logo
W-2 fraud

Detect a fake W-2: edits to Box 1 survive most checks lenders run today

Built for fraud ops at lending, insurance & compliance teams

Mortgage processors, auto-loan underwriters, and tenant-screening agents trust the W-2 the applicant brings as primary income proof. The IRS rarely sees the PDF; the lender does. When the applicant edits Box 1 (Wages, tips, other compensation) before uploading, the wrong figure is the figure the file is built on.

~3 sec
per document
63 checks
forensic layers
1,500+
docs / month on Growth
Plans
subscriptions or one-off packs – see pricing
Scope

HTPBE? analyzes the structural layer of the PDF file – the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. If your fraud problem is a digitally altered or fabricated W-2, we’re the most specific tool for it.

When HTPBE? returns INCONCLUSIVE on a W-2, that is a reason to escalate to manual review, not proof of fraud – it means HTPBE? cannot confirm the file as an untouched original.

A W-2 that arrives as a scan, a phone photo turned into a PDF, or a print-to-PDF cannot return INTACT. That is a limit of the document form, not a finding about the applicant.

The US wage statement

What a W-2 is, and why the PDF is the weak point

Form W-2 (Wage and Tax Statement) is the annual summary a US employer issues for each employee by January 31. It reports wages, tips and other compensation (Box 1), federal income tax withheld (Box 2), Social Security and Medicare wages (Boxes 3 and 5), the employer’s name and EIN, and the employee’s details. Employees almost always receive it as a PDF from the employer’s payroll provider or a portal, then forward that PDF to whoever asks.

The people who ask are mortgage and auto-loan underwriters, personal-lending teams, landlords and tenant-screening agents, and HR or benefits teams. They treat the W-2 as the cleanest annual income figure in the file, which is exactly why it is worth altering. The applicant is the one holding the file, so the copy you receive has passed through their hands.

The usual edits are small: a higher Box 1 or Box 5 figure, a changed employer name, an adjusted withholding line so the numbers still look consistent, or a different tax year. Some applicants rebuild the whole form in a desktop tool instead. HTPBE? reports whether the PDF was changed after it was produced; it does not validate wage figures against IRS records or contact the employer.

Edits we see on submitted W-2s

  • Box 1 or Box 5 raised to clear an income threshold
  • Employer name or EIN swapped for a friendlier one
  • Withholding lines adjusted to keep the form looking consistent
  • A whole W-2 rebuilt from an IRS form layout in a desktop tool
  • Tax year changed so an old form passes as recent

What this looks like

How fake and tampered W-2 PDFs actually look

Three real fraud mechanics we catch at the structural PDF layer.

01

Real W-2 edited after employer issuance

The applicant downloads the real W-2 from the employer’s payroll system, opens it in any PDF editor or spreadsheet, edits Box 1 (Wages) or Box 5 (Medicare wages), exports as PDF. The edit typically leaves traces of the editor in the file.

02

W-2 fabricated in Word from a template

A W-2-shaped PDF authored in Word using the IRS form layout copied from screenshots, populated with a desired employer and Box 1, exported. However closely it copies the IRS form, the file does not come back INTACT: with nothing indicating later editing it returns INCONCLUSIVE and should go to manual review; with evidence of editing or fabrication, MODIFIED.

03

Character overlay on the original

Changing a figure on an existing W-2 leaves a structural trace. HTPBE? flags it without reading the page – it never looks at what the figures say.

The scale

$11B+
in annual mortgage application fraud exposure (US)
~3 sec
per W-2 via API
No IRS
no IRS Get Transcript call needed – works on the file

Why your existing checks miss this

Day 1 Certainty checks the data with the source. It does not cover every borrower or every doc.

Both layers matter. The PDF the borrower uploaded is what your underwriter opens.

Fannie Mae Day 1 Certainty and Freddie Mac AIM check income data with payroll providers when the borrower’s employer participates and the borrower consents. Coverage is partial – many employers and borrowers fall outside. VOE services call the employer directly, but that step is downstream and slow. Equifax and credit bureaus check identity and credit, not document integrity. HTPBE? catches the W-2 PDF the borrower uploaded at the moment of intake – standalone, no IRS API, no payroll-provider integration required.

Results in under 3 seconds30 to 1,500+ documents/month

What HTPBE? checks

Detection capabilities

Deterministic structural signals. No probabilistic scores, no model training.

Desktop W-2s get a second look

A W-2 saved as PDF from Word, Excel or LibreOffice does not come back INTACT, however closely it copies a payroll provider’s layout. With no sign of later editing it returns INCONCLUSIVE for manual review; with evidence of editing or fabrication, MODIFIED.

Post-issuance edit detection

Editing a W-2 after issuance – in a PDF editor or in other software – leaves structural evidence behind. HTPBE? flags it as MODIFIED.

Character overlay on the original

Changing a figure on an existing form leaves a structural trace. HTPBE? flags it without reading the boxes – it never looks at what the numbers say.

Dates that disagree

When the dates recorded in a ‘freshly issued’ W-2 disagree with each other, HTPBE? flags it – a high-confidence sign of editing after export.

Font inconsistencies across pages

HTPBE? flags font handling that is inconsistent with the rest of the document – a sign of post-issuance editing.

Pasted-element detection

Fabricated W-2s often paste the IRS form layout from screenshots. HTPBE? detects logos, signatures and headers lifted from another document and pasted in.

Share with engineering

Wire this into your intake pipeline in under a day

Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.

Full API reference for engineering

Pricing

Self-serve plans, no sales call

All plans include the same forensic checks. Pick the quota that matches your monthly document volume.

manual

Starter

30 credits/mo

Manual spot-checks and integration testing

most common

Growth

350 credits/mo

Active document processing pipelines

high volume

Pro

1,500 credits/mo

High-volume automation and API integrations

Enterprise (unlimited, on-premise available) — see full pricing

Secure your workflowView API docs

API key on signup. Free test environment on every plan. No card required.

Customer Stories

Teams that stopped document fraud

Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.

Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.

Sarah M.

AP Manager

United States

We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.

Lars V.

Risk Analyst, Online Lending

Netherlands

Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.

Priya K.

HR Operations Lead

India

Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.

Julien R.

Fraud Analyst, Fintech

France

Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.

Marta S.

Compliance Coordinator

Spain

One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.

Tariq A.

Finance Manager

United Arab Emirates

FAQ

Frequently asked questions

Does HTPBE? work with W-2s from any US payroll provider?

Yes. The analysis is producer-agnostic – it inspects whichever PDF the borrower or applicant submits, whether it came from ADP, Paychex, Gusto, QuickBooks Payroll, Workday, Rippling, BambooHR Payroll, Square Payroll, Justworks, or a smaller in-house system. Edits made after issue are checked for the same way, whichever provider produced the original.

Does this replace Fannie Mae Day 1 Certainty or Freddie Mac AIM?

No. D1C and AIM check income data with the source payroll provider when available. HTPBE? inspects the W-2 PDF the borrower uploaded – covering cases where D1C/AIM is not available, the employer is not in coverage, or the borrower will not consent. Use both: D1C/AIM for the data when available, HTPBE? for the file always.

Can it catch W-2s fabricated entirely from scratch in Word?

A W-2 built in Word, Excel or LibreOffice and exported directly, with nothing indicating later editing, comes back inconclusive – not intact – however closely it copies a payroll provider’s layout, and should go to manual review. The verdict is modified when the file itself carries evidence of editing or fabrication.

What about W-2s from IRS Get Transcript?

IRS Get Transcript is a separate consent-based path – most lenders cannot use it for borrower income checks at scale. HTPBE? inspects the W-2 PDF the borrower uploaded directly, no IRS access required.

What does an INCONCLUSIVE verdict mean for a W-2?

INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original. A W-2 built in general-purpose office software to look like a payroll export typically lands here. In the W-2 context, INCONCLUSIVE is a review trigger: it is not evidence of fraud, and it is not a pass. Route the case to VOE or Fannie Mae Day 1 Certainty fraud detection before underwriting.

What does a MODIFIED verdict on a W-2 mean?

It means the PDF was changed after the payroll system produced it, and the named markers in the response show which kind of change. It establishes that an edit happened. It does not say what was edited, whether the figures are wrong, or why the file was changed – a payroll clerk re-saving a corrected form looks the same as an applicant doing it. Ask the applicant for the original from the payroll portal or request a transcript before you decide.

Does an INTACT verdict mean the W-2 figures are correct?

No. INTACT means no sign of modification was found in the file as submitted. It does not confirm that the employer reported the right wages, and HTPBE? does not compare figures with IRS records or payroll data. A scanned, photographed or printed W-2 cannot be returned as INTACT at all.

Can I check a W-2 that was uploaded as a scan or photo?

You can submit it, but the result is limited. A scan carries no payroll-system history to compare against, so it cannot come back INTACT and is typically INCONCLUSIVE. Ask for the PDF downloaded directly from the employer’s payroll provider instead.

Who typically asks for a W-2, and when is the check run?

Mortgage and auto-loan underwriters, personal-lending teams, landlords and tenant-screening agents, and HR onboarding teams. The check runs at document intake, before a human reads the form, so a flagged file goes to review while the application is still open.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →