Edited Payslip Detection: Amount, Date and Name Red Flags

An edited payslip almost always betrays itself through a consistency break: a total that no longer matches its lines, a date that conflicts with the pay calendar or the previous payslip, or a name and identifier that do not match the rest of the file. Amount, date and name are the three fields most often altered, because they are the first things a landlord, lender or recruiter reads.

This guide goes field by field: what to recalculate, and which other document to compare it against. The aim is not to prove that a file is forged but to know when a file deserves a deeper review.

This article is provided for information only and is not legal or regulatory advice. References are accurate as of October 2026 and apply to the United Kingdom.

What a UK payslip contains, and why that makes it checkable

Employees in the UK are entitled to an itemised pay statement under section 8 of the Employment Rights Act 1996, showing gross pay, variable and fixed deductions, and net pay. In practice payroll software also prints the tax code, National Insurance number and category letter, pay period, tax month or week, and year-to-date totals, as described in GOV.UK's guidance on payslips.

Every printed field is a control point: the richer the payslip, the more traces an edit leaves. Year-to-date figures are the most useful of them. Month 5 gross-to-date must equal month 4 gross-to-date plus month 5 gross pay. Someone who edits a single payslip breaks that chain without knowing it.

Edited amounts: what the arithmetic exposes

An altered amount typically shows up as a break in the chain gross pay, deductions, taxable pay, net pay. A PDF editor changes a number in seconds but rarely recalculates the fifteen lines that depend on it.

Checks to run, in order:

1. Gross minus deductions equals net. Redo the subtraction line by line. A gap of a few pounds usually points to a hand-edited figure.
2. Tax against the tax code. PAYE on the payslip should be consistent with the tax code and cumulative taxable pay, using the HMRC rates and thresholds.
3. National Insurance against the category letter. Class 1 contributions follow earnings bands. A high salary with NI that does not move in proportion is suspicious.
4. Hours against pay. For hourly staff, rate multiplied by hours should return basic pay. An inflated salary with unchanged hours stands out at once.
5. Year-to-date totals. Cumulative taxable pay and tax should progress from payslip to payslip and, at year end, match the P60.

Net pay is the figure edited most often, because it is the number lenders and landlords compare with the requested repayment or rent. No reliable public measure of how often payslips are altered exists, so verification rests on consistency, not on statistics.

Edited dates: pay period, payment date and start date

A changed date is found by comparing the dates on the payslip with each other and with the real calendar. People change the pay period to satisfy a "last three payslips" requirement, or the start date to show enough length of service.

Treat the last row with care. Payslips delivered through a payroll portal are often generated in batches and may legitimately carry a later creation date. A file produced by a general-purpose editor rather than payroll software is still a signal worth weighing with others.

Edited names: employee, employer and identifiers

A changed name is betrayed less by the name than by the identifiers around it. Replacing a name is trivial; replacing the National Insurance number, employer, address and pay-in account consistently is not.

Useful checks:

• Employer and company number: search the Companies House register to confirm the company exists, is active, and that its name, address and activity match the payslip. Do not confuse the Companies House number with the employer PAYE reference.
• National Insurance number: it has a fixed format (two letters, six digits, a final letter A to D). Prefixes such as BG, GB, NK, KN, TN and NT are not allocated.
• Typography: a different font or letter spacing on the name, slightly shifted alignment, a broken cell background around it.
• Near-matches: a name that differs from the ID by one letter or a hyphen deserves a query, especially if the rest of the file is clean.

A name is never "wrong" on its own; it is inconsistent with the passport, the P60 or the bank statement. The check is always between documents.

Signals in the file itself

A PDF keeps traces the eye cannot see: producer software, creation and modification dates, multiple revisions, different embedded fonts across zones, text laid over an image. A payslip from payroll software has a uniform producer and coherent vector text.

These are signals, never proof. A screenshot saved as PDF is not fraudulent by nature, and a good forgery may have been cleanly regenerated. Any tool analysing these elements should report a level of suspicion to review, not a verdict of authenticity. For a wider view of methods, see our document verification guide.

Cross-checking: the most reliable method

Cross-document comparison remains the strongest approach, because changing one document without touching the others creates an inconsistency that the file reveals by itself.

For credit files, the approach is described in income document validation before a consumer credit decision, and AI-generated payslips are covered in our article on fake payslip detection.

What forums ask

On landlord, recruiter and lending forums, three questions come up repeatedly.

"Can you see by eye that a payslip was edited?" Rarely. A good editor changes the amount and font without visible artefacts. That is why you recalculate: arithmetic and year-to-date totals do not lie, appearance does.

"My employer corrected my payslip. Is that suspicious?" No, an amended payslip is legitimate. It usually carries an adjustment line and is confirmed by an employer letter or a matching credit on the bank statement.

"Should I just reject the application when in doubt?" Better to request a neutral supporting document (bank statement, employer reference, P60) than to accuse. An inconsistent file is treated as incomplete until the gap is explained.

A five-step control procedure

1. Recalculate gross, deductions and net; check year-to-date totals.
2. Compare pay period, payment date and start date with the calendar and the contract.
3. Verify company number, National Insurance number and the employee's identity.
4. Match net pay to the bank statement and year-to-date figures to the P60.
5. Record the gap and request a supporting document before any decision.

Done by hand, this takes ten to twenty minutes per file, which is hard to sustain at volume. CheckFile surfaces AI-generation signals as a complement to your existing controls, and compares fields, dates and identifiers across the documents in a file: see the financing and leasing solution, data security and pricing.

Legal framework: the risk to the person who edits

Using an edited payslip to obtain credit or a tenancy can amount to fraud by false representation under section 2 of the Fraud Act 2006, with a maximum of ten years' imprisonment, and to forgery under the Forgery and Counterfeiting Act 1981. For lenders, the FCA's CONC sourcebook requires creditworthiness assessments based on sufficient information, and file data remains subject to the UK GDPR: limited purpose, short retention and transparency about checks performed.

FAQ

How do you detect an edited payslip?

Recalculate the totals, confirm that year-to-date figures progress each period, check the company number and National Insurance number, then match net pay to the bank statement. One inconsistency is not enough to conclude; several are.

Can a PDF payslip be verified without contacting the employer?

Partly. Arithmetic checks, public registers and bank or tax comparisons need no employer involvement. An employer confirmation remains the final answer when doubt persists.

What is the difference between a corrected and a falsified payslip?

A corrected payslip comes from the employer's payroll system, with year-to-date totals recalculated and a matching payment. A falsified one was altered afterwards, so its lines and cumulative figures no longer reconcile.

Does PDF metadata prove a payslip was altered?

No. It is a clue to weigh with other signals, since a legitimate payslip may be regenerated or exported by a portal. A creation date later than the pay date is not proof on its own.

Should every payslip in a file be checked?

Yes, at least the latest three. Year-to-date checks only work on a series; an isolated payslip offers far fewer points of comparison.

For where this fits in the CheckFile offering, see our AI and deepfake detection approach.