Ways to Spot Fake Pay Stubs - Checking PDF Metadata and Red Flags

Ways to spot fake pay stubs include checking the document’s PDF metadata—who produced it and when—and watching for visual or numerical red flags. Pay stubs that come straight from a payroll system show a matching producer and creator (e.g. a known payroll vendor); documents that were printed to PDF from a browser or edited often show a different producer (e.g. Chromium, Skia) or mismatched creation and modification dates. Here’s how to check and what to look for.

Why PDF metadata matters

Every PDF stores metadata: the software that created it (PDF Producer), the application or company that authored the content (Content creator), and creation and modification dates. A pay stub generated by a real payroll provider will usually show that provider’s name in the producer or creator. A document that was altered, re-saved, or “printed to PDF” from a webpage often shows generic or browser-based software instead. Checking that metadata is one practical way to flag suspicious pay stubs.

How to check PDF metadata (Preview on Mac)

Open the pay stub PDF in Preview.
Go to Tools → Show Inspector (or press ⌘I).
In the Inspector, check:
- PDF Producer – Which software generated the PDF?
- Content creator – Which application or company is listed as the content source?
- Creation date – When was the file first created?
- Modification date – Was the file changed after creation? (Empty often means it wasn’t re-saved.)

Other systems (e.g. Adobe Acrobat, Windows) have similar document properties or metadata panels where you can view producer, creator, and dates.

What payroll-original metadata often looks like (good signs)

PDF Producer: A known payroll or document output engine (e.g. “PDFOUT v3.8v by Xenos, inc.”).
Content creator: The payroll or HR vendor (e.g. “Automatic Data Processing, Inc.”).
Creation date: A specific date and time when the stub was generated.
Modification date: Often blank or same as creation—the file wasn’t edited after creation.

When the producer and creator match known payroll or HR systems, the document is more likely to be an original from that source.

What edited or re-exported documents often show (red flags)

PDF Producer: A browser or generic PDF engine, e.g.:
- Skia/PDF (Chrome, Chromium)
- PDFium (Chrome)
- Quartz (Safari)
Content creator: Chromium, Safari, or another browser/app instead of a payroll company.
Modification date: Present and equal to (or later than) creation—suggests the file was re-saved or exported again.

Example of a suspicious pairing: Producer “Skia/PDF m101,” Content creator “Chromium,” with creation and modification on the same day. That usually means the PDF was created by printing or saving from a browser, not downloaded as an original from a payroll portal. It doesn’t prove fraud by itself, but it’s a reason to look closer or ask for an original.

One caveat: “Print to PDF” from a browser

Some applicants legitimately open a real pay stub in their browser and choose “Print to PDF” to save it. In that case you may see Quartz, Skia, or PDFium as the producer even though the underlying document is genuine. So browser-produced metadata is a red flag to investigate, not automatic proof of a fake. Ask for a direct download from the payroll site or consider verification methods that don’t rely on documents, such as bank-based income reports, which use data pulled from the bank instead of a file the applicant can re-save or edit.

Other ways to spot fake pay stubs

Visual and consistency checks: Mismatched fonts, layout that doesn’t match the employer’s usual format, or numbers (e.g. YTD) that don’t add up. See altered or forged income documents.
Cross-checking: Employer name, pay frequency, and dates consistent across pay stubs, offer letters, and other documents.
Source of the file: Prefer “download from payroll portal” over “printed to PDF” or screenshots when you must rely on documents.

What requesters can do

For any pay stub you review, open the PDF and check producer, content creator, and dates. Treat browser producers and mismatched metadata as a signal to dig deeper.
When possible, prefer income verification that doesn’t depend on a single uploaded file—e.g. bank-based income reports that use data from the applicant’s bank—to reduce reliance on document authenticity.
Use metadata checks as one input among others, not as the only test. See fake pay stubs and what’s harder to fake for the bigger picture on fraud risk.

Checking PDF metadata is a practical way to spot pay stubs that may have been re-saved, edited, or printed from a browser instead of coming straight from a payroll system. Want to skip the document guessing game entirely? View a sample bank-based income report or see pricing.

Fake Pay Stubs and What's Harder to Fake — The bigger picture on document fraud and which methods resist it
Altered or Forged Income Documents — Red flags across all document types
Pay Stubs vs. Bank-Based Income Reports — Why bank-sourced data is harder to fake