Supported document type
Detect tampered and deepfake Salary Certificate
A salary certificate is an assertion rather than a record, which is what makes it attractive to forge. It is written on request, on employer letterhead, and it states a salary in a single sentence instead of deriving one from a table of payments. The evidence therefore sits in the packaging: the letterhead, the signatory's authority, the seal, and whether the stated figure survives annualisation. TamperCheck runs 200+ forensic checks over that packaging and returns a risk score from 0 to 100.
API slug: salary_certificate
Last updated:
What a genuine salary certificate contains
A salary certificate is a letter, not a ledger. It sits on the employer's letterhead with the registered address and company registration number, is addressed either to a named bank or consulate or to whomever it may concern, and identifies the employee by name, employee code, department, and designation. It states the date of joining, the employment status, whether permanent, probationary, or contract, and the salary, usually broken into basic, housing allowance, conveyance, and other allowances, with gross and net figures and the currency named.
The certificate's few numbers still constrain each other. The monthly figure multiplied by twelve has to equal the annual figure wherever both are given, and the allowance lines have to sum to the gross. The designation has to be plausible for the salary beside it, and both have to survive comparison with the applicant's payslips and the salary credits on their bank statement. The signatory has to be someone with authority to certify pay, which in most organisations is a payroll, finance, or HR officer rather than a colleague or a line manager.
How salary certificate forgeries are made
Single-figure inflation
The salary is the only thing that changes on an otherwise genuine certificate, often by a factor chosen to clear a specific loan-to-income ratio or visa threshold. With no table to recompute, nothing else on the page contradicts the new number, so detection falls to the rendering of the edited characters themselves.
Letterhead harvesting
A real letter from the employer, of any kind, supplies the letterhead. The original body is removed and a certificate is typed onto the reclaimed header. The logo and footer are authentic because they came from a genuine document, while the body text was laid down by an entirely different renderer.
Seal and stamp reproduction
A company seal is scanned from another document and pasted in. A real rubber stamp impression varies in ink density with the pressure applied and sits partly over the text it lands on. A pasted one is uniform, cleanly bounded, and repeats identically across every certificate from the same source.
Signatory invention
A name and job title are placed under the signature that either do not exist in the organisation or belong to someone with no authority to certify pay. Neither fact is visible in the file, so this is caught by contacting the employer on a number found independently of the certificate.
Annualisation and currency sleight
A monthly salary is presented as though it were the annual figure, or a local-currency amount is labelled in a stronger currency, so a modest income clears a means test. The document is otherwise untouched and reads correctly until the figure is set against the stated period and the employer's country.
Certificates produced to order
Template certificates are drafted end to end for employers the applicant never worked for, complete with an invented reference number and a plausible registered address. These are consistent internally and are assessed on letterhead fidelity, seal behaviour, and whether the employer's details resolve to a real organisation.
What TamperCheck checks on a salary certificate
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Stamp authenticity and placement
Stamps are assessed for whether the ink was impressed onto the page or printed as part of it, and for whether the impression was placed digitally after the fact.
Letterhead, logo, and issuer plausibility
Issuer branding is checked for resolution and compression consistency against the body text it sits on. A logo lifted from a website carries the signature of its source, not of the document.
Date and validity consistency
Issue, expiry, and period dates are checked against one another and against the file's own creation metadata, which catches backdating and validity extension.
And many more checks
The three above are the layers that carry the most weight on a salary certificate. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a salary certificate, and why
Banks and immigration authorities reviewing loan and visa applications. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a salary certificate in 4 steps
Check the fields against each other
Read stated salary, designation, and employer seal together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a salary certificate and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do banks verify a salary certificate?
Banks compare the certificate against documents the employer did not write for this application: payslips, bank statements showing the salary credits, and a tax form for the same period. They then contact the employer directly, using a switchboard number found independently rather than the one printed on the certificate. The certificate itself is checked for letterhead fidelity, a genuine seal impression, and a signatory with authority to certify pay.
How can you tell if a salary certificate is fake?
Check the packaging before the figure. A pasted seal has uniform ink and identical edges wherever it appears, a harvested letterhead sits above body text rendered by a different engine, and an invented signatory carries a title that does not exist in the organisation. Then test the number: the monthly amount times twelve should match the annual figure, and both should match the applicant's payslips.
What is the difference between a salary certificate and a payslip?
A payslip records one payment that already happened, while a salary certificate is a statement the employer writes on request to confirm current pay for a third party. The payslip shows its own working and can be matched against a bank credit. The certificate only asserts a figure, which is why its letterhead, seal, and signatory carry most of the evidential weight.
Can a forged salary certificate be detected from the PDF alone?
Yes, in most cases. Editing a figure, pasting a seal, or typing a new body onto a reclaimed letterhead leaves the changed regions with different rendering, compression, and noise characteristics from the material around them. Field-level analysis reports which region failed, though confirming that the signatory holds authority to certify pay still requires contact with the employer.
TamperCheck analyses salary certificate uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.