Fake Employment Verification Letter Fraud Detection Guide

A fake employment verification letter is a fabricated, altered, or AI-generated version of the short, employer-issued letter that confirms someone's job title, start date, and salary on request. It is distinct from an employment contract, which sets out the terms of employment, and from a payslip, which evidences a single period's pay — a verification letter exists purely to confirm current status to a third party such as a mortgage lender, landlord, credit provider, or visa sponsor.

This article is provided for informational purposes and does not constitute legal advice. Regulatory references are accurate as of the publication date.

Why Verification Letters Are a Distinct Fraud Target

A verification letter is fabricated more often than a full contract or payslip run because it is short, template-based, and usually produced on demand rather than pulled from an existing HR file. A payslip has to match months of prior pay cycles and a contract has to reproduce full clause structure; a verification letter is typically a single page — employer address, a confirmation sentence, job title, salary, tenure, and a signature. That brevity is what makes it easy to forge convincingly and hard to catch on sight.

The letter is also often supplied by the applicant rather than sent independently by the employer, which means the first and sometimes only copy a lender, landlord, or visa caseworker ever sees has already passed through the applicant's hands. This differs from a payslip trail, which accumulates over months and is harder to falsify consistently, and from a contract, which usually predates the application and sits in the employer's own records.

Three use cases drive most demand for these letters: mortgage and consumer credit applications, where the letter supplements payslips and bank statements to confirm ongoing rather than just historical employment; tenancy references, where letting agents often accept the letter as sole income evidence; and right-to-work or visa sponsorship checks, where an employment letter can support a change-of-circumstances or settlement application.

How Fraudsters Fabricate Verification Letters

Fabrication ranges from editing a handful of fields on a genuine letter to generating one entirely from a text prompt. Three techniques dominate the cases referred to UK lenders, letting agents, and compliance teams.

Template modification of an authentic letter. The applicant takes a real letter — their own from a previous role, or a template found online — and edits the salary figure, job title, or employment dates in a PDF or word processor while leaving the letterhead and closing signature block untouched. This is the most common method because it requires no design skill and preserves an otherwise-genuine layout.

Cloned employer letterhead and branding. Fraudsters reproduce a real, often well-known employer's logo, address block, and HR signature style from a careers page or job advert, then draft an entirely fictitious confirmation of employment for a role that does not exist or that ended months earlier. These letters are internally consistent but fail as soon as anyone checks with the employer directly.

Full AI generation. Generative tools can now produce a complete letter — plausible letterhead, formal HR phrasing, a named signatory, and a contact number or email — from a short prompt describing the desired job title and salary, with no underlying employer relationship at all. Unlike the first two methods, there is no genuine document anywhere in the chain, which shifts detection almost entirely onto external cross-checks rather than document-internal review.

Forensic Signals That Expose a Fake Letter

The signals that reliably separate a genuine letter from a fabricated one fall into four groups: registry, metadata, cross-document, and contact-based checks.

Companies House and employer registry cross-check

A registry lookup confirms the named employer exists and is active, but existence alone is not sufficient, since fraud rings increasingly borrow the registration details of a real, unrelated company rather than inventing one. A secondary check compares the claimed job function against the company's registered SIC code and trading activity — a "senior engineer" letter from a dormant holding vehicle is a strong inconsistency signal, the same logic applied when verifying a company registration certificate elsewhere in a file.

PDF and image metadata analysis

Every PDF and scanned image carries metadata — creation and modification timestamps, producer software, and sometimes device information — that a fraudster rarely thinks to strip. A letter dated months in the past but with a PDF creation timestamp from the day before submission, or a producer field showing a generic PDF editor or an AI writing tool rather than an office suite, is a reliable structural tell independent of how convincing the letter looks visually.

Cross-document validation against payslips and bank statements

Cross-validating the letter against the applicant's payslips and bank deposits is the strongest single counter-measure, because a letter confirming a £45,000 salary cannot be reconciled with three months of bank credits consistent with a materially lower or irregular wage. This is the same principle behind fake payslip detection in consumer lending and the wider document set reviewed in fake mortgage application document detection — no single document, including a verification letter, should be assessed in isolation from the rest of the file.

Contact and callback verification

Because a verification letter exists to be checked, fraudsters routinely list a phone number or email address that reaches an accomplice rather than the real HR department. Sourcing the employer's switchboard number independently — via Companies House, the company website, or a corporate directory, rather than dialling the number printed on the letter — is standard practice; any mismatch with the employer's published contact channels is treated as a high-severity flag on its own.

What Applicants and Tenants Ask on Finance Forums

On UK personal finance forums, recurring threads capture the practical friction around verification letters, beyond the fraud angle itself.

On MoneySavingExpert's forums, one recurring thread involves applicants whose employer refuses to issue a letter confirming their employment to a lender at all, leaving the applicant to ask what alternative evidence a lender will accept — a situation that, ironically, is one driver of applicants attempting to produce the letter themselves. A related, frequently repeated question asks precisely when and how a lender checks employment during underwriting, with posters comparing notes on whether a phone call, a written reference, or both should be expected.

A third pattern involves applicants asking why a lender wants a letter in addition to payslips and bank statements already submitted. The practical answer is that payslips confirm past pay but not current, ongoing employment status at the point of application, which is exactly the gap a dated confirmation letter is designed to close — the same rationale underlying MCOB's restriction on lenders relying on self-certified income (FCA Handbook, MCOB 11.6).

UK Regulatory Framework

UK lenders, letting agents acting as credit intermediaries, and employers each operate under distinct obligations that touch employment verification letters.

A lender or letting agent that accepts a verification letter without checking it against Companies House, metadata, or the rest of the applicant's document file is exposed to the same supervisory scrutiny under CONC 5.2A and MCOB 11.6 as one accepting an unverified contract or payslip. For sponsored workers, employer compliance obligations are covered in more detail in our right to work check guide, since an employment letter supporting an immigration application sits alongside, not instead of, the Home Office's own checks.

Detection Protocol in Practice

A layered protocol lets underwriting, lettings, and HR teams check every letter without materially slowing turnaround.

Level 1 — automated. OCR extraction of employer name, job title, salary, and dates; automated layout and font-consistency scoring against known genuine templates from the same employer where available; PDF and image metadata extraction flagged for anomalies.

Level 2 — risk-based cross-validation. A live Companies House lookup against the named employer; cross-document reconciliation of salary and tenure against submitted payslips and bank statement deposits; domain and contact-number verification against the employer's published channels.

Level 3 — manual investigation. A compliance analyst reviews flagged files, independently calls the employer through a number sourced outside the applicant's submission, and requests supplementary evidence — a second dated letter, an HR portal export, or a written reference — where doubt remains.

AI-generation signal detection functions as a complement to existing structural checks — Companies House verification, metadata forensics, and cross-document validation — rather than a replacement for them. According to the ACFE 2024 Report to the Nations, manual review methods identify only 37% of document fraud, with an average detection delay of 87 days, a gap that in lending and lettings often means funds or tenancies have already been committed before a fabrication surfaces (ACFE 2024 Report to the Nations).

CheckFile applies this layered approach across employment letters, payslips, and supporting income documents for lending, lettings, and KYC teams. For banking onboarding and affordability checks specifically, see banking KYC verification; deployment and integration options are covered in the document security overview, and current packages are listed on the pricing page.

Consequences for Submitting a Fabricated Letter

Submitting a fabricated or altered employment verification letter to obtain credit, a tenancy, or an immigration benefit exposes the applicant, and anyone who helped produce the document, to criminal liability. Fraud by false representation under the Fraud Act 2006, section 2 and producing or using a false instrument under the Forgery and Counterfeiting Act 1981 each carry a maximum sentence of ten years' imprisonment. A discovered fabrication typically also triggers immediate withdrawal of the credit offer or tenancy, a recorded Cifas fraud marker affecting applications for up to six years, and, where the letter supported a visa or right-to-work claim, potential curtailment of immigration status alongside civil penalty exposure for any complicit employer.

For a broader view of document verification obligations across regulated sectors, see our industry document verification guide. To see how AI-generation signals apply specifically to forged and synthetic documents as a complement to your existing controls, our deepfake and AI document detection page sets out the approach in full, including where it fits alongside manual and structural checks.

Frequently Asked Questions

How is a fake employment verification letter different from a fake employment contract?

A verification letter is a short, on-demand confirmation of current job title, tenure, and salary, typically requested for a specific application such as a mortgage or tenancy. An employment contract instead sets out the terms of the role — permanent, fixed-term, or probationary — and usually predates the application by months or years, which makes it a different, and separately assessed, fraud target.

Can a real employer's letterhead be used on a fake verification letter?

Yes. Fraudsters commonly copy a genuine employer's logo, address, and signature style from a careers page or job advert onto a letter confirming employment that does not exist or has since ended. A Companies House check confirms the employer is real, but only an independent call to the employer's published number, or cross-document validation against payslips and bank deposits, reliably exposes that the confirmation itself is false.

Why do lenders ask for a letter as well as payslips and bank statements?

Payslips evidence past pay, not necessarily current, ongoing employment status at the point of application. A dated verification letter closes that gap, which is why FCA MCOB 11.6 treats it as part of an adequate, independently-sourced income evidence file rather than a substitute for payslip and bank statement checks.

Do letting agents check employment verification letters as carefully as lenders?

Not always. Letting agents commonly accept a verification letter as sole income evidence without a registry check or an independent call to the employer — a lighter-touch process than mortgage underwriting, where FCA-regulated lenders apply layered verification by regulatory requirement. That gap is one reason tenant document fraud involving fabricated letters tends to go under-detected relative to mortgage fraud.

What should a compliance team do if a submitted letter is suspected to be forged?

Preserve the document and its metadata, pause the application pending independent verification, and record the suspicion through internal fraud-reporting processes. Where the letter supported a regulated credit or mortgage application, this should be logged consistently with the firm's obligations under FCA CONC and MCOB, and suspected fraud should also be reported to Action Fraud.