P45 fraud

Fake P45 Detection – Check If a P45 PDF Was Edited

Q: Does the API need a reference original P45 to compare against?

No. HTPBE performs standalone forensic analysis on the PDF the starter uploaded – the structural signals of editing live inside the file itself. No reference copy required, no HMRC API call.

Q: What does an INCONCLUSIVE verdict mean for a P45?

INCONCLUSIVE means HTPBE cannot confirm the file as an untouched original. A P45 built in general-purpose office software to look like a payroll export typically lands here. In the P45 context, INCONCLUSIVE is a review trigger: it is not evidence of fraud, and it is not a pass. Request manual confirmation from the previous employer before adding the starter to payroll.

Q: Does HTPBE check the pay and tax figures against HMRC?

No. HTPBE does not read the figures on a P45 and has no link to HMRC or to payroll records. It checks the PDF file itself for signs that it was changed or built outside a payroll system. A P45 that passes that check can still carry figures the previous employer entered wrongly – that is a payroll question, not a file question.

Built for fraud ops at lending, insurance & compliance teams

A P45 sets the new starter’s tax code and pay-to-date – and an edited one cascades into payroll. New-employer HR teams trust the P45 the starter brings. Payroll uses it to set the tax code and the pay-and-tax-to-date for the year. When that P45 is fabricated or tampered, the error compounds across every payslip until HMRC eventually corrects it – and the discrepancy lands on someone’s desk.

~3 sec

per document

63 checks

forensic layers

1,500+

docs / month on Growth

Plans

subscriptions or one-off packs – see pricing

Scope

HTPBE? analyzes the structural layer of the PDF file – the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. If your fraud problem is a digitally altered or fabricated P45, we’re the most specific tool for it.

When HTPBE? returns INCONCLUSIVE on a P45, that is a reason to escalate to manual review, not proof of fraud – it means HTPBE? cannot confirm the file as an untouched original.

The UK context

What a P45 is – and where an edited one turns up

A P45 is the leaving statement a UK employer issues when someone stops working for them. It records the leaver’s tax code, their pay to date and tax paid to date in the current tax year, and the employer’s PAYE reference. The employer sends one part to HMRC and gives the leaver the other parts – increasingly as a PDF from the payroll software rather than on paper.

The new employer’s payroll uses the figures on that document to put the starter on the right tax code and carry their year-to-date pay and tax forward. That is why HR and onboarding teams handle P45s as routine paperwork. Letting agents, lenders and background-check providers also see them now and then when an applicant offers a P45 alongside payslips and a P60 as proof of earnings.

A starter without a P45 is normal and not a warning sign: the new employer gets a starter checklist instead. The risk is the P45 that is offered – a real one with changed figures or a tax code, or one rebuilt from scratch to cover a gap in the work history. The page can look exactly right while the file behind it says otherwise.

What a verdict does and does not tell you

1MODIFIED – the PDF shows signs of being changed after the payroll system produced it. Ask for a fresh copy from the previous employer.
2INTACT – no sign of editing after production. It does not confirm that the employer’s own figures were correct.
3INCONCLUSIVE – the file carries no payroll-system baseline to compare against. Treat it as a reason to confirm with the employer, not as proof of fraud.
4Scanned or photographed P45s are never returned as INTACT, because a scan cannot show whether the paper was altered first.
5HTPBE? does not read the pay or tax figures and does not query HMRC.

What this looks like

How fake and tampered P45 PDFs actually look

Three real fraud mechanics we catch at the structural PDF layer.

Pay and tax to date edited up

The new starter takes the real P45 from their previous employer’s payroll, opens it in any PDF editor or spreadsheet, edits the Total pay to date or Total tax to date, exports as PDF. The edit typically leaves traces of the editor in the file. Visual layout preserved; the file structure is not.

P45 fabricated to skip a gap of unemployment

There is a six-month gap between the real last working day and the new start date – the candidate was either out of work or working under the table. They build a P45 in Word using a template, type in plausible figures, export to PDF. However closely it copies the HMRC layout, the file does not come back INTACT: with nothing indicating later editing it returns INCONCLUSIVE and should go to manual review; with evidence of editing or fabrication, MODIFIED.

Tax code rewritten to favour the starter

A BR or D0 emergency code on the original P45 means more tax. The starter edits the code to their preferred letter (1257L, etc.) before submitting. Even when the visual layout is clean, HTPBE? flags the post-issuance edit.

The scale

~1 in 8

job applicants misrepresent prior employment on background checks

~3 sec

per P45 via API

Cascades

a wrong P45 figure propagates into every payslip until HMRC corrects it

Why your existing checks miss this

Payroll trusts the P45 figures. Trust them too readily and the error cascades.

HMRC eventually flags the discrepancy. By then payroll has been paying the wrong figures for months.

New-employer payroll systems take the P45 figures at face value when adding a starter – that is the design intent. HMRC catches the discrepancy through Real Time Information once the new employer files an FPS, but the lag can run weeks or months. Tampered P45s used in fraudulent loan or housing applications meanwhile pass through HR and payroll undetected. HTPBE? inspects the P45 PDF at the moment of intake, before payroll trusts the numbers – standalone, no HMRC API, no payroll-bureau lookup.

Results in under 3 seconds·30 to 1,500+ documents/month

What HTPBE? checks

Detection capabilities

Deterministic structural signals. No probabilistic scores, no model training.

Rebuilt P45s aren’t waved through

A P45 saved as PDF from Word, Excel or LibreOffice does not come back INTACT, however closely it copies the HMRC layout. With no sign of later editing it returns INCONCLUSIVE for manual review; with evidence of editing or fabrication, MODIFIED.

Post-issuance edit detection

Editing a P45 after issuance – in a PDF editor, or by rebuilding it in other software – leaves structural evidence behind. HTPBE? flags it as MODIFIED.

Character overlay on the original

Changing a figure on an existing P45 leaves a structural trace. HTPBE? flags it without reading the page – it never looks at what the figures say.

Dates that disagree

A ‘freshly issued’ P45 whose own dates show it was changed months later is a high-confidence flag for post-issuance editing.

Reassembled documents

HTPBE? detects documents assembled from pages of different sources and documents reworked after their original creation.

Values overlaid on a scan

HTPBE? detects scans mixed with inserted content – values laid over a scanned page to substitute what it originally showed.

Share with engineering

Wire this into your intake pipeline in under a day

Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.

Full API reference for engineering

Pricing

Self-serve plans, no sales call

All plans include the same forensic checks. Pick the quota that matches your monthly document volume.

manual

Starter

30 credits/mo

Manual spot-checks and integration testing

most common

Growth

350 credits/mo

Active document processing pipelines

high volume

Pro

1,500 credits/mo

High-volume automation and API integrations

Enterprise (unlimited, on-premise available) — see full pricing

Secure your workflow View API docs

API key on signup. Free test environment on every plan. No card required.

Customer Stories

Teams that stopped document fraud

Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.

Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.

Sarah M.

AP Manager

United States

We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.

Lars V.

Risk Analyst, Online Lending

Netherlands

Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.

Priya K.

HR Operations Lead

India

Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.

Julien R.

Fraud Analyst, Fintech

France

Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.

Marta S.

Compliance Coordinator

Spain

One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.

Tariq A.

Finance Manager

United Arab Emirates

FAQ

Frequently asked questions

Does HTPBE? work with P45s from any UK payroll provider?

Yes. The analysis is producer-agnostic – it inspects whichever PDF the starter submits, whether it came from Sage, IRIS, Brightpay, Moneysoft, Xero Payroll, QuickBooks Payroll, Moorepay, or ADP UK. Edits made after issue are checked for the same way, whichever provider produced the original.

What if the previous employer is small and uses Word for P45s?

A P45 exported directly from Word, Excel or LibreOffice, with nothing indicating later editing, comes back inconclusive – not intact – whether a small employer made it or someone copying the HMRC layout did. Treat it as a prompt for a manual check with the employer, not as proof of fraud. The verdict is modified only when the file itself carries evidence of editing or fabrication.

Can it catch P45s where only the tax code was edited?

Yes. A tax-code edit leaves structural evidence in the file regardless of how clean the visual layout looks. The verdict will be modified, with the named markers behind it.

Does the API need a reference original P45 to compare against?

No. HTPBE? performs standalone forensic analysis on the PDF the starter uploaded – the structural signals of editing live inside the file itself. No reference copy required, no HMRC API call.

What does an INCONCLUSIVE verdict mean for a P45?

INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original. A P45 built in general-purpose office software to look like a payroll export typically lands here. In the P45 context, INCONCLUSIVE is a review trigger: it is not evidence of fraud, and it is not a pass. Request manual confirmation from the previous employer before adding the starter to payroll.

What is a P45, and who asks to see one?

A P45 is the statement an employer gives a leaver, showing their tax code, pay to date and tax to date for the current tax year. New employers use it to set up the starter in payroll. Letting agents, lenders and background-check providers sometimes ask for one as supporting evidence, usually next to payslips and a P60. If a starter has no P45, the employer uses a starter checklist instead, so a missing P45 on its own says nothing about fraud.

Does HTPBE? check the pay and tax figures against HMRC?

No. HTPBE? does not read the figures on a P45 and has no link to HMRC or to payroll records. It checks the PDF file itself for signs that it was changed or built outside a payroll system. A P45 that passes that check can still carry figures the previous employer entered wrongly – that is a payroll question, not a file question.

Can a scanned or photographed P45 come back as INTACT?

No. A scan or phone photo wrapped in a PDF shows what the paper looked like at the moment of capture, not whether the paper had been altered before that. Those files cannot be cleared as INTACT. Ask for the original PDF from the previous employer’s payroll system, or confirm the figures with the employer directly.

What should HR do when a P45 comes back MODIFIED?

Hold the starter’s payroll set-up and ask the previous employer for a fresh copy of the P45, or use the starter checklist if none can be produced. MODIFIED tells you the file was changed after it was produced; it does not tell you who changed it or why, so keep the conversation factual rather than accusatory.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud Gap See Pricing

Read API Docs →