Detect tampered and deepfake P45

What a genuine P45 contains

The form prints the tax year, employer name and PAYE reference, employee name and National Insurance number, the leaving date, and the total pay and tax in the current employment, with a student loan box where relevant. The parts matter: the new employer submits Part 3 and keeps Part 2, while the employee keeps Part 1A.

Leaving dates carry the chronology: employment start dates must precede the P45's leaving date, and the next employer's first payslip should follow it, with tax codes moving from week-one or emergency codes back to a cumulative code. A P45 whose dates contradict the employment timeline around it was built to bridge a gap or inflate a history.

How P45 forgeries are made

• Employment chronology

  The leaving date must sit between the prior employer's start and the next employer's start, and payslips on either side should agree. Dates that violate the sequence mark the document as a bridge rather than a record.

• Part-structure completeness

  A genuine P45 exists in parts with distinct purposes. A file where the parts disagree on figures, or where the claimed copy shows a layout no part uses, was assembled rather than issued.

• PAYE reference and NI formats

  The employer's PAYE reference and the employee's NI number follow fixed formats and must agree with the payslips and employment letters around them.

• Figure-level print forensics

  Pay and tax totals are the fraud surface, and digit substitutions inside the totals table leave font-pass and spacing traces exactly at the edited cells.

What TamperCheck checks on a P45

TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.

• Table structure integrity

  Inserted and deleted rows leave structural artifacts behind: inconsistent spacing, misaligned columns, and formatting the visible table no longer accounts for.

• Stamp authenticity and placement

  Stamps are assessed for whether the ink was impressed onto the page or printed as part of it, and for whether the impression was placed digitally after the fact.

• Signature forgery analysis

  Signature regions are assessed for ink consistency and for how the stroke sits on the page, which distinguishes a genuine pen stroke from a pasted image of one.

• And many more checks

  The three above are the layers that carry the most weight on a P45. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.

Who verifies a P45, and why

UK employers onboarding staff, referencing agencies, and benefit assessors. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.

How to verify a P45 in 4 steps

1. 1

   Collect the parts you need

   For onboarding, take Parts 2 and 3 from the employee; Part 1A is the employee's own copy and useful for corroboration.

2. 2

   Check the chronology

   Place the leaving date against the employment dates on either side of it in the file, and confirm payslips agree with the pay figures.

3. 3

   Validate identifiers

   Confirm the PAYE reference and NI number formats and their agreement with the rest of the file.

4. 4

   Run a forensic check on the file

   Chronology and totals together expose a bridged gap faster than any single field. TamperCheck runs 200+ forensic checks across chronology, identifiers, and figure-level print analysis, returning a risk score from 0 to 100 with findings tied to specific regions of the image.

Frequently asked questions