Forensic file analysis, identification of the payroll software that issued it and a full recalculation from gross to net: Koncile flags an altered or AI generated pay stub or payslip in 10 seconds.
Create a free account to run the analysis.
Create a free accountFor document volumes or an API, talk to an expert.
The pay stub checker used by insurers, banks and large companies
4.8 / 5
To cover native PDFs as well as scans and photos, the fake pay stub detector runs four levels of checks. An edit leaves traces: in the file, in the pixels or in the math.
ADP, Paychex, Gusto, Workday: each payroll provider produces its pay stubs its own way, with its fonts, its layout and its way of writing the PDF. Koncile compares the file with the known output of that provider. Our library of payroll providers grows with every provider we see, from ADP and Paychex to Gusto and Workday.
A PDF is written like code. We read its metadata, its saved versions, its fonts and the library that wrote it, the serializer. A net pay changed in a PDF editor, or a pay stub rewritten by a Python script, leaves its signature in the file.
On a scan or a photo, the image itself is analyzed. Our proprietary AI model flags cloned digits, white patches, text laid over the original and pay stubs generated in whole or in part by AI from a real one.
AI detected82/100Earnings, deductions, net pay and year to date totals are recomputed line by line. Social Security and Medicare lines are compared with their rates, pay dates with the pay frequency. An edited net pay almost always breaks one of these equations.
Without a tool, these three checks stop clumsy fakes in ten minutes. A tip: ask for the native PDF downloaded from the employee's payroll portal, not a scan or a screenshot.
Subtract each deduction from gross pay: you must land on net pay to the cent. Social Security is 6.2% of wages up to $184,500 in 2026, Medicare 1.45% with no cap (IRS Topic 751). Federal and state withholding depend on the W-4: read them for consistency, do not recompute them.
Ask for two or three consecutive stubs: year to date gross grows by the current gross, no more. Net pay should land on the bank statement, last year's total on the W-2. Look the employer up with the Secretary of State and call the number on its official website.
Use our free PDF metadata viewer and look in particular at Creator, Producer and the timestamps. A native pay stub comes out of a payroll platform such as ADP, Paychex or Gusto. Word, Canva or a PDF editor are red flags. An edit after the pay date deserves a question.
A pay stub is a chain of calculations tied to a job, a pay schedule and a state. Our payroll model built with a French chartered accountant covers French payslips today. US pay stubs get the arithmetic and consistency checks below.
Rate times hours gives each earnings line, the lines add up to gross pay, and gross minus every deduction gives net pay. A pre tax 401(k) contribution lowers taxable wages, not gross pay: a stub that mixes the two does not add up.
Year to date gross must equal the previous total plus the current period. Social Security at 6.2% and Medicare at 1.45% are checked on the current line and on the year to date line. Federal and state withholding, or UK PAYE, National Insurance and tax code, are read for consistency.
Pay dates must match the pay frequency, year to date totals the hire date, the hourly rate the job title. A state income tax line on a stub from Texas, Florida or another state with no wage income tax deserves a question.
A full payroll rules engine by state, like our French model, is not built yet for US pay stubs.
Koncile's fraud detection API gives you a score (0-100) and detailed explanations of manipulation risks, right inside your own tools.
Every earnings and deduction line, current and year to date.
High, medium or low level, with a one sentence explanation.
High risk from 80.
A one line summary ready for your information system.
curl -X POST https://api.koncile.ai/v1/upload_file \ -H "Authorization: Bearer $API_KEY" \ -F "files=@pay-stub.pdf"requests.post("https://api.koncile.ai/v1/upload_file/", headers={"Authorization": f"Bearer {API_KEY}"}, files=[("files", open("pay-stub.pdf", "rb"))]){ "status": "DONE", "General_fields": { "Employer": {"value": "Northline Logistics LLC", "confidence_score": 0.98}, "Net_pay": {"value": "2432.80", "confidence_score": 0.99} }, "Line_fields": { "Deduction_amount": [{"value": "174.63"}, {"value": "40.84"}] }, "Fraud_detection": { "risk_score": 84, "summary": "Year to date gross does not match current earnings", "signals": [ {"name": "Pay stub arithmetic", "severity": "high"}, {"name": "Editing software", "severity": "medium"} ] }}84.3% of landlords hit by fraud received falsified income documents (NMHC, 2024). The pay stub stays required when an applicant declines bank or payroll linking: here is where the checker fits in.
Pay stubs, W-2s and bank statements in every file. Length of employment and year to date income weigh on approval: an edited hire date or an inflated year to date total is flagged before underwriting.
Income extracted from pay stubs, then checked before approval with your own rules. An inflated net pay shows in the file, even when the math adds up.
The two or three recent stubs of each applicant checked in seconds: payroll provider, math, file. Doubtful files rise to the top, before the lease is signed.
Disability and life underwriting, lost wage claims: earnings are proven with pay stubs. Anomalies are flagged before payout, with a score the claims handler can explain.
Proof of income checked at the same time as identity, for an account opening or a source of funds review. The detail of every test is kept, for internal audit and for the regulator alike.
Letting agents and UK lenders check two or three recent payslips against the P60 and bank statements. Each file is scored before the tenancy or the loan.
Some edits break no calculation and show nothing on screen. The fake pay stub detector then relies on signals invisible to the naked eye: the comparison with the known pay stubs of the same payroll provider, and the traces left by PDF editing tools or by AI.
| Pay stub element | What Koncile checks | What gives an edit away |
|---|---|---|
| Payroll provider | Creator, Producer, fonts and layout compared with the known pay stubs of each provider: ADP, Paychex, Gusto, Workday | A stub branded with a payroll provider but written in Word, Canva or an online generator |
| Dates and timestamps | Creation and modification dates, compared with the pay period and the pay date | An edit dated after the pay date, rewritten or missing dates |
| Saved versions | Versions appended at the end of the file, dormant objects | The old net pay stays in the file: Koncile rebuilds the before and after |
| Fonts | Embedded fonts, subsets and encoding, compared with the rest of the stub | An amount retyped in another font, or embedded differently from the rest |
| File writing style | Object order, cross reference table, compression: the library that wrote the PDF | pypdf, MuPDF, ReportLab or qpdf instead of the payroll platform |
| Text layer | Match between the displayed text and the encoded text | A visible net pay that differs from the extracted text, a deleted line still present |
| Pay stub math | Earnings, deductions, net pay and year to date totals | Net pay that no longer follows from gross pay, a year to date total that skips |
| FICA lines | Social Security at 6.2% and Medicare at 1.45%, current and year to date | A Medicare line that no longer matches gross pay after an edit |
| Employment consistency | Pay frequency, pay dates, hire date, state of work | A state income tax line in a state with no wage income tax |
| Scan or photo image | Cloned areas, white patches, text laid over the original, AI generation | A digit pasted on a scan, a stub generated from a real one |
A pay stub holds a name, an address, a salary, often part of a Social Security number and sometimes bank details. Founded by a former lawyer, Koncile was built with data protection at the core of its architecture: third party SOC 2 audit, GDPR compliance, secure hosting. Pay stubs are encrypted, deleted after analysis and never used to train a model.
It is a tool that combines several technologies to spot the anomalies that give away an edit or a fraud: machine learning that analyzes the image, analysis of the PDF file, which is written like code, and a recomputation of the pay stub math. The goal is to stop the few percent of fakes that slip into your processes.
You never know for certain: you measure a risk. It becomes high when one fraud test goes over its threshold, or when several tests point the same way: a net pay that no longer follows from gross pay, a file unlike its payroll provider, traces of editing. That body of evidence should raise the alarm.
It can help, mainly to spot inconsistencies in context and redo a few calculations. It lacks three things: models specialized in images edited or generated by AI, knowledge of the traces each editing tool leaves, and a base of payroll providers that brings the mismatches out. A language model is only one part of the machine.
Compare it with a genuine ADP stub: layout, fonts, the employee ID format and the PDF's Producer field. A real ADP stub is downloaded from the employee portal; one rebuilt in Word, Canva or an online tool no longer matches the provider's output, and Koncile flags the gap.
They cross check. Net pay must land on the bank statements and last year's income on the W-2. Many lenders pull IRS tax transcripts with the applicant's consent through Form 4506-C, and confirm employment with the employer or a database such as The Work Number. The checker sorts the files before those steps.
They ask for two or three recent consecutive stubs, recompute net pay, check that it lands on the bank statement and call the employer at a number they found themselves. Property managers working in volume automate the step: extraction, math check, file check, then their own income to rent rule.
Yes, when it is used to obtain a loan, a lease or a benefit. 18 U.S.C. § 1014 punishes a knowingly false statement made to influence an FDIC insured bank on a loan application: up to 30 years in prison and a $1,000,000 fine. States add their own forgery and fraud laws. Keep the original file and the report.
A stub printed and scanned again loses its file traces: the image and the math remain. A real stub issued by a complicit employer for a fictitious job is authentic on the file side. Our accountant built payroll model covers French payslips; US stubs get the math, file and image checks. A high score is a signal to verify.
Letting agents run tenant referencing and lenders run affordability checks: two or three recent payslips are compared with the P60, bank statements and the employer's details. Koncile adds the file check: payslip edited after export, totals that do not add up, a layout that matches no known payroll provider.
Each document gets its own method: a proprietary ML model for photos, known metadata and forensics for native PDFs, and contextual cross checks.
Inflated balances, deleted lines, a PDF rewritten with software other than the bank's.
See the detection
Photo replaced, date of birth or number changed, an MRZ that no longer matches the fields.
See the detection
Edited amounts, wrong VAT, duplicates and made up suppliers.
See the detection
Address or name replaced on an energy or phone bill, date moved forward.
See the detectionUpload your bank statements, pay stubs or IDs: Koncile extracts the data and flags fakes in seconds.
Talk to an expert
