Fake pay stubs: how to detect forged payslips with AI in 2026

Income verification is the foundation of lending decisions. When a borrower applies for a mortgage, personal loan, or auto lease, the lender needs to confirm that the stated income is real. The primary evidence for this is the pay stub - and as FTC identity theft reports document, pay stubs are now one of the easiest financial documents to forge.

The problem has grown rapidly since 2024. AI image editing tools and dedicated payslip template generators have reduced the time required to produce a convincing fake from hours to minutes. The cost has dropped to zero. Federal Reserve research on synthetic identity fraud confirms that this category of fraud has outpaced the verification infrastructure at most lending institutions, HR departments, and property management firms.

The scale is measurable in one line of business alone: Point Predictive put 2025 auto lending fraud exposure at $10.4 billion, with income and employment misrepresentation accounting for 45% of it and growing 21% year over year. Pay stubs are the document that carries that misrepresentation. For a broader view of how document fraud impacts every sector, see our analysis in Document fraud in 2026: the data behind a $4.7T problem.

Fake pay stubs fall into three broad categories, each with different detection characteristics. Understanding these categories is essential for building effective detection - because the artifacts left behind by each technique are different, and a detection system needs to catch all three.

The first category is template-based generation. Dozens of websites and apps offer pay stub templates where the user fills in employer name, income, deductions, and dates. The output is a clean PDF that looks professional but contains telltale signs: identical font rendering across all fields (real payroll systems use variable rendering), mathematically perfect deduction calculations (real payroll often has rounding), and metadata that traces to consumer PDF libraries rather than payroll software.

The second category is AI inpainting. The fraudster starts with a legitimate pay stub - their own or someone else's - and uses AI editing tools to change specific fields: gross income, net pay, employer name, or dates. Inpainting tools are designed to blend edits seamlessly into the surrounding context, but they leave compression artifacts at edit boundaries that are detectable at the pixel level.

The third category is full PDF editing. Using tools like Adobe Acrobat or open-source PDF editors, the fraudster modifies text layers directly. This produces clean text but often introduces font substitution artifacts, misaligned baselines, or inconsistent character spacing that differs from the original payroll system output.

Most lenders verify income documents through one or more of these methods: employer verification calls, cross-referencing with tax returns, OCR-based data extraction with rule validation, and manual visual review. Each has significant gaps when it comes to sophisticated fakes. The same gaps apply to the bank statements that usually arrive in the same loan file; our guide on how to detect a fake bank statement walks through the equivalent checks.

Employer verification calls are slow (often 3–5 business days), incomplete (many employers only confirm dates of employment, not salary), and easily circumvented by fraudsters who use accomplices or fake phone numbers. Cross-referencing with tax returns helps but only catches discrepancies between documents - if both the pay stub and tax return are forged, the cross-reference passes.

OCR-based extraction reads the text on the pay stub and checks for internal consistency - do the deductions add up, is the tax rate plausible, does the net pay match gross minus deductions. This catches sloppy fakes but misses any manipulation where the numbers are internally consistent. We covered this fundamental limitation in depth in Why OCR alone is not enough for document fraud detection.

Manual visual review is the last line of defence, but human reviewers process dozens or hundreds of documents per day. At that volume, reviewers check for obvious formatting issues - they do not zoom to 400% and inspect compression artifacts around the income field. The manipulation that AI tools produce is invisible at normal viewing resolution.

Pixel-level analysis operates on the raw document image before any text extraction occurs. It examines the visual properties of the document - not what the document says, but how it was produced and whether it has been altered. This is the fundamental difference from OCR-based approaches, which can only validate text-level consistency.

For pay stubs specifically, the AI examines 200+ fraud signals across several categories. Compression analysis detects discontinuities at editing boundaries - when a region has been modified with an inpainting tool, the JPEG or PNG compression patterns in that region differ from the surrounding area. Font rendering analysis identifies character-level anomalies: substituted fonts, misaligned baselines, inconsistent kerning, and rendering artifacts that differ from known payroll system outputs.

Generation signature detection identifies documents produced by template generators or AI generation tools. These tools leave statistical fingerprints in the pixel data - patterns in noise distribution, colour quantisation, and anti-aliasing that distinguish generated documents from scans or screenshots of legitimate payroll output.

Metadata and structural analysis examines the PDF structure, creation tools, timestamps, and layer composition. Legitimate payroll systems produce documents with characteristic metadata signatures. Template generators and PDF editors produce different signatures - and the mismatch is a strong fraud indicator.

{
  "fraud_score": 91,
  "verdict": "LIKELY_FRAUD",
  "findings": [
    {
      "type": "compression_discontinuity",
      "description": "JPEG compression artifact at income field boundary - inconsistent with surrounding regions",
      "region": { "x": 310, "y": 204, "w": 185, "h": 28 },
      "severity": "high"
    },
    {
      "type": "font_rendering_anomaly",
      "description": "Character baseline shift in gross pay value - inconsistent with payroll system font rendering",
      "region": { "x": 312, "y": 206, "w": 90, "h": 22 },
      "severity": "medium"
    }
  ],
  "signals_checked": 218
}

The integration pattern for pay stub verification follows the same architecture as any document fraud detection workflow: intercept the document before it reaches your existing processing pipeline, analyze the raw image, receive a fraud score and structured findings in seconds, and route based on the result.

1. When a pay stub is uploaded as part of a loan application or employment verification, send the document image to the fraud detection API before passing it to your OCR or income extraction pipeline
2. Receive a fraud score (0–100), a verdict, and an array of findings with pixel coordinates identifying suspicious regions
3. For documents above your threshold (typically 70–80 for lending workflows), route to a focused manual review queue with findings attached
4. Reviewers inspect the specific flagged regions rather than reviewing the entire document - reducing review time from minutes to seconds
5. Clean documents continue to your existing income verification and underwriting workflow unchanged

This pre-OCR detection layer is additive - it does not replace your existing income verification, credit checks, or underwriting logic. It adds a document authenticity check that catches fakes before they enter your pipeline. The same architectural pattern applies to expense platforms detecting fake receipts and accounts payable workflows verifying invoices.