Fake US Pay Stub Detection – catch tampered ADP, Paychex, Gusto, and QuickBooks Payroll PDFs
US property managers screening rental applications, US auto-loan and consumer-credit underwriters, and US HR teams onboarding new starters all see the same pattern: an applicant runs a free US pay-stub generator, types in a desired employer and gross, downloads the PDF. Or they take a real ADP / Paychex / Gusto / QuickBooks Payroll / Workday / Rippling stub and edit the figures before uploading. Visual review passes either way; a Form W-2 cross-check at year-end exposes the gap, but by then the lease is signed or the loan is funded.
HTPBE? analyzes the structural layer of the PDF file – the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. If your fraud problem is a digitally fabricated or tampered pay stub, we’re the most specific tool for it.
When HTPBE? returns INCONCLUSIVE on a pay stub, that is a reason to escalate to manual review, not proof of fraud – it means HTPBE? cannot confirm the file as an untouched original.
ADP pay stubs
ADP pay stub fraud – how a tampered ADP stub gives itself away
ADP is the most widely used US payroll platform, so an ADP pay stub is also the most widely faked. A genuine one is exported straight from ADP’s payroll system and nothing about it is touched after issuance – and the file records that.
Two things break that picture. A generator site reproduces the ADP layout pixel-for-pixel, but ADP never produced the file. Or an applicant downloads a real ADP stub, opens it in Excel or a PDF editor, changes the gross or YTD figure, and re-saves – which leaves traces of the editor and of the later change in the file.
HTPBE? reads the file’s structure and returns a verdict in about three seconds – MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. The same check covers Paychex, Gusto, QuickBooks Payroll, Workday, and Rippling stubs. Check an ADP pay stub free to see which markers fire.
What flags a modified ADP stub
- Traces of an editing tool layered over the payroll export
- Revisions saved after the original export
- Modification date trailing the creation date by days or months
- Replacement characters stamped over the original figures
- INCONCLUSIVE – HTPBE? cannot confirm the stub as an untouched original
What this looks like
How fake and tampered pay stubs actually look
Three real fraud mechanics we catch at the structural PDF layer.
Generator-tool fabrication
Free online pay-stub generator sites produce a plausible-looking PDF for any employer name and gross the user types in. A stub like this comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. An INCONCLUSIVE result means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.
Real pay stub edited after issuance
Authentic pay stub from a US payroll system (ADP, Paychex, Gusto, QuickBooks Payroll, Workday, Rippling, Square Payroll, Justworks). The applicant downloads it, opens it in any PDF editor or spreadsheet, edits Gross or YTD, exports as PDF. The edit typically leaves traces of the editor in the file.
Multiple ‘monthly’ stubs batch-created in one session
Six monthly stubs for January through June, all produced in a single sitting. Real monthly issuance produces files a month apart, and the dates the API returns for each file make the batch visible.
ADP, Workday, and Gusto stubs cloned by a generator
The three most-faked US payroll layouts are ADP, Workday, and Gusto, because their stub designs are the most widely recognised. A generator site reproduces the look pixel-for-pixel; the clone comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. An INCONCLUSIVE result means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.
The scale
Why your existing US checks miss this
W-2 cross-check arrives in February. The stub was uploaded in March.
Plaid, Finicity, and The Work Number help when they help – they do not cover the PDF the applicant submitted.
US tenant-screening platforms (Snappt, The Closing Docs, RentSpree) and consumer-lending vendors run income checks through Plaid, Finicity, MX, or The Work Number – when the applicant consents or when the employer is in coverage. Applicants who fabricated the pay stub almost never connect a bank, and many small employers are outside Work Number coverage. Form W-2 reconciliation against IRS data only happens at tax filing – too late. The W-2 PDF an applicant submits as annual income proof can be checked the same way. HTPBE? checks the pay stub PDF at the moment of intake, whichever payroll provider’s name is on it.
What HTPBE? checks
Detection capabilities
Deterministic structural signals. No probabilistic scores, no model training.
INCONCLUSIVE goes to review
INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud. A stub is not passed on how closely it copies a payroll provider’s layout.
A pixel-perfect clone earns nothing for its look
A stub from a pay-stub generator site comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. An INCONCLUSIVE result means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.
Post-issuance edit detection
Editing a payroll export after issuance – in a PDF editor, or by rebuilding it in other software – leaves structural evidence behind. HTPBE? flags it as MODIFIED.
Character overlay on the original
Changing a figure on an existing stub leaves a structural trace. HTPBE? flags it without reading the page – it never looks at what the figures say.
Batch-produced sets
When multiple ‘monthly’ stubs arrive together, the API returns each file’s own dates. Real monthly issuance produces files a month apart; a set produced in one sitting stands out.
Dates that disagree
A ‘fresh’ stub whose own dates show it was changed months later is a high-confidence flag for post-export editing.
Share with engineering
Wire this into your intake pipeline in under a day
Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.
Pricing
Self-serve plans, no sales call
All plans include the same forensic checks. Pick the quota that matches your monthly document volume.
manualStarter
30 credits/mo
Manual spot-checks and integration testing
most commonGrowth
350 credits/mo
Active document processing pipelines
high volumePro
1,500 credits/mo
High-volume automation and API integrations
Enterprise (unlimited, on-premise available) — see full pricing
API key on signup. Free test environment on every plan. No card required.
Customer Stories
Teams that stopped document fraud
Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.
Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.
Sarah M.
AP Manager
United States
We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.
Lars V.
Risk Analyst, Online Lending
Netherlands
Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.
Priya K.
HR Operations Lead
India
Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.
Julien R.
Fraud Analyst, Fintech
France
Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.
Marta S.
Compliance Coordinator
Spain
One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.
Tariq A.
Finance Manager
United Arab Emirates
FAQ
Frequently asked questions
Does HTPBE? work with pay stubs from any US payroll provider?
Can it catch pay stubs from generator websites?
modified when the file itself carries evidence of editing or fabrication, whatever tool produced it. An inconclusive result means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.How is this different from Snappt or The Closing Docs?
What about phone photos of pay stubs?
What does an INCONCLUSIVE verdict mean for a pay stub?
How can you tell if a pay stub is fake?
modified when the file itself carries evidence of editing or fabrication, whatever tool produced it; inconclusive means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud. Edited stubs also carry recorded dates showing the file was changed after creation. HTPBE? reads all of these structural traces and returns a verdict in about three seconds. Check a pay stub free to see which markers fire.How do you spot a fake ADP pay stub?
modified when the file itself carries evidence of editing or fabrication, whatever tool produced it. An inconclusive result means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud. The same check works for Paychex, Gusto, QuickBooks Payroll, Workday, and Rippling stubs.How do landlords and lenders detect a fake paycheck or pay stub PDF?
modified when the file carries evidence of editing or fabrication, whatever tool produced it – evidence that is invisible in a PDF viewer but present in the file itself.Secure your workflow
Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.