Online payslip generators exist specifically to produce convincing fake income documents. They accept a salary figure, an employer name, and a date — and output a PDF that looks professionally formatted. These tools are free, widely available, and require no design skill.
The fraudulent payslip is then submitted as proof of income for a loan, rental application, or government benefit. Manual reviewers, unfamiliar with every employer's payslip format, often approve it.
AI forensic analysis catches these fakes at submission, before the fraud has consequences.
The Payslip Fraud Spectrum
Payslip fraud ranges from crude to sophisticated:
Crude fakes: generated using an online payslip tool, submitted as-is. These fail basic employer checks and arithmetic validation but pass casual visual inspection.
Edited genuine payslips: a real payslip from the applicant (or a third party) with the salary figure, employer name, or date changed. These are harder to detect because genuine security features (font, layout, branding) are authentic — only the data has changed.
AI-generated payslips: synthetically created documents with plausible formatting, correct font matching, and consistent data. These require multi-signal forensic analysis to catch.
The most difficult payslip fraud to catch is an edited genuine document — particularly where only a single number (gross salary or net pay) has been altered. This is exactly what arithmetic verification catches.
Check 1: Gross-to-Net Arithmetic
Every payslip must satisfy:
Gross pay − total deductions = net pay
This identity is invariant. An applicant inflating their gross salary must either:
- Correctly recalculate all deductions and the net figure — requiring deep knowledge of the employer's exact deduction structure
- Change only the gross figure — leaving the net figure unchanged but the arithmetic broken
- Change gross and net — breaking the deduction arithmetic
AI agents verify the full deduction chain: gross → individual deductions (income tax, national insurance/superannuation, pension, student loan, etc.) → net. The expected deduction amounts are estimated based on jurisdiction-specific tax tables and the stated salary.
A deviation between the expected and stated deductions signals fraud even when the fraudster has updated multiple fields.
Check 2: YTD (Year-to-Date) Consistency
Payslips include YTD figures alongside the current period values. These must satisfy:
- YTD gross = sum of all period grosses for the year
- YTD deductions = sum of all period deductions for the year
- YTD net = YTD gross − YTD deductions
When only one payslip is submitted, the YTD figure allows the AI to infer whether previous payslips for the year are consistent with the claimed salary. An applicant claiming a salary first paid three months ago should have YTD figures at roughly 3/12 of the annual equivalent — not 12/12.
Check 3: Font and Rendering Analysis
Every employer generates payslips from a specific payroll system (Xero, MYOB, ADP, Sage, etc.) or internal system. These systems produce payslips with characteristic font metrics, line spacing, and field positioning.
AI agents detect:
- Font substitution: a payslip generated by Xero uses a specific font at specific sizes. An edited version with a replaced salary figure in a slightly different weight or spacing is measurable.
- PDF operator anomalies: genuine payroll-generated PDFs use consistent PDF operators throughout. Re-edited documents introduce operator sequences characteristic of PDF editing tools.
- Character spacing outliers: individual characters in a modified value often have slightly different spacing than surrounding text — invisible to the eye, measurable statistically.
Check 4: Employer Verification
AI agents cross-reference the employer details on the payslip against public business registries:
- ABN/ACN (Australia): the stated ABN must be valid (passing the check-digit algorithm), active (not deregistered), and consistent with the stated employer name and state.
- EIN (USA): employer identification number format and consistency with the claimed employer entity.
- Company number (UK): Companies House registration status and trading name.
A payslip for "Smith & Associates Pty Ltd" with an ABN that belongs to a supermarket chain, or an ABN that has been deregistered, is an immediate fraud signal.
Check 5: Pixel-Level ELA Analysis
Payslips submitted as images (not PDF) are subject to Error Level Analysis. When a value is changed in an image editor:
- The original value is covered with a white rectangle
- The new value is typed or pasted over it
- The edited region is saved back to JPEG
This process creates compression discontinuities at the boundary of the edited region. ELA maps these discontinuities, highlighting the edited area visually. The numeric fields — salary, deductions, net pay — are specifically targeted in the ELA scan.
Check 6: Metadata and Creation Tool Fingerprinting
Payslip PDFs carry metadata identifying the generating software. A payslip from a large employer's SAP payroll system should have metadata consistent with that system. A payslip generated by an online fake tool carries the metadata of that tool — often a web-based PDF generator, identifiable by its PDF producer string.
AI agents maintain a database of known-legitimate payroll system producer strings. Documents generated by known fake-payslip tools are flagged immediately.
Even when a fraudster strips the metadata, the absence of expected metadata from a large employer's payroll system is itself a signal worth noting in the analysis.
Case Pattern: The Salary Inflation Attack
The most common payslip fraud pattern:
- Applicant has a genuine payslip from their employer
- Opens it in a PDF editor
- Changes the gross salary figure from $55,000 to $95,000
- Doesn't touch net pay, deductions, or YTD figures
- Submits to a lender
Caught by: gross-to-net arithmetic failure, YTD inconsistency, font metrics outlier on the modified figure.
The lender who receives this document without AI analysis either approves a loan the applicant can't service, or routes it to a human reviewer who may or may not notice the arithmetic problem.
Check a payslip in seconds
Upload any payslip and get a forensic verdict across all 6 checks instantly. Free to start.
Start free →FAQ
What payslip formats are supported?
AI payslip analysis supports PDFs and images (JPEG, PNG) across a wide range of payroll systems and jurisdictions, including Australia, UK, USA, New Zealand, and others. The AI adapts its deduction arithmetic to the applicable tax jurisdiction based on document signals.
Can AI detect fake payslips generated by online tools?
Yes. Online payslip generators have characteristic metadata signatures and PDF producer strings. Even stripped-metadata documents fail on arithmetic, font, and employer verification checks.
What if the applicant has a legitimate payslip but a genuinely unusual salary structure?
The AI returns a confidence score alongside the verdict. Unusual salary structures (commission-heavy, irregular pay periods, salary sacrificing) that reduce arithmetic confidence are flagged as "suspicious" with a low-severity signal and explanation, rather than immediately as "likely tampered." These route to human review rather than auto-rejection.
Where does payslip fraud fit in the broader document fraud picture?
Payslip fraud is one of three common income document types targeted in lending and rental workflows — alongside bank statement tampering and tax return manipulation. For the full taxonomy of document fraud types and the forensic signals used to catch each, see the Complete Guide to Document Tampering and Fraud.