Catching Altered Paystubs That Manual Review Misses
Altered paystubs and fabricated income documents slip past experienced underwriters every day. Here's what to look for — and how automation catches what eyes miss.
The FundLock Team · 2026-08-15 · 5 min
Income fraud doesn't always arrive looking like fraud. The altered paystub in your queue today probably clears a quick visual scan — the logo is right, the math adds up, the employer name looks familiar. That's the point. Fraudsters have learned exactly what manual review checks, and they've engineered their documents to pass it.
For lenders and dealers alike, the cost of missing a fabricated income document isn't just a bad loan. It's a repossession, a potential buyback demand, and the operational drag of chasing paper that was never real. Understanding where manual review breaks down — and what automated verification catches instead — is now a baseline competency for anyone funding auto deals.
Why Manual Income Verification Has a Structural Blind Spot
Experienced underwriters catch a lot. They recognize when gross-to-net math is off, when an employer's address looks wrong, or when a pay frequency doesn't match the stated income. But manual review has an inherent ceiling:
- Volume pressure. When an underwriter is processing dozens of applications in a shift, each document gets seconds of focused attention, not minutes.
- Normalization bias. Once a reviewer has approved a hundred legitimate paystubs from a payroll platform like ADP or Paychex, the visual pattern feels safe — and a well-cloned fake benefits from that trust.
- No access to metadata. A printed or scanned PDF looks identical whether it was generated by a legitimate employer or edited in Adobe Acrobat last Tuesday. The human eye cannot see creation timestamps, font substitution artifacts, or layer data embedded in the file.
- Inconsistency across reviewers. Stip standards vary by shift, by reviewer, and by how close it is to month-end. Automated checks apply the same logic every time.
None of this is a criticism of underwriting teams — it's a description of the limits of unaided human review against a problem that has become technically sophisticated.
Common Alteration Patterns in Auto Lending Income Fraud
Knowing what you're up against helps you evaluate any verification approach. The most frequent patterns FundLock and fraud investigators see in auto lending:
Gross income inflation. The most common manipulation — a digit is changed or a zero added to base pay, hourly rate, or YTD earnings. Payroll formatting is preserved perfectly; only the numbers move. Visual review rarely catches a $4,800 that should be $3,800.
Employer name or address substitution. A legitimate paystub from a real employer is used as a template, with the company name swapped to match what the applicant told the dealer. The payroll format, fonts, and layout are authentic — because they were cloned from an authentic document.
Pay period and YTD manipulation. When gross income is inflated, the year-to-date figures must also change to remain internally consistent. Fraudsters update both, but the revised YTD figures frequently conflict with the stated pay frequency or hire date when the arithmetic is checked rigorously.
Fabricated direct deposit confirmations. Some applicants supplement an altered paystub with a fabricated bank statement showing a matching direct deposit. Each document alone looks plausible; cross-referencing the two surfaces the inconsistency.
Font and formatting artifacts. Editing a PDF without the original source file often introduces subtle inconsistencies — mixed font weights, misaligned decimal points, inconsistent kerning between original and edited text. These are invisible to the eye but detectable algorithmically.
What Automated Income Verification Catches — and How
Automation doesn't replace underwriting judgment; it handles the computational and metadata checks that judgment cannot perform manually at scale.
Document authenticity analysis examines file-level properties: edit history, font consistency, layer structure, and metadata timestamps. A paystub that was opened and resaved in a PDF editor carries forensic traces that a legitimate payroll-generated document does not.
Cross-field arithmetic validation runs every calculable relationship in the document — gross to net given stated deductions, YTD consistency with pay frequency and hire date, hourly rate times hours against gross pay — flagging any break in internal logic. This is the check that catches the inflated YTD that doesn't divide evenly by pay periods.
Employer verification confirms that the stated employer exists, that the address on the paystub matches known business records, and — where data is available — that the payroll format matches the employer's known payroll provider. Substituted employer names frequently fail this cross-reference immediately.
Bank data cross-reference ties stated income to actual deposit history when the applicant authorizes account connectivity. A stated monthly income that has no corresponding deposit pattern is a hard stop, not a stip.
Consistency scoring across the application flags when income on the paystub, income stated on the credit application, and income implied by the deal structure are in tension with each other — the kind of multi-document cross-check that a reviewer under time pressure may not complete manually.
What This Means for Dealers Submitting Deals
Dealers have skin in this game too. A buyback demand on a funded deal — because the lender later discovers income was fabricated — lands on the dealer's floorplan relationship, not just the lender's loss ledger. Beyond the financial exposure, dealers who consistently submit clean deals get funded faster. Lenders extend more liberal approval parameters to sources they trust.
Practically, this means dealers benefit from working with lenders who use automated verification, because those lenders can issue faster, more confident decisions on clean deals — rather than adding stips that slow the process for everyone. The friction that automation introduces is targeted: it slows down fraud, not legitimate applications.
Building a Verification Process That Scales
For lenders building or refining their verification stack, the practical takeaway is layered checks over single-point review:
- Automate the mechanical checks (arithmetic, metadata, format consistency) so underwriters spend their time on judgment calls, not computation.
- Set clear escalation triggers — specific flags that move an application from automated queue to senior review rather than routing everything through a single tier.
- Track stip patterns by dealer source. Repeated income stips from a specific dealer are a signal worth investigating before it becomes a pattern of loss.
- Review your exception log regularly. Fraud patterns evolve; the altered paystub of next quarter may look different from the one you caught last quarter.
Manual review will always be part of underwriting. The goal isn't to eliminate human judgment — it's to make sure humans are applying judgment where it actually matters, not burning time on checks a machine can run in seconds.
See how FundLock verifies income and flags altered documents before you fund — without adding friction to your clean deals.
Written by the FundLock team.