Edited Payslip Detection: Amount, Date and Name Red Flags

An edited payslip almost always betrays itself through a consistency break: a total that no longer matches its lines, a pay date that conflicts with the pay cycle or the previous payslip, or a name and employer identifier that do not match the rest of the file. Amount, date and name are the three fields most often altered, because lenders, landlords and employers read them first.

This guide goes field by field: what to recalculate and which other document to compare it with. The aim is not to prove a file is forged but to know when it deserves a deeper review.

This article is for information only and is not legal or regulatory advice. References are accurate as of October 2026 and apply to Australia; state and territory rules vary.

What an Australian payslip contains, and why that makes it checkable

Employers must give employees a payslip within one working day of payment under section 536 of the Fair Work Act 2009. The Fair Work Regulations 2009 (reg 3.46) set the content: employer name and ABN, employee name, pay period, date of payment, gross and net amounts, deductions, and the superannuation contributions made. Every required field is a control point: the richer the payslip, the more traces an edit leaves.

Year-to-date (YTD) figures, which most payroll software prints, are the reviewer's best ally. Gross YTD on the second payslip of the month must equal gross YTD on the first plus the new gross. Someone who edits one payslip breaks that chain without realising it.

Edited amounts: what the arithmetic exposes

An altered amount usually appears as a break in the chain gross, tax, net. A PDF editor changes one figure in seconds but rarely recalculates the fifteen lines that depend on it.

Checks to run, in order:

1. Gross minus deductions equals net. Redo the subtraction line by line. A gap of a few dollars points to a hand-edited number.
2. PAYG withholding against the ATO schedules. Tax withheld follows the ATO tax withheld calculator and schedules for the pay cycle and the employee's declaration. High earnings with unusually low withholding is a flag.
3. Superannuation. The super guarantee rate has been 12% of ordinary time earnings since 1 July 2025, according to the ATO. Earnings multiplied by the rate must reproduce the contribution shown; a payslip with high pay and no super line is suspicious.
4. Hours against pay. For hourly staff, rate times hours must return ordinary pay, with award penalty rates applied correctly.
5. YTD totals. Gross, tax and net YTD must grow payslip to payslip and, at year end, match the income statement in myGov.

Net pay is the figure altered most often, because it is what lenders and property managers compare with the requested repayment or rent. No reliable public measure of how often payslips are altered exists, so verification rests on consistency, not on statistics.

Edited dates: pay period, pay date and start date

A changed date is found by comparing the dates on the payslip with each other and with the real calendar. People edit the pay period to satisfy a "last two payslips" requirement, or the start date to show enough length of service.

Treat the last row with care. Payslips downloaded from an employee portal are often generated in batches and may legitimately carry a later creation date. A file produced by a general-purpose editor rather than payroll software is still a signal to weigh with others.

Edited names: employee, employer and identifiers

A changed name is betrayed less by the name than by the identifiers around it. Replacing a name is trivial; consistently replacing the employer, ABN, address and pay-in account is not.

Useful checks:

• Employer and ABN: look up the ABN on the ABN Lookup service to confirm it is active, that the entity name and GST status fit, and that the state matches the payslip. Company details can be checked against ASIC's registers.
• Tax File Number: a payslip should not print a full TFN; if one appears, treat it as unusual and handle it with care under the Privacy Act.
• Typography: a different font or letter spacing on the name, slightly shifted alignment, a broken cell background.
• Near-matches: a name that differs from the driver licence by one letter or a hyphen deserves a query.

A name is never "wrong" on its own; it is inconsistent with the ID, the income statement or the bank statement. The check is always between documents.

Signals in the file itself

A PDF keeps traces the eye cannot see: producer software, creation and modification dates, multiple revisions, different embedded fonts across zones, text laid over an image. A payslip from payroll software has a uniform producer and coherent vector text.

These are signals, never proof. A screenshot saved as PDF is not fraudulent by nature, and a good forgery may have been cleanly regenerated. A tool analysing these elements should report a level of suspicion to review, not a verdict of authenticity. For a wider view of methods, see our document verification guide.

Cross-checking: the most reliable method

Cross-document comparison remains the strongest approach, because changing one document without touching the others creates an inconsistency the file reveals by itself. Single Touch Payroll (STP) means employers report each pay run to the ATO, so the applicant's ATO income statement should mirror the payslips.

For lending files, the approach is described in income document validation before a consumer credit decision, and AI-generated payslips are covered in our article on fake payslip detection.

What forums ask

On landlord, recruiter and mortgage forums, three questions come up repeatedly.

"Can you see by eye that a payslip was edited?" Rarely. A good editor changes amounts and fonts without visible artefacts. That is why you recalculate: arithmetic and YTD totals do not lie, appearance does.

"My employer reissued my payslip. Is that suspicious?" No, a corrected payslip is legitimate. It usually carries an adjustment line and is confirmed by an employer letter or a matching credit.

"Should I just decline the application when in doubt?" Request a neutral supporting document (bank statements, income statement, employer letter) rather than accuse. An inconsistent file is treated as incomplete until the gap is explained.

A five-step control procedure

1. Recalculate gross, tax, super and net; check YTD totals.
2. Compare pay period, payment date and start date with the calendar and the contract.
3. Verify the ABN, the entity and the employee's identity.
4. Match net pay to bank statements and YTD gross to the ATO income statement.
5. Record the gap and request a supporting document before any decision.

Done by hand, this takes ten to twenty minutes per file, which is hard to sustain at volume. CheckFile surfaces AI-generation signals as a complement to your existing controls, and compares fields, dates and identifiers across the documents in a file: see the financing and leasing solution, data security and pricing.

Legal framework: the risk to the person who edits

Submitting an altered payslip can amount to obtaining a financial advantage by deception under section 134.2 of the Criminal Code Act 1995 (Cth), with a maximum of 10 years, and to forgery offences in Part 7.7. Credit providers must assess unsuitability under the National Consumer Credit Protection Act 2009 and verify income as part of responsible lending, as set out by ASIC. Reporting entities under the AML/CTF Act 2006 report suspicious matters to AUSTRAC. File data is governed by the Privacy Act 1988 and the Australian Privacy Principles, overseen by the OAIC: limited purpose, security, and notice of the checks performed.

FAQ

How do you detect an edited payslip?

Recalculate the totals, confirm that YTD figures grow each cycle, check super and withholding against the ATO rates, then match net pay to the bank statement. One inconsistency is not enough to conclude; several are.

Can a PDF payslip be verified without contacting the employer?

Partly. Arithmetic checks, ABN Lookup, and bank or ATO comparisons need no employer involvement. An employer confirmation remains the final answer when doubt persists.

What is the difference between a corrected and a falsified payslip?

A corrected payslip comes from the employer's payroll system, with YTD totals recalculated, reported through STP and a matching payment. A falsified one was altered afterwards, so its lines and cumulative figures no longer reconcile.

Does PDF metadata prove a payslip was altered?

No. It is a clue to weigh with other signals, since a legitimate payslip may be regenerated or exported by a portal. A creation date later than the pay date is not proof on its own.

Should every payslip in a file be checked?

Yes, at least the latest two to three. YTD checks only work on a series; an isolated payslip offers far fewer comparison points.