---
title: "Pay stub verification: evidence and exceptions for lenders | Trustable"
url: "https://trustable.ai/insights/fake-pay-stubs"
description: "A pay stub verification workflow for lenders: reconcile earnings, trace deposits, confirm the source and resolve suspicious documents with accountable review."
---

Insights · October 30, 2026 · 13 min read

# Pay stub verification: a lender’s review workflow

A pay stub verification workflow for lenders: reconcile earnings, trace deposits, confirm the source and resolve suspicious documents with accountable review.

Pay stub verification helps lending teams resolve discrepancies before relying on claimed income. The review needs to connect the submitted file to payroll activity and an identifiable source, with a clear next action when the evidence disagrees.

A documented workflow keeps the investigation focused on the disputed income without treating every formatting oddity as a fraud finding.

## What pay stub verification establishes

Pay stub verification is a review of the submitted earnings statement, its payroll source and evidence of payment. Document authenticity, source confirmation and the underwriting decision about qualifying income need separate findings. Correct arithmetic alone cannot establish that a stub is genuine.

The examples use U.S. payroll and mortgage rules, rather than universal underwriting standards. The applicable loan program governs documentation. Privacy and employment rules also constrain how the lender obtains and uses evidence.

At Trustable, we add document-authenticity evidence to the [lender’s review workflow](https://trustable.ai/lending). We check pay stubs for signs of editing, including changed figures, font mismatches and rebuilt templates. Each finding identifies its location and signal strength for the reviewer. A document check does not verify employment, receipt of income or borrower honesty, and it does not prove fraud. Payroll records and employer confirmation supply different evidence about the income.

A review therefore needs distinct findings:

What pay stub verification establishes

| Question | Evidence that helps answer it | What remains unresolved |
| --- | --- | --- |
| Does the stub reconcile? | Earnings calculations, deductions and year-to-date movements | A fabricated document can contain correct arithmetic. |
| Does the file show manipulation signals? | File and image analysis, including localized anomalies | A signal alone does not establish who issued the stub or anyone’s intent. |
| Was the stated pay received? | Identified payroll deposits and payment allocations | A deposit alone does not establish continuing employment or qualifying income. |
| Does the source support the claim? | Authorized payroll data or a documented employer response | The response’s scope and date determine what it establishes. |

The distinction matters in real investigations. Freddie Mac described a case in which a pay stub carried a payroll vendor’s logo, but the employer handled payroll internally and did not use a payroll vendor. The employer’s response exposed the fabrication. A familiar logo had supplied no assurance of issuance. [Freddie Mac’s investigation](https://sf.freddiemac.com/articles/news/true-lies-suspiciously-similar-paystubs) also found falsified documents elsewhere in the loan files.

## The review starts with the file received

The intake record should preserve the original upload, its submission time and the route through which it arrived. Any extracted fields or converted copies remain linked to that original. Otherwise, an analyst may investigate an anomaly introduced by the lender’s own conversion process.

Preserve the source-issued payroll download when it is available. A screenshot, scan or photograph may still be usable, but it may not retain the source PDF’s [embedded metadata](https://helpx.adobe.com/acrobat/desktop/edit-documents/edit-pdf-properties/view-metadata.html) or searchable text layer. Missing metadata alone does not show alteration; limited file evidence calls for an appropriate alternate review path.

Pay-period dates should follow the employer’s payroll cadence. Biweekly pay and twice-monthly pay use different schedules; they should not be treated as interchangeable. A pay date after the period ends is not itself an inconsistency.

The reviewer needs enough legible information to connect the statement to the borrower and reconstruct the pay:

- Employee and employer names, with any relevant payroll-provider identity.
- Pay-period dates and the pay date, recorded separately.
- Earnings components, hours and rates where applicable, and gross pay.
- Taxes, employee deductions, additions and net pay.
- Year-to-date totals and any displayed payment allocations.

This is an evidence inventory, not a universal legal pay-stub template. For mortgages sold to Fannie Mae, its [employment documentation standards](https://selling-guide.fanniemae.com/sel/b3-3.2-01/standards-employment-and-income-documentation) require complete, legible documents that identify the employer and source, with sufficient information to calculate income. Borrower-downloaded pay stubs are acceptable. The most recent stub must be dated no earlier than 30 days before the initial loan application and include all year-to-date earnings, subject to Fannie Mae’s document-age limits. Other loan programs have their own requirements.

A screenshot cropped above the employer name is incomplete for that purpose. A missing logo, on its own, says little about authenticity.

## Reconciliation needs the whole payroll picture

### Rebuild the current period

For hourly pay, the reviewer reconciles each earnings line using its stated hours and rate, then includes the other earnings shown. Salary, bonuses, commissions and corrections need their own treatment. Gross pay cannot always be reconstructed from regular hours alone.

For a straightforward cash-pay statement, the relationship is:

Gross cash earnings − employee taxes − employee deductions + separately listed cash additions = net payment.

Every amount must be counted once. A benefit contribution already included in total employee deductions cannot be subtracted again. Employer-paid contributions are not automatically employee deductions, and noncash earnings require separate treatment before reconciling cash paid.

Expense reimbursements can also explain a difference between earnings and the payment. Their treatment depends on the arrangement: the Internal Revenue Service (IRS) distinguishes reimbursements under [accountable and nonaccountable plans](https://www.irs.gov/publications/p463), with different wage-reporting consequences. A reviewer needs the relevant payroll line rather than an assumption that every dollar paid is salary.

A mismatch is most useful when it is specific: “The listed employee deductions leave an unexplained difference in net pay.” That gives the next reviewer something to resolve. “The taxes look wrong” does not.

Illustrative reconciliation example. On a fictional statement with no additions or noncash items, gross cash earnings of $4,000 minus $706 in employee taxes and deductions equals $3,294. A displayed net payment of $4,294 leaves an unexplained $1,000 difference. This invented example shows a discrepancy to resolve. It is not a Trustable result, a real borrower file or a performance benchmark.

In that review, the case file would retain the original upload, the extracted amounts and calculation, and any document-analysis output as separate evidence. The underwriter would then obtain a source-issued payroll record or a documented employer response through an independently established channel, with the required authorization, to resolve the net-pay difference.

### Follow the change in year-to-date totals

Year-to-date (YTD) reconciliation compares like-for-like totals across the same employer’s payroll records. The movement between consecutive statements should be explainable by the payments and adjustments between them.

Multiplying the latest gross pay by the number of elapsed periods assumes unchanged earnings throughout the year. A new hire, variable hours, a raise or an off-cycle payment breaks that assumption.

Consider this illustrative example, using invented amounts:

Follow the change in year-to-date totals

| Item | Earlier statement | Later statement |
| --- | --- | --- |
| YTD gross earnings | $24,000 | $27,450 |
| Current-period gross earnings | $3,000 | $3,000 |

YTD gross increased by $3,450, leaving $450 beyond the later statement’s current-period earnings. That difference is unresolved. A separate $450 bonus statement between the two pay dates could explain it. Without a supporting record, the gap remains open.

The same comparison needs care around a calendar-year reset, a payroll-system migration or a corrected payment. The case record should identify which total changed and which record explains the movement. A verbal explanation alone does not make the arithmetic reconcile.

Tax lines require context too. Federal income-tax withholding depends on earnings, the payroll period and the employee’s Form W-4 information, as the IRS explains in its [withholding guidance](https://www.irs.gov/publications/p505). A fixed percentage of gross pay is an unreliable authenticity rule. [Social Security and Medicare](https://www.irs.gov/taxtopics/tc751) also have different wage-base and withholding rules; neither should be treated as a universal percentage of the displayed gross. Low withholding by itself is not proof of fabrication.

## Deposits corroborate pay within limits

Bank evidence connects the claimed payment to money received. The comparison starts with net payment, its allocation and the pay date, rather than gross salary or the period-end date.

A paycheck can be [split across accounts](https://resource-secure.adp.com/web/protectedHtml/dirDepInstruct.html). In an illustrative case, a $2,500 net payment might appear as $2,200 in checking and $300 in savings. The checking deposit alone leaves a gap; the documented allocation and corresponding savings deposit can close it. Posting dates can also differ from the stated pay date, so the reviewer needs the relevant transaction window and payment context.

The deposit description matters. An incoming transfer of the right amount is not automatically payroll. For covered mortgage transactions, the Consumer Financial Protection Bureau’s [official income-verification interpretation](https://www.consumerfinance.gov/rules-policy/regulations/1026/43/#43-c-4-Interp-4) specifically says an unidentified inflow does not establish income without a basis for that conclusion.

The source of the bank evidence matters as well. Agreement between a borrower-uploaded stub and a borrower-uploaded statement establishes consistency between the files. Both may still need authenticity review. Our guide to [reviewing bank statements](https://trustable.ai/insights/fake-bank-statements-mortgage) explains the document checks involved. Authorized information obtained from the financial institution adds a different evidence path.

Annual tax records have a separate role. A prior-year W-2 supports historical wages; it does not establish current employment. Its taxable-wage amounts may also differ legitimately from a pay stub’s gross earnings because some salary-reduction arrangements affect taxable wages. The IRS describes that distinction in its [wages and salaries guidance](https://www.irs.gov/taxtopics/tc401). Comparisons need the same time period and wage definition.

## Source confirmation goes beyond finding a real business

The source inquiry needs to address the disputed claim. A registered business may not employ the borrower, and an employment confirmation may not cover the earnings shown.

For a suspicious stub, a documented employer response can establish whether the business issued that specific statement and whether the pay period and amounts agree with its records. An authorized payroll-data connection can provide source information within the coverage and fields it returns.

Contact provenance belongs in the case file. An independently established employer channel provides a different basis for confidence from a phone number supplied only on the questioned document. A website or business-registry entry helps establish the business’s identity; it does not validate the employment claim by itself.

For Fannie Mae loans, the [vendor verification standards](https://selling-guide.fanniemae.com/sel/b3-3.2-01/standards-employment-and-income-documentation) require proper borrower authorization, and the lender remains accountable for the integrity of the information obtained. A successful connection is therefore not a blanket approval of everything claimed on the application.

Source responses can conflict too. Freddie Mac has documented [false employment confirmations](https://sf.freddiemac.com/articles/news/true-lies-when-employers-twist-the-truth) that later contradicted employer and borrower interviews. An unresolved conflict calls for investigation under the lender’s policy. Repeating the original call through the same questionable channel adds little.

## Forgery signals should focus the investigation

Authenticity analysis belongs alongside the financial reconciliation. A stub with correct totals may still contain altered earnings. Conversely, a font change or editing-software entry in metadata can have a legitimate explanation.

Trustable checks financial documents for signs of editing and AI generation. Findings marked on the page help an underwriter identify the field needing attention. Metadata that names editing software, missing metadata or a mismatch between visible text and the text layer needs context; none establishes fabrication by itself.

Shared formatting alone is weak evidence: legitimate employers can use the same payroll system. A reviewer investigating similar documents needs to identify what matches and why the similarity is suspicious.

A signal-strength label is not a calibrated fraud probability, an accuracy measure or proof of intent. A highlighted region is a lead for review, not ground truth about that region or a certification of the rest of the page. Results can be wrong in either direction, so an unflagged file is not a guarantee of authenticity.

The reviewer’s next action should address the flagged claim. A signal near gross earnings can lead to comparison with a source-issued payroll record. An unreadable or unsupported input needs a replacement document or another permitted evidence route. “No result” must remain distinct from “no anomaly detected.”

## Every exception needs an owner and a resolution

An effective review queue describes the discrepancy and the evidence needed to close it. It leaves the lending decision with the accountable team.

The lender owns the case record and its routing. Document findings, source responses and bank evidence stay distinguishable so the underwriter can see which question each record addresses.

![Illustrative lender workflow: document signals, payroll-source evidence and bank records feed a case record for underwriter review.](https://trustable.ai/assets/articles/pay-stubs/evidence-workflow.7a3181ea21ae.webp)

Every exception needs an owner and a resolution

| Finding | Possible explanation | Resolution path |
| --- | --- | --- |
| Net pay exceeds the deposit in one account | Split deposit or another payment allocation | Reconcile the allocation to the relevant payment records. |
| YTD movement exceeds the visible period’s gross | Off-cycle pay, correction or missing statement | Obtain the intervening payroll record and reconcile the delta. |
| Employer name differs across records | Payroll provider or another employing entity | Establish the relationship through an authorized source. |
| Localized manipulation signal affects earnings | Alteration or a legitimate export artifact | Compare the disputed field with source-issued evidence; retain the detector result separately. |
| Employer response contradicts the submitted stub | Payroll error, stale information or misrepresentation | Escalate the conflict for investigation before relying on the disputed income. |
| Document cannot be analyzed | Unsupported format or insufficient quality | Use a supported replacement or an alternate verification route. |

These are possible explanations, not findings about a borrower. The analyst records the original discrepancy, corroborating evidence, remaining uncertainty and the person responsible for the next action. The final record states what was established and which income the underwriter accepted under the applicable policy.

Sensitive payroll documents belong in the lender’s approved intake and review systems, with access limited to the people who need them. An unapproved public upload tool is an inappropriate shortcut for a file containing borrower financial information.

## Put the authenticity result into the lending workflow

A lender’s optical character recognition (OCR) tool can extract fields for reconciliation; extraction does not confirm who issued the document. Trustable supplies separate document-authenticity findings through our API or web app. The lender’s team reconciles those findings with payroll-source responses and payment evidence, then decides what income can be relied on under its policy.

Cross-document income comparisons, workflow routing and the review console are in development. The reconciliation and exception paths described here are lender responsibilities, not promises that Trustable automates them. Our [mortgage and HELOC checks](https://trustable.ai/mortgage) add evidence about the submitted files without replacing source confirmation or underwriting.

We demonstrate checks on a sample file and agree on data handling before you share borrower documents. Pricing is quoted by file volume and deployment.

[Book a demo](https://cal.com/scamai/20min?utm_source=trustable.ai&utm_medium=website&utm_campaign=book_demo&utm_content=insight-fake-pay-stubs-body) to discuss pay-stub authenticity checks in your lending workflow.

Trustable

## See it on a sample file.

Book a 20-minute demo. We agree on data handling before you share anything.

[Book a demo](https://cal.com/scamai/20min?utm_source=trustable.ai&utm_medium=website&utm_campaign=book_demo&utm_content=insight-fake-pay-stubs)