How to Spot Fake Check Stubs: A Landlord's Guide to Fake Documents and Fraud-Resistant Verification

A landlord in Phoenix approves a tenant based on pay stubs showing $6,200/month from a local construction firm. Three months later, the tenant has not paid rent. The construction firm has no record of the person. The pay stubs were built from a $15 template downloaded off the internet.

This is not an edge case. Income fraud on rental applications is common enough that an entire category of verification tools exists to combat it. The question is not whether applicants will try to fake income documents. The question is whether your process catches it before you hand over the keys.

This guide covers how income fraud actually works, what red flags to look for in documents, and which verification methods make fraud difficult or nearly impossible.

How applicants fake income documents

Understanding the mechanics helps you know what to look for. There are three levels of sophistication, and all three are accessible to a motivated applicant.

Level 1: Editing a real document

The applicant takes a genuine pay stub and changes the numbers. Open the PDF in an editor, adjust the gross pay from $2,800 to $5,600, update the YTD totals, and re-export. The formatting and employer details look right because they started from a real document. The only things that changed are the numbers.

This is the most common approach because it is the easiest. Basic PDF editing tools can do it. Some applicants use browser developer tools to change numbers on a payroll portal screen, then print to PDF.

Level 2: Building from a template

Websites sell pay stub templates for $15-25. The applicant enters whatever employer name, salary, and deduction amounts they want. The output looks like a professional pay stub, complete with tax withholdings and a layout that mimics real payroll systems. Some template sites even advertise "for verification purposes" in a thin attempt at plausible deniability.

These are harder to catch visually because the formatting is clean. But they leave traces in the PDF metadata. More on that below.

Level 3: Fabricating supporting documents

The most determined applicants create an entire paper trail: pay stubs, an offer letter on fabricated letterhead, and a fake employer phone number that rings to a friend who confirms employment. This level of effort is less common but not rare, and it defeats any process that relies solely on document review and employer callbacks to a number the applicant provided.

For a deeper look at what is easy to alter versus what is not, see altered or forged income documents and what to watch for.

Red flags in income documents

No amount of visual inspection can guarantee a document is authentic. But a careful review can catch the most common mistakes fraudsters make.

PDF metadata

Every PDF stores metadata about how it was created: the software that produced it, the application that authored the content, and creation and modification dates. A pay stub generated by a payroll provider like ADP will show ADP's software in the producer and creator fields. A document that was edited or built from a template often shows:

• PDF Producer: Skia/PDF, PDFium, or Quartz (browser-based PDF engines)
• Content Creator: Chromium, Safari, or a generic PDF editor
• Modification date: Present and later than the creation date, indicating the file was re-saved

On a Mac, open the PDF in Preview and press Cmd+I to view the Inspector. On Windows, right-click the file, go to Properties, then Details. Look for mismatches between what the document claims to be (an ADP pay stub) and what the metadata says produced it (Chrome).

The full walkthrough, including examples of legitimate vs. suspicious metadata, is in ways to spot fake pay stubs using PDF metadata.

Math that does not add up

Fraudsters who edit numbers often forget to update related fields. Check:

• YTD totals vs. individual pay periods. If the stub says $3,000 biweekly but the YTD after 10 pay periods shows $22,000 instead of $30,000, the numbers were changed.
• Tax withholdings. Federal and state tax rates follow specific brackets. If someone claims $6,000/month gross but the federal withholding is $180, the math does not work for any filing status.
• Net pay. Gross minus deductions should equal net. Run the subtraction.

Formatting inconsistencies

• Fonts that shift between sections of the document
• Layout that does not match what the stated payroll provider typically produces
• Inconsistent spacing, alignment, or capitalization
• Low resolution or obvious image compression artifacts (suggests the document was screenshot-edited and re-exported)

Cross-document contradictions

When you collect multiple documents (pay stubs, offer letter, ID), compare:

• Does the employer name match exactly across all documents?
• Does the pay frequency on the stub match the employment terms in the offer letter?
• Do the dates align? A pay stub dated before the offer letter's start date is a red flag.

Why document review alone is not enough

Even a thorough document review has limits. You can catch obvious mistakes, but a careful fraudster who uses a good template, runs the math correctly, and creates clean metadata will produce a document that passes visual inspection.

The fundamental problem: you are reviewing a file that passed through the applicant's hands. They had full control over its contents before it reached you. Any process that relies entirely on the applicant to provide truthful documents is trusting the person you are trying to verify.

This is why the industry has moved toward methods where the data comes from a source the applicant cannot control.

Verification methods ranked by fraud resistance

Not all verification methods are equally resistant to fraud. Here is how they compare, from most vulnerable to most resistant.

Uploaded documents (pay stubs, tax returns, bank statement PDFs)

Fraud resistance: Low

Any document the applicant uploads can be edited before submission. Pay stubs, W-2s, tax returns, and bank statement screenshots are all modifiable with basic tools. Even bank statements downloaded as PDFs can be altered and re-saved.

The comparison between pay stubs and bank-based income reports makes this tradeoff concrete: documents are familiar but fragile. Bank-sourced data is harder to manipulate.

Document fraud detection (Snappt-style scanning)

Fraud resistance: Moderate

Tools like Snappt scan uploaded PDFs for signs of digital editing -- metadata changes, font swaps, pixel-level alterations. This catches Level 1 fraud (editing a real document) fairly well. It is less effective against Level 2 fraud (documents built from clean templates) because there may be no "original" to compare against.

Document scanning also does not provide income data. It tells you whether a document appears tampered with, not how much the applicant earns. You still need another method to assess income. For a detailed comparison, see Snappt alternatives and why bank-based verification works differently.

Employer verification

Fraud resistance: Moderate to high (for employment status)

When an employer confirms employment and salary, that is authoritative data. The problem is access and speed. Many employers do not respond for days or weeks. Self-employed applicants have no employer to contact. And if the applicant provides the employer's phone number themselves, there is nothing stopping them from listing a friend who will vouch for them.

Employer verification is strong when it works but has blind spots and significant delays. The timing issues are covered in why employer verification is so slow.

Bank-based income analysis (connected via Plaid or similar)

Fraud resistance: High

The applicant does not submit a file. They authorize a secure, read-only connection to their bank account. The provider pulls deposit and transaction data directly from the financial institution through an API. The applicant cannot edit the data because they never handle it.

What appears in the report is what the bank has on record: actual deposits, actual dates, actual amounts. If someone claims to earn $6,000/month but their bank shows $2,400 in deposits over the past three months, the data speaks for itself.

This is the core reason bank-based verification exists. It removes the applicant's ability to control the narrative. For a full explanation, see bank-based income reports: what they are and when requesters use them.

Building a fraud-resistant verification process

A process that is hard to game combines the right method with good habits. Here is a practical framework.

Step 1: Use a verification method the applicant cannot manipulate

Bank-based income analysis is the single most effective change you can make. When the data comes from the bank rather than from a document the applicant provides, the most common fraud tactics (editing pay stubs, using templates, fabricating documents) become irrelevant.

Step 2: Never rely on a single data point

Even with bank-based analysis, context matters. Review deposit patterns over multiple months, not just one. Look at consistency and trend direction. Cross-reference with other information you have (application details, stated employer, references).

Step 3: Be skeptical of employer contact information provided by the applicant

If you do call an employer, find the company's phone number independently. Do not use the number on the application or pay stub. A Google search or LinkedIn lookup takes two minutes and prevents the "my friend answers the phone" scam.

Step 4: Know the red flags and check for them

If you receive documents for any reason (some applicants offer them proactively), run through the checks: PDF metadata, math validation, cross-document consistency. These take five minutes and catch low-effort fraud. The full checklist is in ways to spot fake pay stubs.

Step 5: Apply your screening criteria consistently

Fair housing laws require you to apply the same criteria to every applicant. Whatever verification method you choose, use it for everyone. Do not selectively apply stricter scrutiny based on factors unrelated to the financial data.

What fraud-resistant verification actually looks like

Here is a concrete example of the difference.

Document-based process:

1. Ask applicant for three recent pay stubs.
2. Wait 1-3 days for applicant to respond.
3. Receive two pay stubs (one is blurry).
4. Ask for the third pay stub and a clearer copy.
5. Wait another day.
6. Review all three. Numbers look plausible.
7. Hope they are real.
8. Total time: 3-5 days. Fraud protection: low.

Bank-based process:

1. Create a verification request. Send applicant a link.
2. Applicant connects their bank account (2-3 minutes).
3. Receive a report with deposit history and estimated monthly income.
4. Review the report. Apply your income-to-rent ratio.
5. Total time: under 30 minutes. Fraud protection: high.

The second process is faster, cheaper, and harder to game. The applicant still controls whether they participate (they authorize the bank connection), but they cannot control what the bank reports.

The cost of not catching fraud

Approving a fraudulent applicant is expensive. The math is straightforward:

• Lost rent: 2-3 months of unpaid rent before eviction is filed ($3,000-$4,500 at $1,500/month)
• Eviction costs: Court filing fees, attorney fees, and process server costs ($1,500-$5,000 depending on jurisdiction)
• Property damage: Fraudulent tenants who know they are getting evicted have little incentive to maintain the property ($500-$10,000+)
• Vacancy during eviction and turnover: Additional months of lost rent while you go through the process and re-list

A single fraud incident can cost $5,000-$20,000 or more. A bank-based income verification costs $14.99 per applicant. The math is not close.

Common objections and honest answers

"My applicants would not be comfortable connecting their bank account."

Most people already connect their bank account to apps like Venmo, Cash App, Zelle, and dozens of other services. The technology (Plaid) is the same. The connection is read-only and encrypted. In practice, most applicants complete the process in under three minutes.

"I have been doing this for years and I can spot a fake."

Maybe. But a well-made fake from a $15 template with correct math and clean metadata will pass a visual review. Document review catches lazy fraud. It does not catch competent fraud. And the applicants with the most to hide are usually the ones who put in the most effort.

"Document scanning tools like Snappt are enough."

Snappt catches edits to existing documents. It does not catch documents fabricated from scratch, and it does not tell you how much the applicant earns. It is an additional layer, not a complete solution. If you use Snappt, you still need a separate method to assess income.

"Employer verification is the gold standard."

For confirming employment status, yes. For speed, cost, and coverage of non-traditional income, no. Employer verification cannot handle self-employed applicants, gig workers, or anyone without a traditional employer. And waiting 1-2 weeks for HR to respond costs you vacancy days.

Next steps

If you currently rely on document review alone, your process has a gap that fraudulent applicants can exploit. Closing that gap does not require an overhaul. Start by running one bank-based verification alongside your current process and compare what you learn.

• See how bank-based income analysis works
• View an example income report
• View pricing -- $14.99 per verification, no subscription required
• Read the full comparison of income verification services

Fraud prevention in rental screening is not about catching every lie. It is about choosing a verification method that makes lying impractical.