Edited Pay Stub Detection: Amount, Date and Name Red Flags

An edited pay stub almost always betrays itself through a consistency break: a total that no longer matches its lines, a pay date that conflicts with the pay calendar or the previous stub, or a name and Social Insurance Number that do not match the rest of the file. Amount, date and name are the three fields most often altered, because landlords, lenders and employers read them first.

This guide goes field by field: what to recalculate and which other document to compare it with. The aim is not to prove a file is forged but to know when it deserves a deeper review.

This article is for information only and is not legal or regulatory advice. References are accurate as of October 2026 and apply to Canada; provincial rules vary.

What a Canadian pay stub contains, and why that makes it checkable

Employment standards legislation in each province requires a wage statement. Ontario's Employment Standards Act, 2000, s. 12 is typical: pay period, gross wages, deductions and net pay. Payroll software also prints Canada Pension Plan (CPP) or Quebec Pension Plan (QPP) contributions, Employment Insurance (EI) premiums, income tax, benefit deductions and year-to-date (YTD) totals. Every printed field is a control point: the richer the stub, the more traces an edit leaves.

YTD totals are the reviewer's best ally. Gross YTD on the June 30 stub must equal gross YTD on the June 15 stub plus June 30 gross. Someone who edits one stub breaks that chain without realizing it.

Edited amounts: what the arithmetic exposes

An altered amount usually appears as a break in the chain gross, deductions, net. A PDF editor changes one figure in seconds but rarely recalculates the fifteen lines that depend on it.

Checks to run, in order:

1. Gross minus deductions equals net. Redo the subtraction line by line. A gap of a few dollars points to a hand-edited number.
2. CPP and EI against published rates. Contributions are a fixed percentage of pensionable and insurable earnings up to annual maximums, published by the Canada Revenue Agency. Earnings multiplied by the rate must reproduce the deduction. A stub showing high pay with CPP or EI at zero is a flag, unless the annual maximum was already reached, which YTD totals will show.
3. Income tax against the TD1. Tax deducted should be consistent with the employee's claim amounts and pay frequency, using the CRA payroll deductions tables.
4. Hours against pay. For hourly employees, rate times hours must return regular pay. Inflated earnings with unchanged hours stand out at once.
5. YTD totals. Gross, tax and net YTD must grow stub to stub and, at year end, match the T4.

Net pay is the figure altered most often, because it is what lenders and property managers compare with the requested payment or rent. No reliable public measure of how often stubs are altered exists, so verification rests on consistency, not on statistics.

Edited dates: pay period, pay date and start date

A changed date is found by comparing the dates on the stub with each other and with the real calendar. People edit the pay period to satisfy a "last 30 days of pay stubs" requirement, or the start date to show enough tenure.

Treat the last row with care. Stubs downloaded from an employee portal are often generated in batches and may legitimately carry a later creation date. A file produced by a general-purpose editor rather than payroll software is still a signal to weigh with others.

Edited names: employee, employer and identifiers

A changed name is betrayed less by the name than by the identifiers around it. Replacing a name is trivial; consistently replacing the employer, address, SIN and deposit account is not.

Useful checks:

• Employer and business number: confirm the corporation exists and is active in Corporations Canada or the relevant provincial registry, and that its name and address match the stub. Cross-check the payroll account number (BN plus RP) against the employer's T4.
• Social Insurance Number: nine digits ending in a Luhn check digit; numbers starting with 9 belong to temporary residents. Stubs usually print the SIN masked, which must match the T4 and the application.
• Typography: a different font or letter spacing on the name, slightly shifted alignment, a broken cell background.
• Near-matches: a name that differs from the driver's licence by one letter or a hyphen deserves a query.

A name is never "wrong" on its own; it is inconsistent with the ID, the T4 or the bank statement. The check is always between documents.

Signals in the file itself

A PDF keeps traces the eye cannot see: producer software, creation and modification dates, multiple revisions, different embedded fonts across zones, text laid over an image. A stub from payroll software has a uniform producer and coherent vector text.

These are signals, never proof. A screenshot saved as PDF is not fraudulent by nature, and a good forgery may have been cleanly regenerated. A tool analyzing these elements should report a level of suspicion to review, not a verdict of authenticity. For a wider view of methods, see our document verification guide.

Cross-checking: the most reliable method

Cross-document comparison remains the strongest approach, because changing one document without touching the others creates an inconsistency the file reveals by itself.

For lending files, the approach is described in income document validation before a consumer credit decision, and AI-generated stubs are covered in our article on fake payslip detection.

What forums ask

On landlord, recruiter and mortgage forums, three questions come up repeatedly.

"Can you see by eye that a pay stub was edited?" Rarely. A good editor changes amounts and fonts without visible artifacts. That is why you recalculate: arithmetic and YTD totals do not lie, appearance does.

"My employer reissued my stub. Is that suspicious?" No, a corrected stub is legitimate. It usually carries an adjustment line and is confirmed by an employment letter or a matching deposit.

"Should I just deny the application when in doubt?" Request a neutral supporting document (bank statements, employment letter, Notice of Assessment) rather than accuse. An inconsistent file is treated as incomplete until the gap is explained.

A five-step control procedure

1. Recalculate gross, deductions and net; check YTD totals.
2. Compare pay period, pay date and start date with the calendar and the offer.
3. Verify the corporation, payroll account and the employee's identity.
4. Match net pay to bank statements and YTD gross to the T4 or Notice of Assessment.
5. Record the gap and request a supporting document before any decision.

Done by hand, this takes ten to twenty minutes per file, which is hard to sustain at volume. CheckFile surfaces AI-generation signals as a complement to your existing controls, and compares fields, dates and identifiers across the documents in a file: see the financing and leasing solution, data security and pricing.

Legal framework: the risk to the person who edits

Using an altered pay stub can amount to forgery under section 366 of the Criminal Code, punishable by up to 10 years, and to fraud under section 380, up to 14 years where the value exceeds $5,000. Federally regulated lenders follow OSFI Guideline B-20 on residential mortgage underwriting, which requires income to be verified. Reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act report suspicious transactions to FINTRAC. File data is governed by PIPEDA: limited purpose, short retention and openness about the checks performed. In Quebec, Law 25 adds stricter consent and privacy impact rules.

FAQ

How do you detect an edited pay stub?

Recalculate the totals, confirm that YTD figures grow each period, check CPP and EI against the published rates, then match net pay to the bank statement. One inconsistency is not enough to conclude; several are.

Can a PDF pay stub be verified without contacting the employer?

Partly. Arithmetic checks, corporate registries, and bank or CRA comparisons need no employer involvement. An employer confirmation remains the final answer when doubt persists.

What is the difference between a corrected and a falsified pay stub?

A corrected stub comes from the employer's payroll system, with YTD totals recalculated and a matching deposit. A falsified one was altered afterwards, so its lines and cumulative figures no longer reconcile.

Does PDF metadata prove a pay stub was altered?

No. It is a clue to weigh with other signals, since a legitimate stub may be regenerated or exported by a portal. A creation date later than the pay date is not proof on its own.

Should every pay stub in a file be checked?

Yes, at least the latest two to three. YTD checks only work on a series; an isolated stub offers far fewer comparison points.