — read the verdict
{
"id": "p1a2y3s4-5t6u-7b8u-9s9p-d1f2g3h4i5j6",
"status": "inconclusive",
"modification_confidence": "none",
"modification_markers": [
"Generator-tool producer (Chrome Headless) — no payroll-system signature",
"Missing payroll-system institutional metadata",
"Single-session creation — no incremental update trail"
],
"producer": "Chrome Headless 124.0",
"creator": "Chrome Headless 124.0",
"creation_date": 1707350400,
"modification_date": 1707350400,
"has_digital_signature": false,
"xref_count": 1,
"has_incremental_updates": false
}htpbe? returns inconclusive — there is no edit trail, but the file lacks the payroll-system metadata genuine pay stubs carry. In the pay-stub context, inconclusive is itself a high-confidence fraud signal: a real pay stub from any major US payroll provider carries that provider’s producer signature. Chrome Headless is the fingerprint of a generator-tool render — typically a free pay-stub site’s server. Treat inconclusive on a pay stub as a strong fraud-positive flag.
Customer Stories
Teams that stopped document fraud
Compliance, finance, and risk teams use htpbe? to catch manipulated PDFs before they become costly mistakes.
Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.
Sarah M.
AP Manager
United States
We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.
Lars V.
Risk Analyst, Online Lending
Netherlands
Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.
Priya K.
HR Operations Lead
India
Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.
Julien R.
Fraud Analyst, Fintech
France
Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for verified originals when something is flagged. Already saved us from a few bad decisions.
Marta S.
Compliance Coordinator
Spain
One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.
Tariq A.
Finance Manager
United Arab Emirates
Frequently asked questions
Related solutions and guides
Tenant Screening
Pay stub + bank statement forensics for US property managers and tenant-screening platforms.
Fake W-2 Detection
Sister page — same forensics for the annual W-2 PDF.
Alternative Lending
Income document forensics for US alt-lenders and consumer fintech underwriting.
Secure your workflow
Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.