How to Spot Fake Pay Stubs

The Case

A landlord in Miami gets an application. The applicant has a 761 credit score. The pay stub shows $6,400/month gross — comfortably above the 3x rent threshold for the $2,000 unit. Employer name checks out. Formatting looks professional. Numbers add up.

The landlord approves.

Six weeks later, the applicant goes silent. Eight weeks in, first missed rent. Twelve weeks after move-in, the landlord starts the eviction process — which in Florida averages 45 to 60 days, costs $3,000 to $7,000 in legal fees alone, and leaves a unit that needs cleaning, repairs, and re-leasing.

What the landlord never checked: the PDF metadata.

The pay stub was created in Adobe Photoshop CC 2024. The file's ModifyDate was 2:17 AM — roughly 14 hours before submission. The Producer field showed a paystub-generation tool, not a payroll system. The CreateDate and ModifyDate were identical — normal for a document created from scratch, not exported from payroll software.

None of this was visible on screen. All of it was embedded in the file.

Why Pay Stubs Are the #1 Target

Pay stubs sit at the exact intersection of high stakes and low verification. Landlords need income proof. Pay stubs are the accepted standard. And unlike bank statements (which need account access), employer letters (which require social engineering), or tax returns (which involve the IRS), a pay stub is a standalone document that most landlords accept at face value.

The fraud ecosystem has matured. Platforms selling ready-made fake pay stubs operate in the open — some charge as little as $15 per document. Others offer subscription tiers. TikTok and Reddit threads document the process so casually that fraud enablement has become an inadvertent tutorial industry.

According to the National Apartment Association (Apartmentalize 2024), synthetic document fraud — fake pay stubs, bank statements, and employment letters — accounts for approximately 85% of all rental application fraud.

Fraud rates vary sharply by market. Snappt's 2024 analysis identified Memphis (14.4%), Mobile (13.5%), Atlanta (12.2%), Houston (10.9%), and Jackson, MS (11.0%) as the highest-fraud metros. In some Atlanta neighborhoods managed by Greystar, fraudulent applications hit up to half of all submissions.

Anatomy of a Fake Pay Stub

Three methods. Each leaves different traces.

Method 1: PDF Editing (Most Common)

The applicant takes a real pay stub — their own from a previous job, a sample found online, or someone else's — and edits it in Adobe Acrobat, PDF Expert, or similar. They swap employer name, dates, income figures, sometimes the employee name.

What they can't change: the embedded metadata. When a PDF is edited, the ModifyDate updates. The Producer field may reveal the editing software. XMP metadata logs both the original creation tool and subsequent modifications. If the original came from ADP, Gusto, or Paychex, that Producer tag is there. If it was then modified in Acrobat, a modification event gets logged.

Visual tell: inconsistent font weights — a common artifact where replacement text doesn't exactly match the original typeface rendering.

Method 2: Paystub Generator Sites

Dozens of websites generate pay stubs from scratch. Plug in employer name, employee name, pay period, income. Out comes a professional-looking PDF.

What they can't change: these generators produce PDFs with identifiable Producer strings — PDFKit, jsPDF, wkhtmltopdf, or custom strings tied to specific platforms. Legitimate payroll software produces PDFs with Producer fields like "ADP Pay Statement," "Gusto," or "QuickBooks Payroll."

A real ADP pay stub and a fake one look nearly identical on screen. The Producer field tells a different story.

Method 3: AI-Generated Documents

The newest evolution. Applicants use AI tools to generate entire documents — complete with logos, realistic deduction breakdowns, and employer details. Near-perfect formatting.

What they can't change: AI generators leave their own metadata fingerprints. More importantly, the deduction logic is frequently wrong — tax withholdings that don't match income levels, Social Security contributions that are slightly off, YTD figures that don't multiply correctly across pay periods.

The 60-Second Metadata Check

You don't need forensic software. Here's how to run a basic check yourself.

On Mac

• Open Terminal and run: mdls /path/to/paystub.pdf
• Look for kMDItemCreator — this shows the creating application
• Or: open the PDF in Preview, then Tools → Show Inspector → More Info tab

On Windows

• Right-click the PDF → Properties → Details tab
• Check "Author" and "Program name" fields
• For deeper metadata, use the free ExifTool app

What You're Looking For

Want to skip the manual work? Try our free fraud checker tool — upload a PDF and get the metadata analysis instantly.

The Deduction Math Test

Real pay stubs always pass the math. Fake ones frequently don't. Here's what to verify.

Federal Income Tax Withholding: For a single filer claiming standard withholding, federal tax on $6,400/month gross should be roughly $800 to $1,000. If the stub shows $200 or $1,800, that's anomalous.

Social Security: Always 6.2% of gross up to the annual wage base ($176,100 in 2025). On $6,400/month, Social Security should be exactly $396.80. Round numbers — $400 or $397 — can indicate fabrication.

Medicare: Always 1.45% of gross. On $6,400, Medicare = $92.80. Any deviation is a flag.

Year-to-Date Consistency: If the stub is dated June 15 (pay period 12 of 24), the YTD gross should be approximately 12x the bi-weekly gross. If the numbers don't multiply out, the document was assembled wrong.

Net Pay Reasonableness: For a $6,400 gross earner with standard deductions in a no-income-tax state, net pay should be roughly $5,000 to $5,200. In California, factor in state income tax of approximately $420 to $480/month at that level.

None of this is forensic accounting. It's arithmetic you can do in 90 seconds.

What VeriRent's Detection Actually Analyzes

When VeriRent processes an income document, the analysis goes well beyond what manual inspection can catch.

PDF Metadata Analysis: Full extraction of XMP metadata — CreateDate, ModifyDate, MetadataDate, Producer, Creator, and document information dictionary fields. Cross-referenced against a continuously updated database of known payroll software signatures and known fraud tool signatures.

Font Consistency Check: PDF fonts are embedded as subsets. When a document is edited, replacement text often uses a different font subset than the original — creating detectable inconsistencies in the font table even when the visual output looks identical.

Document Structure Analysis: Legitimate payroll PDFs follow predictable structural patterns — object references, compression methods, cross-reference table formats — that differ from documents assembled by editing tools or generators. VeriRent checks for hidden layers containing original content that was covered up rather than deleted.

Deduction Math Verification: Automated cross-calculation of federal and state withholding against stated income and pay period, flagging statistical outliers.

The result is a risk surface — not an approval or denial — that highlights the specific anomalies detected so you can make an informed decision.

See how VeriRent's document analysis works

The 73% Problem

Here's the number that should keep you up at night: 73%.

That's the share of rental operators who told a 2018 Forrester/TransUnion industry survey they discovered fraud only after the tenant had already moved in. NMHC's 2024 operator survey shows the endgame: 23.8% of eviction filings were attributed to fraudulent applications. By the time you find the fraud, you're not making a screening decision. You're filing for eviction.

In California, an uncontested eviction takes 3 to 4 months. A contested one can stretch 6 to 12. Legal fees run $3,000 to $15,000+. Add lost rent, cleaning, repairs, and re-leasing costs, and a single fraudulent tenancy can cost $30,000 to $50,000 in a high-rent market.

The economics are stark. A screening that includes document forensics — $44/screening, tenant-paid — costs less than 0.1% of the downside exposure in a worst-case fraudulent tenancy.

What Doesn't Work

A few common verification practices that modern pay stub fraud blows right past:

Visual inspection. Fraudsters have the same professional-grade templates you're used to seeing. A visually perfect pay stub is no longer evidence of anything.

Calling the employer. Fraudsters provide fabricated HR numbers. Always verify the employer's phone number independently — look it up directly, never use the number on the stub.

Requiring two months of stubs. If they can generate one fake, they can generate two. Multiple documents from the same fraudulent source share the same metadata signature.

Matching the employer to LinkedIn. Adds friction for the applicant, not for the fraudster. A fabricated stub can include any real employer's name.

What actually works: metadata analysis, deduction math verification, cross-referencing bank statements for matching deposit patterns, and direct payroll verification through API connections. Or a screening platform that does it all for you.

The Bottom Line

Pay stubs are the most faked document in rental applications because they're the document landlords trust most and verify least. The verification gap exists because most landlords don't know that the signal they need isn't visual — it's embedded in the file itself.

Check the Producer field. Run the deduction math. Cross-reference the YTD figures. And if you'd rather not spend 20 minutes on every application, VeriRent automates all of it — starting at $44/screening, tenant-paid.

The fake looks perfect on screen. The metadata tells the truth.

Frequently Asked Questions

Data sourced from: National Multifamily Housing Council (NMHC) 2024 Pulse Survey; Snappt 2024 Fraud Report (analysis of ~5 million documents); TransUnion/Forrester rental fraud survey (2018); National Apartment Association Apartmentalize 2024 session data; Fox Business reporting on Greystar fraud analysis (November 2025). Last updated: July 2026.