Edited Pay Stub Detection: Amount, Date and Name Red Flags

An edited pay stub almost always betrays itself through a consistency break: a total that no longer matches its lines, a pay date that conflicts with the pay calendar or the previous stub, or a name and Social Security number that do not match the rest of the file. Amount, date and name are the three fields most often altered, because landlords, lenders and employers read them first.

This guide goes field by field: what to recalculate and which other document to compare it with. The aim is not to prove a file is forged but to know when it deserves a deeper review.

This article is for information only and is not legal or regulatory advice. References are accurate as of October 2026 and apply to the United States; state rules vary.

What a U.S. pay stub contains, and why that makes it checkable

Federal law does not require employers to issue pay stubs; most states do, with different content rules. In practice a stub from payroll software (ADP, Paychex, Gusto and similar) shows gross pay, federal income tax, Social Security and Medicare withholding, state and local taxes, pre-tax deductions such as 401(k), net pay, pay period, pay date and year-to-date (YTD) totals. Every printed field is a control point: the richer the stub, the more traces an edit leaves.

YTD totals are the reviewer's best ally. Gross YTD on the June 30 stub must equal gross YTD on the June 15 stub plus June 30 gross. Someone who edits one stub breaks that chain without realizing it.

Edited amounts: what the arithmetic exposes

An altered amount usually appears as a break in the chain gross, deductions, net. A PDF editor changes one figure in seconds but rarely recalculates the fifteen lines that depend on it.

Checks to run, in order:

1. Gross minus deductions equals net. Redo the subtraction line by line. A gap of a few dollars points to a hand-edited number.
2. FICA against the statutory rates. Employee Social Security is 6.2% of wages up to the annual wage base and Medicare is 1.45% with no cap, per the Social Security Administration and the IRS Publication 15. Wages multiplied by the rate must reproduce the withholding. A stub showing high pay and low or zero FICA is a flag.
3. Federal withholding against the W-4. Withholding should be consistent with filing status and pay frequency, using the IRS withholding tables.
4. Hours against pay. For hourly workers, rate times hours must return regular pay. Inflated earnings with unchanged hours stand out at once.
5. YTD totals. Gross, tax and net YTD must grow stub to stub and, at year end, match the W-2.

Net pay is the figure altered most often, because it is what underwriters and property managers compare with the requested payment or rent. No reliable public measure of how often stubs are altered exists, so verification rests on consistency, not on statistics.

Edited dates: pay period, pay date and hire date

A changed date is found by comparing the dates on the stub with each other and with the real calendar. People edit the pay period to meet a "most recent 30 days of pay stubs" requirement, or the hire date to show enough tenure.

Treat the last row with care. Stubs downloaded from an employee portal are often generated in batches and may legitimately carry a later creation date. A file produced by a general-purpose editor rather than payroll software is still a signal to weigh with others.

Edited names: employee, employer and identifiers

A changed name is betrayed less by the name than by the identifiers around it. Replacing a name is trivial; consistently replacing the employer, address, partial SSN and direct deposit account is not.

Useful checks:

• Employer and EIN: confirm the business exists and is in good standing in the Secretary of State records for the state of incorporation, and that its name and address match the stub. The IRS does not publish an EIN lookup, so ask for the EIN and compare it with the employer's Form W-2.
• Social Security number: the first three digits are not 000, 666 or 900-999, and the middle two are never 00. A stub printing only the last four digits must match the same four on the W-2 and the application.
• Typography: a different font or letter spacing on the name, slightly shifted alignment, a broken cell background.
• Near-matches: a name that differs from the driver's license by one letter or a suffix deserves a query.

A name is never "wrong" on its own; it is inconsistent with the ID, the W-2 or the bank statement. The check is always between documents.

Signals in the file itself

A PDF keeps traces the eye cannot see: producer software, creation and modification dates, multiple revisions, different embedded fonts across zones, text laid over an image. A stub from payroll software has a uniform producer and coherent vector text.

These are signals, never proof. A screenshot saved as PDF is not fraudulent by nature, and a good forgery may have been cleanly regenerated. A tool analyzing these elements should report a level of suspicion to review, not a verdict of authenticity. For a wider view of methods, see our document verification guide.

Cross-checking: the most reliable method

Cross-document comparison remains the strongest approach, because changing one document without touching the others creates an inconsistency the file reveals by itself.

For lending files, the approach is described in income document validation before a consumer credit decision, and AI-generated stubs are covered in our article on fake payslip detection.

What forums ask

On landlord, recruiter and mortgage forums, three questions come up repeatedly.

"Can you see by eye that a pay stub was edited?" Rarely. A good editor changes amounts and fonts without visible artifacts. That is why you recalculate: arithmetic and YTD totals do not lie, appearance does.

"My employer reissued my stub. Is that suspicious?" No, a corrected stub is legitimate. It usually carries an adjustment line and is confirmed by an employer verification or a matching deposit.

"Should I just deny the application when in doubt?" Request a neutral supporting document (bank statements, employer verification, IRS transcript) rather than accuse. Note that adverse action based on a consumer report triggers notice duties under the Fair Credit Reporting Act; an inconsistent file is treated as incomplete until the gap is explained.

A five-step control procedure

1. Recalculate gross, withholding and net; check YTD totals.
2. Compare pay period, pay date and hire date with the calendar and offer letter.
3. Verify employer registration, EIN and the employee's identity.
4. Match net pay to bank statements and YTD gross to the W-2 or an IRS transcript.
5. Record the gap and request a supporting document before any decision.

Done by hand, this takes ten to twenty minutes per file, which is hard to sustain at volume. CheckFile surfaces AI-generation signals as a complement to your existing controls, and compares fields, dates and identifiers across the documents in a file: see the financing and leasing solution, data security and pricing.

Legal framework: the risk to the person who edits

Submitting an altered pay stub to a federally insured lender can violate 18 U.S.C. § 1014 (false statements to financial institutions) and 18 U.S.C. § 1344 (bank fraud), each carrying up to 30 years in prison and fines up to $1,000,000. Lenders subject to the Bank Secrecy Act file suspicious activity reports with FinCEN where they know or suspect fraud, under 31 CFR Chapter X. On the data side, the Gramm-Leach-Bliley Act and state laws such as the CCPA govern file data: limited purpose, short retention and notice of the checks performed.

FAQ

How do you detect an edited pay stub?

Recalculate the totals, confirm that YTD figures grow each period, check FICA against the statutory rates, then match net pay to the bank statement. One inconsistency is not enough to conclude; several are.

Can a PDF pay stub be verified without contacting the employer?

Partly. Arithmetic checks, state business records, and bank or IRS comparisons need no employer involvement. An employer verification remains the final answer when doubt persists.

What is the difference between a corrected and a falsified pay stub?

A corrected stub comes from the employer's payroll system, with YTD totals recalculated and a matching deposit. A falsified one was altered afterwards, so its lines and cumulative figures no longer reconcile.

Does PDF metadata prove a pay stub was altered?

No. It is a clue to weigh with other signals, since a legitimate stub may be regenerated or exported by a portal. A creation date later than the pay date is not proof on its own.

Should every pay stub in a file be checked?

Yes, at least the latest two to three. YTD checks only work on a series; an isolated stub offers far fewer comparison points.