Fake P60 detection: one PDF a year, and any applicant can re-save it with a higher gross
Lettings agents use it for tenant referencing. Mortgage lenders use it as primary income proof. Sponsor-licence holders keep it on file for Home Office audit. And every applicant who needed a higher figure knows the original from Sage, IRIS, or Xero Payroll can be opened in any PDF editor and re-exported in five minutes.
HTPBE? analyzes the structural layer of the PDF file – the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. If your fraud problem is a digitally altered or fabricated P60, we’re the most specific tool for it.
When HTPBE? returns INCONCLUSIVE on a P60, that is a reason to escalate to manual review, not proof of fraud – it means HTPBE? cannot confirm the file as an untouched original.
The UK context
What a P60 is, and why it gets edited
A P60 is the end-of-year certificate a UK employer must give every employee who is on the payroll at 5 April. It sets out total pay and tax deducted for the tax year, National Insurance contributions, the tax code and the employer’s details. Most employees receive it as a PDF from the payroll software or an employee portal, usually by 31 May.
It is asked for because it is a single, tidy summary of a whole year. Letting agents ask for it during tenant referencing, lenders and brokers ask for it alongside payslips, and HR teams and sponsors keep it on file. Tax credit and benefit claims also ask for it.
Because it is one short, simple PDF, it is a convenient file to alter. Typical edits are the pay figure, the tax and National Insurance lines, the employer name, or the tax year. A fabricated P60 built in Word or Excel is the other common case.
HTPBE? does not read the figures and does not compare them with HMRC records. It reports whether the PDF file itself shows signs of having been edited or built after the payroll system produced it.
Typical P60 edits
- Total pay for the year raised
- Tax deducted or NI lines adjusted to look consistent
- Employer name or tax year swapped
- Whole P60 rebuilt from a template
What this looks like
How fake and tampered P60 PDFs actually look
Three real fraud mechanics we catch at the structural PDF layer.
Edit-and-re-save with bumped Total for year
The applicant downloads the real P60 from the employer’s payroll system, opens it in any PDF editor or spreadsheet, edits the Total for year (gross or net), exports back to PDF. The edit typically leaves traces of the editor in the file.
P60 fabricated in Word from a template
Online ‘P60 generator’ sites and Word templates produce a P60-shaped PDF for any employer name and earnings the user types in. Whatever tool produced it, a P60 comes back MODIFIED when the file itself carries evidence of editing or fabrication. Treat an INCONCLUSIVE result as a prompt for a manual check with the employer, not as proof of fraud.
Tax code edited but the figures don’t reconcile
Wrong-code P60s are a classic letting-agent flag – but most tenant-referencing teams catch only the obvious ones. When the applicant edits the gross figure, the PAYE deducted no longer reconciles with the tax code and bands. HTPBE? does not read those figures – it reports the structural trace of the edit that produced the mismatch.
The scale
Why your existing checks miss this
Open Banking checks the income. It does not check the P60.
Both layers matter. The applicant chose to upload the P60 because the bank doesn’t cover the full picture.
Tenant-referencing platforms (Goodlord, RentProfile, FCC Paragon) and mortgage tech vendors check income through Open Banking when the applicant agrees to connect the account – but applicants who want a higher figure shown rarely do. They submit a P60 instead. HMRC operates Real Time Information for employers, but tenant agents and lenders cannot query it on behalf of an applicant. HTPBE? catches the P60 the applicant uploaded, regardless of whether Open Banking is available – standalone, no HMRC API, no payroll-bureau lookup.
What HTPBE? checks
Detection capabilities
Deterministic structural signals. No probabilistic scores, no model training.
The file decides, not the layout
However closely it copies a UK payroll layout, a P60 comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.
Post-issuance edit detection
Editing a P60 after issuance – in a PDF editor or in other software – leaves structural evidence behind. HTPBE? flags it as MODIFIED.
Character overlay on the original
Changing a figure on an existing P60 leaves a structural trace. HTPBE? flags it without reading the page – it never looks at what the figures say.
Dates that disagree
When the dates recorded in a ‘freshly issued’ P60 disagree with each other, HTPBE? flags it – a high-confidence sign of editing after export.
Font inconsistencies
HTPBE? flags font handling that is inconsistent with the rest of the document – a sign of post-issuance editing.
Values overlaid on a scan
Some fraudsters lay replacement values over a scanned P60 instead of editing the original. HTPBE? flags the overlay.
Share with engineering
Wire this into your intake pipeline in under a day
Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.
Pricing
Self-serve plans, no sales call
All plans include the same forensic checks. Pick the quota that matches your monthly document volume.
manualStarter
30 credits/mo
Manual spot-checks and integration testing
most commonGrowth
350 credits/mo
Active document processing pipelines
high volumePro
1,500 credits/mo
High-volume automation and API integrations
Enterprise (unlimited, on-premise available) — see full pricing
API key on signup. Free test environment on every plan. No card required.
Customer Stories
Teams that stopped document fraud
Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.
Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.
Sarah M.
AP Manager
United States
We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.
Lars V.
Risk Analyst, Online Lending
Netherlands
Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.
Priya K.
HR Operations Lead
India
Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.
Julien R.
Fraud Analyst, Fintech
France
Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.
Marta S.
Compliance Coordinator
Spain
One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.
Tariq A.
Finance Manager
United Arab Emirates
FAQ
Frequently asked questions
Does HTPBE? work with P60s from any UK payroll provider?
Do I need to call HMRC to check P60s?
Can it catch P60s made with online generator tools?
modified when the file itself carries evidence of editing or fabrication, whatever tool produced it. An inconclusive result means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud. Checking with the employer is a sensible next step.What about P60s that are scanned printed copies?
inconclusive: the scanner authored a fresh PDF, so HTPBE? cannot confirm it as the untouched original. Treat inconclusive on a P60 as a prompt for manual review or a request for the original PDF from the payroll system.What does an INCONCLUSIVE verdict mean for a P60?
What does an INTACT verdict on a P60 mean?
Can HTPBE? tell me whether the pay and tax figures on a P60 are correct?
Who needs to check a P60?
What should I do when a P60 comes back MODIFIED?
Secure your workflow
Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.