TL;DR: A fake employment verification letter states that an employer confirmed a person's job, title, dates, or pay when that employer did not issue the confirmation, or issued a different one. Cotality estimated that 1 in 116 mortgage applications in the second quarter of 2025 carried indications of fraud, and income fraud risk on those applications rose 2.1% from a year earlier. Letterhead still catches a crude copy. A real letter whose salary was changed after HR produced the file walks through that check.
What a Fake Employment Verification Letter Actually Is
An employment verification letter is an employer's written confirmation that a named person holds, or held, a job. Lenders often collect the same facts on Fannie Mae Form 1005 and call the document a verification of employment. The page names the employer, the title, the start date, and the pay. A pay stub is one period of earnings. A bank statement is the deposit record. A genuine letter comes from someone other than the applicant.
Fannie Mae's Selling Guide requires the lender to verify employment income for every borrower whose income is used to qualify. The verification can come from the borrower, the employer, or a third-party employment verification vendor. Pay stubs and W-2s must be computer-generated or typed by the employer, and the original source has to be a third party: human resources, personnel, payroll, a payroll vendor, or a supervisor. Form 1005 is the written request the employer completes. A vendor report is acceptable when the borrower authorized it, and the lender stays accountable for what comes back.
Fake letters arrive in two production classes. Edited-after-creation starts with a genuine letter or a completed Form 1005 and changes the salary, the title, the dates, or the name after the employer produced the file. The letterhead stays. Generated-from-scratch starts from a blank page, a template, or a logo taken from a careers site, with no employment behind it. The edited file walks through a logo check. The generated page can look consistent and still have no issuer.
Income fraud is the misrepresentation of the existence, continuance, source, or amount of income used to qualify. Cotality's 2025 fraud report put indications of fraud on about 0.86% of mortgage applications in the second quarter of 2025, or 1 in 116. Income fraud risk, measured as the change in how often those indicators appear, rose 2.1% from a year earlier. On closed loans, Fannie Mae data cited by Cotality in American Banker put income fraud at 46% of 2024 investigative findings related to misrepresentation.
Lenders and landlords collect the letter when payroll coverage is thin: a small employer, a recent hire, or a stub with no prior-year W-2. Loan document fraud detection treats that packet as one case. The uploaded PDF is the document. The confirmation, on a channel the applicant did not supply, is the verification.
Tells That Still Work, and the Ones That Don't
Letterhead, a sharp logo, and a familiar font catch a letter assembled by someone who never held a real one. A phone number on the page catches less, because the applicant chose that contact. A callback on the employer's own channel is what confirms the employer issued the letter.
Fannie Mae's income and employment guidance lists the discrepancies that still earn a second look. Read them across the whole file. Rounded earnings. A generic title such as manager or vice president. Pay out of line with the occupation, the tenure, or the education. A recent large raise. Direct deposits from a different employer at a materially lower amount. A pay stub or bank record that disagrees with the Verification of Employment. An employer with no public presence, or an address that resolves to a residence, belongs in the same review.
The tells that survive a clean layout connect the page to a record the applicant does not control. Deposits that match the stated pay beat two applicant documents that agree with each other. File history is the other surviving tell: the date on the letter, the creation time, and the last modification should cohere, and a scan of a paper original is the benign case when they do not.
A name swap on a letter the employer issued to someone else clears every row that only inspects this page.
How Detection Actually Works
Detection that holds up reads the file's story before it reads the page, through six classes of signal.
Production method asks how the bytes were made. A letter from an employer's correspondence or payroll system carries that pipeline. A file last saved in a desktop editor, converted from an image, or assembled generatively carries a different one. Edited-after-creation and generated-from-scratch are separate findings, because a genuine HR file may sit under a later save. Timestamp trail asks whether creation, modification, and upload cohere with the date on the letter. Scans add noise, so declining every re-save will decline clean files.
Issuer matching asks whether the claimed employer matches a real entity and a process that employer would use. A company that answers employment questions only through a payroll vendor, or only on Form 1005 after the lender's request, did not produce a free-form page on personal stationery. Consistency then sets the letter against pay, title, start date, the pay stub, deposits on a bank statement, the employer on the credit report, and the date the company was formed. Agreement between applicant documents is a weaker test than agreement with the issuer.
Model artifacts ask whether generative tooling left traces a standard viewer does not show, including a screenshot or image-only PDF that has removed the production story. Recycled patterns ask whether this wording, signatory block, employer identifier, or exact file has appeared on another applicant. That portfolio check is what a single reviewer cannot hold in memory once the same letter arrives under different names.
What to Do With a Suspect File
A flagged letter is a hold, pending a check the applicant does not control. Clearing on letterhead lets the altered real file through. Ask the employer a narrow question through a number on the company's own site, a published HR or payroll desk, or a third-party employment verification vendor the lender queries directly: did you issue a verification for this person, on this date, with this title and this pay. Leave the contact details printed on the letter unused.
A real employer may refuse, or may answer only a lender. Refusal is a limit of the channel. A letter that warrants employment in a form the employer's process does not issue is a finding. When the records disagree, name the letter, the field, and the failed record: a modification after the date on the page, or a tenure that predates the company.
Keep the original. Leave the failed signal out of any message back to the applicant, and ask for a fresh verification through the employer's own channel, a vendor report the borrower has authorized, or the tax-transcript path. Fannie Mae's income guidance tells the lender to execute Form 4506-T and obtain paycheck, W-2, or tax-return information before closing when the employment still will not reconcile. When the packet also holds a pay stub or a bank statement, read each file alone and then against the others, the same way document fraud in banking treats the wider set. Check a document in the Watchdoc playground before the callback, so the x-ray is on file when the employer answers. The first file is free, and no email is required.
Where Sphinx Fits
Watchdoc scores the file and shows the x-ray: production method, timestamp trail, issuer matching, consistency, model artifacts, and recycled patterns. Published figures are a 94.3% correct verdict, 2.8x more forgeries caught, clean files cleared in under 28 seconds, and a review path 54% less expensive, across 1 million documents processed, at $0.45 per document with no seats and no platform fee. The Watchdoc playground is the same check, free to try, including a 50-document free tier. The callback settles what the employer will say. The x-ray settles the file.
Frequently Asked Questions
What is an employment verification letter?
An employment verification letter is an employer's written confirmation that a named person holds or held a job, including the title, start date, and pay. Lenders often collect the same facts on Fannie Mae Form 1005, from human resources, payroll, a payroll vendor, or a supervisor.
How is an employment verification letter different from a pay stub?
A pay stub is one period of earnings from a payroll system, with gross, deductions, net, and year-to-date figures. An employment verification letter is the employer's attestation of the job itself. Each file needs its own check.
How do you verify an employment letter?
Ask the employer, through a number on the company's own site or through a payroll vendor the lender queries directly, whether it issued this letter for this person on this date with this title and pay. Leave the phone number and email on the letter unused. When the income still will not reconcile, Fannie Mae's guidance points lenders to Form 4506-T for paycheck, W-2, or tax-return information.
Can a genuine employer letter still be fraudulent?
Yes. Edited-after-creation starts from a real letter and changes the salary, the title, the dates, or the name after the employer produced it, and a real letter can be reused for a second applicant. Letterhead passes both. File history and a direct question to the issuer separate them.
Does a payroll-vendor report replace the letter?
A report the lender pulls from a third-party employment verification vendor, with the borrower's authorization, is stronger evidence than a PDF the applicant uploaded. Fannie Mae accepts that path and still holds the lender accountable for the data. Where the vendor has no record, the letter returns to the file checks and to a callback the applicant does not control.
.png)
