logo
US pay stub fraud

Fake US Pay Stub Detection — catch tampered ADP, Paychex, Gusto, and QuickBooks Payroll PDFs

Built for fraud ops at lending, insurance & compliance teams

US property managers screening rental applications, US auto-loan and consumer-credit underwriters, and US HR teams onboarding new starters all see the same pattern: an applicant runs a free US pay-stub generator, types in a desired employer and gross, downloads the PDF. Or they take a real ADP / Paychex / Gusto / QuickBooks Payroll / Workday / Rippling stub and edit the figures before uploading. Visual review passes either way; a Form W-2 cross-check at year-end exposes the gap, but by then the lease is signed or the loan is funded.

~3 sec
per document
62 checks
forensic layers
From $15
per month
1,500+
docs / month on Growth
Scope

HTPBE? analyzes the structural layer of the PDF file — the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. If your fraud problem is a digitally fabricated or tampered pay stub, we’re the most specific tool for it.

When HTPBE? returns INCONCLUSIVE on a pay stub, that’s itself a fraud signal in this context — real pay stubs always come from a US payroll system, never from a desktop tool or generator site.

ADP pay stubs

ADP pay stub fraud — how a tampered ADP stub gives itself away

ADP is the most widely used US payroll platform, so an ADP pay stub is also the most widely faked. A genuine one is exported straight from ADP’s payroll system: it carries ADP’s producer signature in the PDF metadata, a single cross-reference table, the institutional structure a payroll engine emits, consistent font subsets across every page, and a modification date that matches its creation date. Nothing about it was touched after issuance, and the file records that.

Two things break that picture. A generator site reproduces the ADP layout pixel-for-pixel but renders through a headless browser or a generic PDF library — so the ADP signature is simply absent and the institutional metadata never appears. Or an applicant downloads a real ADP stub, opens it in Excel or a PDF editor, changes the gross or YTD figure, and re-saves — which swaps ADP’s producer for the editor’s, appends a second cross-reference table, pushes the modification date past the creation date, and breaks the gross-to-net arithmetic unless every dependent line is edited too.

HTPBE? reads all of those structural traces and returns a verdict in about three seconds: a missing ADP signature on an ADP-styled stub, or a producer mismatch plus an edit trail on one that claims to be ADP. The same check covers Paychex, Gusto, QuickBooks Payroll, Workday, and Rippling stubs. Check an ADP pay stub free to see which markers fire.

What flags a modified ADP stub

  • Producer is not ADP’s payroll engine — Microsoft Word, Excel, a PDF editor, or Chrome Headless
  • A second cross-reference table appended after the original export
  • Modification date trailing the creation date by days or months
  • Gross-to-net arithmetic that no longer reconciles
  • INCONCLUSIVE on an ADP-styled stub — the ADP signature is absent

What this looks like

How fake and tampered pay stubs actually look

Three real fraud mechanics we catch at the structural PDF layer.

01

Generator-tool fabrication

Free online pay-stub generator sites produce a plausible-looking PDF for any employer name and gross the user types in. These tools leave a recognisable producer signature (often Chrome Headless or a specific PDF library) and miss the institutional metadata real payroll exports carry. Producer mismatch is unambiguous.

02

Real pay stub edited after issuance

Authentic pay stub from a US payroll system (ADP, Paychex, Gusto, QuickBooks Payroll, Workday, Rippling, Square Payroll, Justworks). The applicant downloads it, opens it in any PDF editor or spreadsheet, edits Gross or YTD, exports as PDF. Producer field changes from the payroll engine to whichever editor was used.

03

Multiple "monthly" stubs batch-created in one session

Six monthly stubs for January through June, all carrying creation timestamps within minutes of each other and identical font subset prefixes. Real monthly issuance produces dates a month apart. Cross-document timestamp clustering exposes the batch.

04

ADP, Workday, and Gusto stubs cloned by a generator

The three most-faked US payroll layouts are ADP, Workday, and Gusto, because their stub designs are the most widely recognised. A generator site reproduces the look pixel-for-pixel but cannot reproduce the payroll engine’s producer signature or the institutional metadata ADP, Workday, and Gusto exports embed — so the clone reads as a desktop or headless-browser render, not a payroll export.

The scale

~1 in 6
rental applications contain misrepresented financial information
$3,500+
average eviction cost when fraudulent income passes screening
~3 sec
per pay stub via API

Why your existing US checks miss this

W-2 cross-check arrives in February. The stub was uploaded in March.

Plaid, Finicity, and The Work Number help when they help — they do not cover the PDF the applicant submitted.

US tenant-screening platforms (Snappt, The Closing Docs, RentSpree) and consumer-lending vendors run income checks through Plaid, Finicity, MX, or The Work Number — when the applicant consents or when the employer is in coverage. Applicants who fabricated the pay stub almost never connect a bank, and many small employers are outside Work Number coverage. Form W-2 reconciliation against IRS data only happens at tax filing — too late. HTPBE? catches the pay stub PDF at the moment of intake: ADP, Paychex, Gusto, QuickBooks Payroll, Workday, Rippling, Square Payroll, Justworks all carry recognisable producer signatures; a Word, Excel, or Chrome Headless producer is the smoking gun.

Results in under 3 seconds30 to 1,500+ documents/monthFrom $15/mo

What HTPBE? checks

Detection capabilities

Deterministic structural signals. No probabilistic scores, no model training.

Producer signature mismatch

Authentic pay stubs carry the producer signature of US payroll software (ADP, Paychex, Gusto, QuickBooks Payroll, Workday, Rippling, Square Payroll, Justworks). When the producer is Microsoft Excel, Microsoft Word, LibreOffice, Chrome Headless, or a generic PDF library, the document was edited or fabricated on a desktop or generator tool.

Generator-tool fingerprint detection

Pay-stub generator sites typically render PDFs through headless browsers or specific PDF libraries. Their producer signatures and document structure differ from authentic payroll exports — a clean detection signal.

Incremental update trail

A clean payroll export has one cross-reference table. Re-saves through any editor append a second xref — visible structural evidence of post-issuance editing.

Gross-to-net arithmetic

Line arithmetic across the stub (Gross → federal tax → Social Security → Medicare → state tax → net) is checked row by row. Edited gross figures break the chain unless every dependent field is also adjusted.

Cross-document timestamp clustering

When multiple "monthly" stubs arrive together, the API surfaces creation timestamps for each. Real monthly issuance produces dates a month apart; batch-fabricated sets cluster within minutes — combined with identical font subsets, the batch pattern is unambiguous.

Modification timestamp gap

A real stub from March has CreationDate ≈ ModDate in March. A months-later modification on a "fresh" stub is a high-confidence flag for post-export editing.

Share with engineering

Wire this into your intake pipeline in under a day

Two API calls — one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.

Full API reference for engineering

Pricing

Self-serve plans, no sales call

All plans include the same forensic checks. Pick the quota that matches your monthly document volume.

manual

Starter

$15/mo

30 checks/mo

Manual spot-checks and integration testing

most common

Growth

$149/mo

350 checks/mo

Active document processing pipelines

high volume

Pro

$499/mo

1,500 checks/mo

High-volume automation and API integrations

Enterprise (unlimited, on-premise available) — see full pricing

Secure your workflowView API docs

API key on signup. Free test environment on every plan. No card required.

Customer Stories

Teams that stopped document fraud

Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.

Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.

Sarah M.

AP Manager

United States

We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.

Lars V.

Risk Analyst, Online Lending

Netherlands

Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.

Priya K.

HR Operations Lead

India

Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.

Julien R.

Fraud Analyst, Fintech

France

Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.

Marta S.

Compliance Coordinator

Spain

One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.

Tariq A.

Finance Manager

United Arab Emirates

FAQ

Frequently asked questions

Does HTPBE? work with pay stubs from any US payroll provider?

Yes. The analysis is producer-agnostic — it inspects whichever PDF the applicant submits. Authentic stubs from ADP, Paychex, Gusto, QuickBooks Payroll, Workday, Rippling, Square Payroll, Justworks, BambooHR Payroll, or smaller in-house systems all carry recognisable producer signatures.

Can it catch pay stubs from generator websites?

Yes — that pattern (free pay-stub generator → desired employer + gross → PDF download) is one of the most common US rental and lending fraud signatures. Generator tools leave fingerprints in the producer field (often Chrome Headless or a specific PDF library) and miss the institutional metadata authentic payroll exports embed.

How is this different from Snappt or The Closing Docs?

Snappt and The Closing Docs operate at the property-manager UI layer with proprietary detection. HTPBE? is a developer API — the same forensic depth, exposed via REST, suitable for tenant-screening platforms, PropTech builders, and any system that accepts PDF uploads programmatically. They are aimed at different buyers.

What about phone photos of pay stubs?

Phone photos are raster images with no PDF structure to analyse — outside scope. Always require digital PDF uploads from applicants. If you cannot enforce that, pair HTPBE? with image-forensics tooling for the photo cases.

What does an INCONCLUSIVE verdict mean for a pay stub?

HTPBE? returns INCONCLUSIVE when a pay-stub PDF lacks the institutional producer signature that genuine US payroll-system exports carry — typically because the file was authored on a desktop or generator tool (Chrome Headless, Word, Excel) rather than exported from a payroll engine such as ADP, Paychex, Gusto, Workday, or Rippling. In the pay-stub context, INCONCLUSIVE is itself a high-confidence fraud signal: a real pay stub from any major US payroll provider carries that provider’s producer signature — a generator-tool or desktop-tool stub is a strong indicator of fabrication. Treat INCONCLUSIVE on a pay stub as fraud-positive and route the case to Open Banking income source-of-truth check or employer VOE before any tenancy, lending, or hiring decision.

How can you tell if a pay stub is fake?

On screen a fabricated or edited pay stub can look perfect — fonts, logo, and layout all match. The tell is inside the PDF file, not on its surface. A genuine stub is exported by a payroll engine and carries that engine’s producer signature; a fake one carries the fingerprint of the tool that actually made it — a generator site (often Chrome Headless), Microsoft Excel, Microsoft Word, or a PDF editor. Edited stubs also pick up extra cross-reference tables and a modification date that trails the creation date. HTPBE? reads all of these structural traces and returns a verdict in about three seconds. Check a pay stub free to see which markers fire.

How do you spot a fake ADP pay stub?

A real ADP stub is exported by ADP’s payroll system and carries ADP’s producer signature in the PDF metadata. The two common fakes are (1) a generator-site stub that mimics ADP’s layout but renders through a headless browser or a generic PDF library, and (2) a real ADP stub downloaded, opened in Excel or a PDF editor, and re-saved with edited figures — which swaps the ADP producer for the editor’s and appends an extra revision layer. HTPBE? flags both: a missing ADP signature on an ADP-styled stub, or a producer mismatch plus an edit trail on one that claims to be ADP. The same check works for Paychex, Gusto, QuickBooks Payroll, Workday, and Rippling stubs.

How do landlords and lenders detect a fake paycheck or pay stub PDF?

Eyeballing the layout and re-keying the gross-to-net math catches the clumsy fakes, but a clean re-save in Excel or a generator-site stub passes visual review every time. The reliable layer is a structural check on the file itself: HTPBE? inspects the PDF’s binary structure for a producer that is not a US payroll system, additional cross-reference tables, a creation-to-modification date gap, and — across a batch of "monthly" stubs — creation timestamps clustered within minutes instead of a month apart. Those signals are invisible in a PDF viewer but unambiguous in the file.

Secure your workflow

Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.

Start Free — Close the Structural Fraud GapSee Pricing
Read API Docs →