logo
Xero payslip fraud

Xero Payslip Fraud Detection – Is This Xero Payslip Original or Edited?

Built for fraud ops at lending, insurance & compliance teams

A real Xero payslip can be edited and re-saved with a higher gross – and we catch the edit. Australian property managers, UK letting agents and lenders see the same script every week: an applicant downloads a genuine Xero payslip, edits the gross figure in any PDF editor, re-exports. The visual is unchanged; the file structure is not. HTPBE? detects the edit regardless of which editor was used – and the API returns each file’s own dates, so a ‘January through June’ set produced in one sitting stands out.

~3 sec
per document
63 checks
forensic layers
1,500+
docs / month on Growth
Plans
subscriptions or one-off packs – see pricing
Scope

HTPBE? analyzes the structural layer of the PDF file – the layer where edits leave traces, even ones invisible on the page. We catch tampering and re-saves of real Xero payslips, and a payslip made to look like Xero is MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. We do NOT detect a genuine fresh Xero export – even if the trial-account ‘employer’ behind it does not exist. For that case, pair HTPBE? with Open Banking income source-of-truth check or ABN lookups; HTPBE? handles the file, those tools handle the entity.

When HTPBE? returns INCONCLUSIVE on a Xero payslip, that is a reason to escalate to manual review, not proof of fraud – it means HTPBE? cannot confirm the file as an untouched original.

Xero payslips

What a Xero payslip PDF looks like – and what changes when it is edited

A Xero payslip is a short, plain document: the employer’s name and address, the employee, the pay period and pay date, a list of earnings, the tax withheld, superannuation (in Australia) or pension and National Insurance lines (in the UK), leave balances, and the net pay. Because it is produced by a payroll system rather than typed by a person, the layout is uniform from one pay run to the next. That uniformity is what a reader trusts – and what a copy made in an editor tries to preserve.

Reading the page tells you very little about whether the file is the original. A figure changed in a PDF editor or a spreadsheet looks exactly like the figure it replaced, down to the font. The difference is in the file, not on the page. For your decision, that comes down to three outcomes: the file is intact (it looks like an unaltered export), modified (the file shows it was changed after it was created), or inconclusive (it does not look like an export from a payroll system, so it cannot be checked against one).

A typical case: a letting agent receives three Xero payslips from an applicant. Two come back intact. The third comes back modified – so the agent asks the employer for the original instead of approving on the strength of the PDF. Check a Xero payslip free to see the verdict on your own file.

What you get back for a Xero payslip

  1. 1A verdict: intact, modified or inconclusive – never a score
  2. 2A confidence level on a modified verdict, and the named checks that fired
  3. 3The creator and producer recorded in the file, for your own review
  4. 4A result page you can attach to the case file

What this looks like

How tampered and fabricated Xero-style payslips actually look

Three real fraud mechanics we catch at the structural PDF layer.

01

Real Xero export edited after download

A genuine Xero payslip downloaded by an actual employee, opened in any PDF editor, gross bumped or deductions reduced, exported as PDF. HTPBE? flags the edit made after Xero issued it.

02

Fabricated payslip mimicking Xero layout

A payslip built outside Xero from a Xero-style template lifted from screenshots and saved as PDF – never actually exported from Xero. HTPBE? does not read the layout or the figures, so looking like Xero earns the file nothing. The verdict is MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.

03

Multiple ‘monthly’ payslips batch-created in one session

Six ‘monthly’ payslips for January through June, all produced in a single sitting. Real monthly payslips are issued one per pay run, months apart, and the dates the API returns for each file make the batch visible.

The scale

~50%
of AU/UK tenancy fraud involves fake or doctored income documents
~3 sec
per payslip via API
No Xero
no Xero API integration needed – works on the file

Why your existing checks miss this

Open Banking shows the income. It does not show the employer.

And applicants who fabricated the employer rarely connect the bank.

Tenant-referencing platforms (Snappt, Goodlord, RentProfile, FCC Paragon, Equifax Tenant Tracker) and lending-tech vendors check income through Open Banking when the applicant agrees to connect – applicants who built a fake Xero company rarely do. ATO Single Touch Payroll data checks real employers but is not accessible to private property managers or lenders. HTPBE? catches the payslip the applicant uploaded, regardless of whether STP or Open Banking is available – standalone, no Xero API, no ATO lookup.

Results in under 3 seconds30 to 1,500+ documents/month

What HTPBE? checks

Detection capabilities

Deterministic structural signals. No probabilistic scores, no model training.

Looking like Xero earns nothing

HTPBE? checks the file, not the layout, so copying the Xero look earns a payslip nothing. The verdict is MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it; INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.

Post-export edit detection

Editing a Xero payslip in a PDF editor after export leaves structural evidence behind. HTPBE? flags it as MODIFIED, whichever editor was used.

Character overlay on the original

Changing a figure on an existing payslip leaves a structural trace. HTPBE? flags it without reading the page – it never looks at what the figures say.

Batch-produced sets

When multiple ‘monthly’ payslips arrive together, the API returns each file’s own dates. Real monthly issuance produces files a month apart; a set produced in one sitting stands out.

Dates that disagree

A ‘freshly issued’ payslip whose own dates show it was changed months later is a high-confidence flag for post-export editing.

Reworked payslips

HTPBE? detects documents reworked after their original creation and documents assembled from pages of different sources.

Share with engineering

Wire this into your intake pipeline in under a day

Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.

Full API reference for engineering

Pricing

Self-serve plans, no sales call

All plans include the same forensic checks. Pick the quota that matches your monthly document volume.

manual

Starter

30 credits/mo

Manual spot-checks and integration testing

most common

Growth

350 credits/mo

Active document processing pipelines

high volume

Pro

1,500 credits/mo

High-volume automation and API integrations

Enterprise (unlimited, on-premise available) — see full pricing

Secure your workflowView API docs

API key on signup. Free test environment on every plan. No card required.

Customer Stories

Teams that stopped document fraud

Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.

Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.

Sarah M.

AP Manager

United States

We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.

Lars V.

Risk Analyst, Online Lending

Netherlands

Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.

Priya K.

HR Operations Lead

India

Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.

Julien R.

Fraud Analyst, Fintech

France

Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.

Marta S.

Compliance Coordinator

Spain

One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.

Tariq A.

Finance Manager

United Arab Emirates

FAQ

Frequently asked questions

What about a payslip issued for an employer that does not exist?

Honest answer: that is an entity problem, not a file problem. A PDF genuinely exported by Xero and never touched afterwards has not been changed, so there is nothing for HTPBE? to flag – even when the account behind it is a trial spun up to invent an employer. HTPBE? checks whether the file was changed, not whether the employer or the income is real. For trial-account fraud, pair HTPBE? with Open Banking (Basiq, Frollo) to check income against the applicant’s actual bank account, or with ABN Lookup to check the employer entity. HTPBE? handles the file; those tools handle the entity.

How is this different from Open Banking income source-of-truth check?

Open Banking checks income from the applicant’s bank account – but only when the applicant agrees to connect. Applicants who fabricated the employer (and therefore have no real salary credit in any bank) rarely consent. HTPBE? catches the payslip itself, regardless of whether banking access is available. Use both.

Can it catch payslips from Xero alternatives like MYOB or Reckon?

Yes. The analysis works on payslips from any payroll system. We run a dedicated MYOB payslip page (/use-cases/fake-pay-stub-detection/myob-payslip-fraud-detection) but the same engine handles Reckon, KeyPay, Employment Hero, and any other AU/UK payroll provider.

Do we need to call Xero or the ATO to check?

No. HTPBE? performs standalone forensic analysis on the PDF the applicant uploaded – no Xero API call, no ATO/STP lookup, no applicant consent required. The signals are inside the file structure.

What does an INCONCLUSIVE verdict mean for a Xero payslip?

INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original – usually because of the kind of source it came from, occasionally because the analysis could not finish; status_reason says which. In the Xero-payslip context, INCONCLUSIVE is a review trigger: it is not evidence of fraud, and it is not a pass. Route the case to Open Banking income source-of-truth check or ABN lookup before approval.

How do I check a Xero payslip I received as a PDF?

Upload the PDF to HTPBE? on the web or send it to the API. You get a verdict in about three seconds: intact, modified or inconclusive. Check the file exactly as it arrived – the original attachment, not a screenshot, a print-out or a photo of the screen, because each of those is a new file and the original is gone.

Can you tell if a Xero payslip was edited?

Yes, when the edited file still carries the evidence of the edit – the usual case for a payslip opened in a PDF editor, Word or Excel and saved again. The result is modified, with the checks that fired. A clean result is a statement about the file, not about the employer or the figures.

Does a clean result mean the income is real?

No. intact means the PDF looks like an unaltered export – it says nothing about whether the employer exists, whether the employee really works there, or whether the figures were entered honestly in the payroll system. HTPBE? does not read or judge the figures. Treat it as one layer next to employer confirmation, bank data and registry lookups.

Does a screenshot or a printed-and-scanned Xero payslip pass?

A screenshot, a photo or a scan is a different file from the one a payroll system produced, so it cannot come back intact. Ask the applicant for the payslip as originally delivered.

Does HTPBE? work with Xero or have access to the employer’s payroll?

No. HTPBE? is not connected to Xero and is not affiliated with it. It analyses only the file you give it, so no Xero credentials, API access or applicant consent are involved.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →