Detect tampered and deepfake W-2 Form

What a genuine W-2 form contains

Each box holds a defined figure: Box 1 the wages subject to federal income tax, Boxes 3 and 5 the Social Security and Medicare wage bases, Boxes 4 and 6 the corresponding withheld taxes at fixed statutory shares of those bases, and Box 2 the federal income tax withheld. Pre-tax benefits legitimately push Box 1 below Boxes 3 and 5.

The employer identification number follows the two-digit, seven-digit pattern, and the box layout follows IRS form revisions that changed slowly, so several legitimate designs circulate. Because Boxes 4 and 6 are arithmetic functions of Boxes 3 and 5, the pairs are fully determined, and a W-2 that breaks the relationship was retyped whatever the print looks like.

How W-2 form forgeries are made

• Statutory withholding ratios

  Box 4 tracks Box 3 and Box 6 tracks Box 5 at fixed statutory shares, so each pair is determined by arithmetic alone. Pairs that break the relationship expose a retyped form even when every other region looks untouched.

• Box 1 versus the wage bases

  Box 1 excludes pre-tax deductions, so it legitimately sits below Boxes 3 and 5. A Box 1 that equals or exceeds them, with no benefit story to explain it, contradicts how payroll actually produces the form.

• Wage and withholding inflation

  Inflating Box 1 raises borrowing power and inflating Box 2 fakes a refund. Both are digit substitutions inside ruled cells, and they leave font-pass and spacing traces exactly where the edit happened.

• EIN and employer coherence

  The EIN pattern, employer name, and address must cohere and agree with payslips or an employment letter elsewhere in the file. An employer block that shifts between documents is a composite signal.

• Layout generation

  IRS revisions mean several W-2 designs are legitimately in circulation. A form that mixes one year's box layout with another year's instructions was assembled from templates rather than issued by payroll software.

What TamperCheck checks on a W-2 form

TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.

• Arithmetic reconciliation

  Stated totals are recomputed from their components, and running or cumulative figures are checked for continuity across periods. A single edited value breaks the chain even when the page still looks right.

• Table structure integrity

  Inserted and deleted rows leave structural artifacts behind: inconsistent spacing, misaligned columns, and formatting the visible table no longer accounts for.

• Field-level forensics

  Every text region is analysed in its own right rather than as part of one whole-page image. This catches the smoothed and feathered edits that whole-image Error Level Analysis misses entirely.

• And many more checks

  The three above are the layers that carry the most weight on a W-2 form. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.

Who verifies a W-2 form, and why

Mortgage underwriters, tenant screeners, and HR onboarding teams. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.

How to verify a W-2 form in 4 steps

1. 1

   Collect the W-2 pages

   Scan or upload the complete form at full resolution, including any state rows and the employer block, keeping the table cells undistorted for figure-level analysis.

2. 2

   Recompute the ratios

   Compare Box 4 against Box 3 and Box 6 against Box 5. The fixed statutory relationships make any break in the pairs a hard arithmetic failure.

3. 3

   Compare Box 1 with the bases

   Check Box 1 against Boxes 3 and 5 for the pre-tax story, and read Box 2 against the wages to sanity-check the withholding claim.

4. 4

   Run a forensic check on the file

   The statutory box relationships are fully recomputable, which is what makes the W-2 so checkable. TamperCheck runs 200+ forensic checks including ratio recomputation and cell-level print analysis, with a risk score from 0 to 100 and findings tied to specific regions of the image.

Frequently asked questions