Catching Altered Paystubs the Human Eye Misses

Manual paystub review leaves gaps that fraudsters exploit. Learn the alteration patterns that slip through and how automated verification catches them before you fund.

The FundLock Team · 2026-10-27 · 5 min

A paystub that looks clean in a deal jacket can still carry altered figures that inflate income by thousands of dollars. Reviewers working a stack of applications under time pressure have no realistic way to catch every manipulation — and applicants who commit income fraud know it. The gap between what human review can reasonably catch and what automated document analysis flags is exactly where funding losses originate.

Understanding the specific patterns fraudsters use — and why manual processes miss them — gives lenders and dealers a practical framework for tightening the front end of every deal.

Common Paystub Alteration Patterns in Auto Lending

Document fraud is not random. Most altered paystubs follow a short list of repeatable techniques:

Digit substitution on gross pay or YTD totals. A borrower changes a single digit — turning $42,000 YTD into $62,000 — using a matching font edited in a PDF tool. The rest of the document stays intact, making the change nearly invisible at a glance.
Employer name or address substitution. Fraudsters replace a legitimate employer's details with a shell company or a real business they have no connection to, then fabricate matching payroll figures.
Inconsistent pay-period math. The stated hourly rate, hours worked, and gross pay don't multiply out correctly — but the error only surfaces if someone runs the arithmetic, which rarely happens under volume pressure.
Mismatched YTD figures. A pay date of late October with a YTD gross that implies a June hire date — or a mid-year stub with YTD figures lower than the single-period pay — signals tampering that is easy to miss without cross-referencing every line.
Font and spacing artifacts. Edited PDFs often carry subtle inconsistencies: a character slightly heavier than surrounding text, non-standard kerning, or a line that doesn't align with the rest of the table. These are invisible to a reviewer scanning a printed copy.
Metadata inconsistencies. PDF creation timestamps, software version strings, and embedded author data can contradict the claimed employer or document date — none of which appears on a printed page.

Why Manual Review Consistently Misses These Red Flags

Experienced underwriters catch obvious fakes. But even seasoned professionals face structural constraints that limit what manual review can realistically accomplish:

Volume and time. When a dealer is waiting on a funding decision, the clock is running. Spending ten minutes verifying the arithmetic on every stip in a deal package isn't operationally viable at scale. Reviewers triage, and triage creates exposure.

Print-based workflows. Printing a PDF to review it eliminates all metadata. It also flattens font-weight differences and compresses spacing artifacts. Many of the easiest automated signals to catch become invisible on paper.

Cognitive consistency bias. When the credit score, down payment, and debt-to-income ratio all look reasonable, reviewers are less likely to scrutinize the income documents closely. Fraudsters understand this and construct applications that pass the headline check.

No cross-reference layer. A human reviewer has no efficient way to cross-check whether the stated employer's FEIN is legitimate, whether the pay frequency is consistent with industry norms for that employer type, or whether the same altered document has appeared on a different application.

How Automated Income Verification Flags What Reviewers Miss

Automated document analysis addresses the structural gaps in manual review by applying checks that are fast, consistent, and don't degrade under volume:

Math validation runs on every field. Gross pay, net pay, deductions, YTD totals, and pay-period arithmetic are calculated automatically. A discrepancy that would take a reviewer two minutes to notice — assuming they checked — surfaces in seconds on every application.
Font and formatting analysis. Machine-based analysis can detect character-level inconsistencies in weight, spacing, and baseline alignment that are imperceptible on a printed page but statistically significant in the underlying file.
Metadata extraction. PDF creation date, modification timestamps, authoring software, and embedded properties are extracted and compared against what the document claims. A paystub allegedly generated by an enterprise payroll platform but carrying metadata from a consumer PDF editor is a material red flag.
Employer and payroll consistency checks. Automated systems can cross-reference stated employer information against known payroll formats, typical pay structures for industry and employer size, and previously flagged document patterns.
Cross-application matching. The same altered document — or a template used to generate multiple fakes — can surface across multiple applications from different applicants or different dealers. Automated flagging identifies re-used documents that manual review would never connect.

What This Means for Dealers and Lenders

For lenders and credit unions, automated income verification means fewer funded deals that later trigger repurchase demands or charge-off write-downs tied to inflated income. It also means underwriters spend their judgment on borderline legitimate files rather than on document forensics that a system can handle faster and more consistently.

For dealers, the benefit is equally concrete. Clean deal packages move faster. When a stip comes back kicked because a paystub failed an automated check, the dealer knows immediately — before the deal is funded — rather than receiving a repurchase demand months later. Getting income documentation right at the point of submission shortens funding timelines and protects the dealer-lender relationship.

The practical workflow shift looks like this: an application enters the pipeline, documents are submitted, and automated checks run before an underwriter opens the file. By the time a human reviews the deal, the document risk layer is already scored. That sequencing compresses decision time and directs human attention to credit judgment rather than document forensics.

Building a Defensible Verification Layer

No single check eliminates income fraud entirely. The most effective approach stacks multiple signals — math validation, formatting analysis, metadata review, and cross-application pattern matching — so that a fraudster would need to defeat all of them simultaneously to pass undetected. That raises the bar significantly above what any individual reviewer or single verification step can achieve.

Lenders building or updating their verification stack should evaluate whether their current process addresses each of these signal types, and where the gaps sit relative to their actual loss experience. Dealers benefit from understanding which documentation standards their lender partners require, since submitting cleaner packages upfront reduces kickbacks and speeds funding decisions for legitimate borrowers.

See how FundLock verifies income and flags altered documents before you fund.

Written by the FundLock team.