The Check That Does Not Care How Good the Fake Looks
Most advice on spotting a fake paystub is visual: a misaligned column, a font that does not match, a logo that is slightly off. That advice was written for a world where a forgery was made by hand, and it fails against the documents arriving in mortgage intake now, which are generated by tools that get the layout right every time. A paystub generator does not misalign a column. It does, very often, get the tax wrong.
Payroll withholding is not a design choice. Social Security and Medicare are fixed percentages of defined wage bases, set by statute, and a real payroll system computes them the same way for every employee of every employer in the country. A forger who types in a salary and lets a template fill the rest, or who edits the gross pay on a real stub and leaves the taxes alone, produces a document that looks right and does not add up. The arithmetic does not care how convincing the document looks, which is exactly why it is the check worth running first.
We wrote earlier about how forged documents got cleaner and about the file-level forensics that catch them. This post is about the cheaper layer underneath: the deterministic tests on the numbers themselves, which need no model, no training data and no vendor, and which a surprising share of fabricated income documents fail.
Social Security and Medicare: Two Percentages a Forger Has to Get Right Together
Under the Federal Insurance Contributions Act, an employee's Social Security tax is 6.2% of Social Security wages, up to an annual wage base that the Social Security Administration sets each year ($176,100 for 2025). Medicare tax is 1.45% of Medicare wages with no cap, and an employer must withhold an additional 0.9% on wages above $200,000 in the calendar year. Together the two come to 7.65% of wages below the wage base, which is the ratio most people remember.
That gives three tests on any paystub, and they get stronger in combination:
- Social Security withholding over Social Security wages should be 6.2%. Within cents of rounding for the current period, and exactly on the year-to-date figures until the wage base is reached.
- Medicare withholding over Medicare wages should be 1.45%. Plus the additional 0.9% only on year-to-date wages above $200,000.
- Year-to-date Social Security tax should stop growing once year-to-date wages pass the wage base. A high earner's stub in November that still shows Social Security withheld at 6.2% of the current period, after year-to-date wages passed the cap months earlier, was not produced by a payroll system.
A forger rarely gets both percentages right at once, and almost never handles the wage base or the additional Medicare threshold, because those require knowing the year-to-date history and the tax year, not just the number on the page. The test is also hard to argue with: a stub where Social Security is 5.1% of wages is not a judgment call, it is a document that a real payroll engine did not produce, or one that was edited after it did.
There is one case where the test points to fraud without any editing at all. Retirement income from a pension or an annuity is not subject to FICA. A document that presents itself as an earnings record for retirement income and shows Social Security and Medicare withheld is describing a payroll that does not exist, and that pattern is a common signature of documents bought from a paystub generator by someone who does not have a wage-paying employer to imitate.
Pre-Tax Deductions Change Which Wages Each Tax Is Computed On
The reason this test produces false positives when it is run naively, and the reason a regex is the wrong tool for it, is that not every deduction reduces every wage base. Getting this right is what separates a useful check from one underwriters learn to ignore.
- Traditional 401(k), 403(b) and similar elective deferrals reduce federal income tax wages, but not Social Security or Medicare wages. On a W-2, they lower Box 1 and leave Boxes 3 and 5 alone.
- Section 125 cafeteria plan deductions for health premiums, and similar pre-tax benefits, reduce all three: federal taxable wages, Social Security wages and Medicare wages.
- Some deductions are post-tax and reduce none of them.
So the right test is not "Social Security is 6.2% of gross." It is "Social Security is 6.2% of gross minus the cafeteria plan deductions," and Medicare is the same base at 1.45%. A stub that applies 6.2% to gross when it carries a large health premium deduction is, ironically, the one that looks wrong on careful inspection, because real payroll systems apply the exclusion. The check has to be written as a small solver that knows which deduction affects which base, and it has to read the deduction labels on the stub to classify them. That classification is where document intelligence earns its place in an otherwise arithmetic test.
The W-2's Boxes Have to Agree With Each Other
A Form W-2 is a set of related figures, and the relationships are fixed:
- Box 4 should equal Box 3 × 6.2%, with Box 3 capped at the wage base for that year.
- Box 6 should equal Box 5 × 1.45%, plus 0.9% on the portion of Box 5 above $200,000.
- Box 1 is ordinarily at or below Box 5. It is lower by pre-tax elective deferrals reported in Box 12 under codes such as D, E and G, and by cafeteria plan exclusions. Roth deferrals, reported under codes AA, BB and EE, are after-tax and do not reduce Box 1, so a W-2 whose Box 1 gap is explained only by a Roth code does not reconcile.
- Box 13's "Retirement plan" checkbox should be consistent with a deferral code in Box 12.
- State wages and withholding in Boxes 16 and 17 should be plausible for the employer's state, and absent for state income tax in the nine states that do not tax wage income: Alaska, Florida, Nevada, New Hampshire, South Dakota, Tennessee, Texas, Washington and Wyoming. A W-2 from a Texas employer showing state income tax withheld for Texas is a hard fail.
The employer identification number deserves its own check. It is nine digits, and the first two digits are an IRS prefix drawn from a known set. More useful in practice: the EIN has to be the same on every paystub, every W-2 and the verification of employment in the file. A borrower who fabricated one document from a template and kept a real one from a previous job often produces two different EINs for what the application says is the same employer.
Cadence and Year-to-Date: The Series Has to Make Sense
A single stub can be internally consistent and still be impossible as part of a series. Two or more stubs give the agent more to test.
Year-to-date gross pay should increase on every stub, by the current-period gross. Pay dates should fall on the cadence the stub claims: weekly and biweekly pay lands on a fixed seven- or fourteen-day lattice, semimonthly on the fifteenth and the last day of the month or the business day before. Year-to-date gross divided by the number of pay periods elapsed should be close to the current period's gross for a salaried employee, and a large gap needs a visible reason, such as overtime, a bonus line or a raise.
Then the series has to agree with the bank statements. Net pay on each stub should arrive as a direct deposit, in that amount, on or about that pay date. This is the single most effective cross-document test for income fraud, because a borrower who fabricates a paystub almost never fabricates the matching deposits. It is also cheap, because the bank statements are already in the file for asset verification. One more test belongs here: a charge on the bank statement to a paystub-generator site, dated near the stub's pay date, is close to conclusive about the stub, and costs one string match to find.
Where These Checks Go Wrong, and How to Keep Them Honest
Every one of these tests has a legitimate exception, and a check that ignores the exceptions will flag real borrowers. The common ones:
- Employees exempt from FICA. Some state and local government employees are covered by a public retirement system instead of Social Security, certain nonresident aliens on specific visas are exempt, and members of some religious groups have approved exemptions. A stub with no Social Security withholding is a question, not a verdict.
- Multiple employers in a year. Each employer withholds Social Security up to the wage base independently, so a borrower who changed jobs can legitimately have Social Security withheld on combined wages above the cap. The excess is refunded through the tax return.
- Corrections and retro pay. A stub that carries a prior-period correction can break the cadence or the year-to-date progression for a real reason, and usually labels it.
- The wage base changes every year. It has to be table-driven by tax year. Hardcoding one year's figure turns every January stub into a false positive.
The way to keep the check honest is to report findings with the arithmetic shown. "Social Security withheld $312.40 on Social Security wages of $6,120.00, which is 5.10%, against an expected 6.20%" is something an underwriter can verify in ten seconds and act on, and it is a finding a borrower can answer with a document if there is an innocent explanation. A finding that says "income document risk: high" is something the underwriter has to take on faith, and a reviewer who cannot see why a check fired eventually stops believing it.
Why This Belongs on Every File, Not the Suspicious Ones
The reason to automate checks that are, individually, simple is coverage. A careful underwriter can run the FICA test on a stub that already looks wrong. Nobody runs it on every stub in every file, because there are dozens of stubs per file and the clean-looking ones are the ones that get skipped, which is exactly where a clean forgery lives.
The Fraud Agent runs the withholding solver, the W-2 box algebra, the EIN consistency check, the cadence test and the deposit match on every income document in every file, and raises a condition with the page and the arithmetic attached when one fails. It runs alongside the Income Desk, which calculates the qualifying figure from the same documents, so a stub that fails authenticity never quietly becomes the basis for a qualifying income. The point is not that any of these tests is sophisticated. It is that the cheapest, most deterministic test in the file is the one most often skipped, and it is the one a forger is least able to beat.
The Honest Read
Arithmetic will not catch every fabricated income document. A careful forger with a working knowledge of payroll can produce a stub that passes every test here, and an employer that is itself a shell will produce real-looking withholding on fabricated wages. Those cases need verification from a source the borrower does not control and the tax transcript. What the arithmetic does, at almost no cost, is remove the large population of fabricated documents that never got the math right, and it does so with findings an underwriter can check by hand and a borrower can answer.
We think this is the right first layer for any mortgage fraud program because it needs no labels, no model and no data-sharing agreement, and every finding it produces is explainable to an examiner. The full set of income and employment schemes we look for, and the signals for each, is in our mortgage fraud guide.
Ramkumar Venkataraman
CTO & Co-Founder