Supported document type
Detect tampered and deepfake Payslip
Lenders detect fake payslips by doing the arithmetic the forger skipped. A payslip is proof that income repeats, so the figures on it are not free-standing: gross pay less deductions has to equal net, and the year-to-date column has to equal the last payslip's total plus this period. Inflating gross without rebuilding everything downstream leaves a page that contradicts itself. TamperCheck recomputes those relationships and names the field that moved.
API slug: payslip
Last updated:
What a genuine payslip contains
A payslip covers one pay period and states who paid, who was paid, and what changed hands. It carries the employer's name and address, the employee's name, payroll number, and tax code, the period start and end dates, the payment date, and the payslip's own reference number. Gross pay is itemised into basic, overtime, bonus, and allowances. Deductions are itemised too: income tax, social security or national insurance, pension contributions, student loan repayments, and any salary sacrifice. Net pay and the destination account's last digits close the page.
Those items are not independent. Gross less total deductions must equal net, down to the smallest unit of the currency. The year-to-date column has to equal the previous payslip's year-to-date plus this period's figures, so a payslip only makes sense in the company of the ones before it. Tax deducted is a function of gross pay and the tax code printed a few lines above it. The payment date falls after the period ends, never before. Raise the gross figure alone and four other numbers on the same page start disagreeing with it.
How payslip forgeries are made
Gross pay uplift
The basic or gross figure is raised while the deduction lines and the net total are left as they were. The page still looks like a payslip, but the sum no longer closes, and the tax deducted no longer corresponds to the gross it is supposed to be calculated from.
Year-to-date left behind
The current period is edited and the cumulative column is not, so the year-to-date total no longer reflects the periods that produced it. Reviewers who compare three consecutive payslips catch this. Reviewers who look at one rarely do, because a single payslip hides the sequence it belongs to.
Employer identity swap
A genuine payslip from one employer is relabelled with another employer's name and logo, usually a larger or more creditworthy one. The replacement logo is resampled from a website and carries different compression and edge characteristics from the rest of the header it now sits in.
Pay period re-dating
An old payslip is reissued with new period and payment dates, so a job that ended reads as current, or three months of history is built from one genuine document. The re-dated characters rarely match the rendering of the dates printed elsewhere on the same page.
Earnings table row insertion
A line is pasted into the earnings or deductions table to add an allowance or drop a repayment. Table structure analysis compares column baselines and row pitch, and an inserted row sits fractionally outside the grid the original payroll renderer laid down.
Payslip generator output
Sold online as a template service, these produce a document that is arithmetically coherent from the start, so recomputation passes. They are identified instead by generation and rendering signatures, and by header artwork that does not match how the named employer's real payroll system sets a payslip out.
What TamperCheck checks on a payslip
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Arithmetic reconciliation
Stated totals are recomputed from their components, and running or cumulative figures are checked for continuity across periods. A single edited value breaks the chain even when the page still looks right.
Table structure integrity
Inserted and deleted rows leave structural artifacts behind: inconsistent spacing, misaligned columns, and formatting the visible table no longer accounts for.
Letterhead, logo, and issuer plausibility
Issuer branding is checked for resolution and compression consistency against the body text it sits on. A logo lifted from a website carries the signature of its source, not of the document.
And many more checks
The three above are the layers that carry the most weight on a payslip. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a payslip, and why
Lenders, landlords, and mortgage brokers verifying income. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a payslip in 4 steps
Check the fields against each other
Read gross and net pay, tax and deduction figures, and employer name together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a payslip and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do lenders detect fake payslips?
Lenders recompute the payslip's own arithmetic and compare payslips across periods. Gross less deductions must equal net, the year-to-date column must carry forward correctly from the previous month, and the tax deducted must be consistent with the gross and the tax code. Most lenders also match the net figure against the salary credit on the applicant's bank statement, which is where a fabricated payslip usually fails.
How can I tell if a payslip is fake?
Ask for three consecutive payslips rather than one, then check that each year-to-date figure equals the previous one plus the current period. On a single payslip, confirm the deductions subtract to the net figure exactly and that the payment date follows the period end. A payslip that is right on its own but wrong in sequence is the commonest kind of forgery.
What software checks payslips for fraud?
TamperCheck checks payslips for arithmetic, layout, and file-level tampering, returning a JSON verdict with a risk score from 0 to 100 and findings pinned to the regions of the document that failed. It accepts PDFs, scans, and phone photographs through one REST endpoint at $0.50 per document, and the file is processed ephemerally rather than stored.
Do payslip generator websites produce documents that pass verification?
They pass the arithmetic, which is the check most reviewers actually run, and fail elsewhere. A generated payslip is internally consistent because a template built it, so gross, deductions, and net agree with each other. What it does not reproduce is the named employer's real payroll layout, the rendering signature of that payroll system, or a matching salary credit in a bank statement.
TamperCheck analyses payslip uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.