Fake Document Checker: How to Test a Suspect File
What a fake document checker can tell from a file, how to read its verdict and score, and what to check before uploading sensitive documents.
TL;DR: Fake proof of income is a document or packet edited or generated to overstate what an applicant earns, and judging each file alone is how it gets through. In NMHC's survey of 75 apartment firms, 84.3% of those that experienced fraud had seen falsified pay stubs, employment references, or other income documentation. Documents that agree prove little when the applicant supplied all of them, so the decision needs at least one source the applicant does not control.
What Fake Proof of Income Actually Is
Fake proof of income is any document or set of documents that misstates the amount, source, or continuance of what an applicant earns. Lenders, landlords, and fintech underwriters each receive a different mix of paper, and each paper can confirm only part of the claim.
Two production classes show up in these packets. Edited-after-creation starts from a real stub, letter, or statement and changes the figures after the issuer produced the file. The employer is genuine, so a call confirming that the person works there can pass while the salary stays false. Generated-from-scratch builds the document, and often the whole packet, with no issuer behind it. Those figures agree because one author wrote them.
Rental application fraud has the clearest recent count. The NMHC survey ran from November 2023 to January 2024. Of the 75 responding firms, 93.3% reported fraud in the prior 12 months, and on average they attributed 23.8% of eviction filings to fraudulent applications and the nonpayment that followed. Those figures describe surveyed operators and do not give a fraud rate per application.
A Matching File Is Still One Witness
The documents in a packet should tell one story over time. Pay on a stub should turn into deposits on a statement. The year to date should fit the prior year's annual figure once raises and job changes are accounted for. The employer's name should hold from letter to stub to tax form, and the application has to fit all of them.
Fannie Mae's income and employment best practices frame this as the lender's job: look for conflicting information, view it holistically, and carry out additional due diligence when discrepancies appear. Its examples include direct deposits from a different employer at significantly lower income, and a stub or bank record showing a different source or amount than the verification of employment.
Agreement needs a second reading. When every page came through the applicant, agreement shows only that the packet was assembled carefully. Reviewers should count sources instead of pages. Three documents from the applicant are one witness. One figure from the IRS is a second.
Honest files also disagree. A mid-year job change, pre-tax deductions that separate gross pay from taxable wages, a bonus, a direct deposit split between accounts, or a payroll processor's name on the deposit line can each produce a mismatch. Ask for the explanation, and prefer one that can be tested against a record. The tests for each document type are covered in how to spot a fake pay stub and how to spot a fake employment verification letter.
Is the Income Believable for This Person?
Income reasonableness compares the claim with the life around it. Fannie Mae's red flags include income inconsistent with occupation and position, income out of line with tenure or education, generic job titles, recent large raises, and rounded earnings. Its suggested due diligence asks whether deposits, assets, and credit history fit the stated income, and whether the commute makes sense for a job that requires physical attendance.
Fannie Mae's worked example is a restaurant manager in a non-metropolitan area reporting $102,000 a year, against an area average of $63,117 for that job. The Bureau of Labor Statistics publishes wage estimates for about 830 occupations by state and metropolitan area, which gives reviewers a free reference point.
A reasonableness result sets how hard to verify. High earners exist in every town, so the result should move a file to a stronger source, and the decision rests on what that source returns.
Go to Sources the Applicant Does Not Control
The employer, reached independently
A phone number or email on the letter is part of the document under test. Find the employer through a state business registry or the company's main line, then ask for HR or payroll. Fannie Mae also suggests checking the employer's online presence, its state registration, and whether its address sits in a commercial area. Its worked example turned up a company principal who shared the borrower's last name, so look for relationships as well as existence.
Keep a record of the date, the person's name and title, and the contact used. A confirmation that someone works there leaves pay open unless the employer confirms the amount too.
Consented payroll and bank data
Consented data arrives from a system of record with the applicant's permission. Fannie Mae accepts third-party employment verifications when the borrower authorized them, and holds the lender accountable for the integrity of what comes back.
Coverage is uneven, and an applicant who declines to link an account has not signaled fraud. Bank data shows that money arrived, and funds cycled through an account can look like pay. The federal open banking rule is also unsettled. The CFPB records that a court stayed its compliance dates on October 29, 2025, and the Bureau's August 2026 regulatory agenda lists a rulemaking to reconsider it, so a policy should not assume those dates.
Landlords who buy a report have a further duty. The CFPB explains that a landlord who denies an application because of a tenant screening report must give an adverse action notice, and that requiring a co-signer or a larger deposit can count as adverse action.
How Detection Actually Works
File forensics asks whether each PDF's history supports its story. Production method separates a payroll or bank export from a later edit or a page built elsewhere. Timestamp trail compares file times with the date the document claims. Issuer matching tests whether the file resembles that issuer's real output. Consistency compares figures inside the file and across the packet. Model artifacts surface traces of generation. Recycled patterns catch the same layout on unrelated applicants, which one reviewer holding one file will never see.
Edited files tend to fail on history, because a later save sits on top of a real original. Generated files tend to fail on issuer and pattern, because no original exists. Neither result proves anything about the job. A forensically clean stub can come from a position that ended last month, and a genuine letter can come from a company the applicant owns. Employer confirmation, IRS data, and consented records do the work of proving income exists.
What to Do with a Suspect File
- Keep the original upload and log any replacement separately. A new version sent after a challenge is a new claim.
- List which sources in the file came through the applicant and which did not.
- Name the specific conflict: which figure, on which two documents, for which period.
- Obtain at least one confirmation from a source outside the packet.
- Record the outcome. A reconciled conflict proceeds. An unresolved one goes to a decision-maker under written policy.
Apply the same steps to every applicant at the same trigger, and avoid denying on a look alone. Mortgage sellers have an added obligation: Fannie Mae requires notice within 30 days once a reasonable basis exists to conclude that misrepresentation or fraud occurred. For a scored read of one file's history before the outside check, check the document.
Where Sphinx Fits
Watchdoc, Sphinx's document fraud product, examines the file and shows the reviewer why it passed or failed across the six checks above. Sphinx reports a 94.3% correct verdict and clears clean files in under 28 seconds, at $0.45 per document with no seats or platform fee. It does not connect to bank accounts, verify a person's face, call employers, or pull IRS transcripts, and the team keeps the final decision. The free playground covers 50 documents and needs no card.
Frequently Asked Questions
How can a landlord tell if proof of income is fake?
A landlord should compare the documents with each other, then confirm the figure outside the packet. Pay should show up as deposits, and the employer should be reached through a contact the landlord found independently.
Do matching documents prove income is real?
Matching documents prove only that the packet is consistent. Real proof needs at least one source the applicant does not control, such as the employer, an IRS transcript obtained through an authorized route, or consented account data.
Can a lender get IRS transcripts directly?
Yes, with the taxpayer's authorization. Enrolled IVES participants request transcripts online or by fax using Form 4506-C, and the IRS releases them only with consent. A transcript confirms what was filed or reported to the IRS, which is different from confirming that the income was accurate or continues today.
Does a matching bank deposit prove someone has that income?
A matching deposit shows that money arrived, and funds moved through an account can resemble pay. Regular timing, the payer's identity, and employer confirmation carry more weight than the amount alone.
Should an application be denied because one document looks altered?
One anomaly justifies verification before it justifies denial, since scans and re-saves produce innocent signals. Teams should name the conflict, seek independent confirmation, and decide under a written policy applied to every applicant.
