All posts

Document fraud forensics

Year-to-date math is the check a forger almost never gets right

Gross pay times pay periods elapsed should equal year-to-date gross. When it does not, the number that was changed is usually the one you were shown.

The ProofUp Team8 min read

Somebody editing a pay stub changes the number they care about. Gross pay for the period, and maybe net.

Year-to-date columns are further down the page, they are derived from a running total nobody wants to recompute, and changing them means changing four or five figures consistently. Almost nobody does.

Two numbers and a period count

Take gross pay for the period. Determine how many pay periods have elapsed in the year through this stub's period end date. Multiply.

The result should land close to year-to-date gross. Not exactly, because of overtime, bonuses, unpaid time, a mid-year raise, or a start date after January 1. Close.

A stub showing $4,000 semi-monthly gross with a period ending June 15, which is pay period 12, should show something near $48,000 year to date. If it shows $31,000, either the period gross was inflated or the applicant started in March. Those are different situations and you can tell them apart by asking.

Getting the pay period count right is the part people fumble. Weekly is 52, biweekly is 26, semi-monthly is 24, monthly is 12, and the count through a given date follows from the frequency and the period end date rather than from the calendar month.

Each deduction line has to reconcile too

This is where a forged stub falls apart even when the gross was handled.

Federal income tax withheld, Social Security, Medicare, state tax where applicable, and every voluntary deduction all have both a current and a year-to-date column. Every one of them has to satisfy the same relationship.

Social Security and Medicare are the two most useful, because their rates are fixed and public. Social Security is 6.2% of wages up to the annual wage base, and Medicare is 1.45% with no cap. Those are arithmetic, not policy, and a forged stub with a Social Security withholding that is not 6.2% of the gross it claims is wrong on its face.

Medicare is the cleaner test because it has no wage base to complicate it. Divide the Medicare withholding by the gross. If the answer is not 1.45%, something does not fit.

Multiple stubs are where consistency gets decisive

One stub gives you internal arithmetic. Two consecutive stubs give you something better.

Between two consecutive stubs from the same employer, the YTD figures should increase by exactly the current-period amounts on the later stub. Every line: gross, each tax, each deduction.

If YTD gross rises by $4,000 while the later stub reports $5,200 in current gross, the two documents were not produced by the same payroll run.

This check is close to unbeatable by hand, because passing it requires editing both documents in a mutually consistent way across every line. Requesting two or three consecutive stubs rather than one is a policy change that costs an applicant nothing and closes most of the remaining space.

Cross-check the stub against the deposit

The strongest available consistency check is between documents of different types.

Net pay on the stub should appear as a deposit in the bank statement, on or about the pay date, for the same amount. A stub claiming $3,100 net with $2,240 landing in the account every two weeks is a mismatch that no amount of internal arithmetic consistency covers.

Somebody forging a stub has to also forge the statement, in agreement, on every pay date in the period. The effort curve gets steep fast, which is why requesting both is worth the extra friction.

Rounding, and where to set the tolerance

A tolerance too tight generates false positives on legitimate payroll rounding. Too loose and you miss real discrepancies.

Broadly: within about 2% on YTD gross against the periods-elapsed calculation is normal variance. Beyond about 5% wants an explanation. On the fixed-rate items, Social Security and Medicare, the tolerance should be tight, because those are arithmetic and a real payroll system does not get them wrong.

Setting these thresholds explicitly and applying them the same way to every applicant is also what makes the check defensible. An inconsistent tolerance is a fair housing problem regardless of how good the underlying math is.

Where this fits, and what replaces it

YTD reconciliation is the most durable document check available, because it does not depend on file format, metadata, or fonts. It survives regenerated PDFs and clean forgeries, and it works on a photograph of a paper stub.

It is still a document check. A pay stub that reconciles perfectly can report a job the applicant started three weeks ago, or one they are about to leave, and no arithmetic reveals that.

Which is why the account connection is the better path when the applicant can use it. Income sourced from the bank or payroll provider directly comes from the institution rather than from a document, and deposit history shows duration and consistency that a stub cannot. Document analysis, including this check, is the fallback for applicants who cannot or will not link.

Verdicts return in two to three minutes with the specific failed check named, because "YTD gross is 34% below the periods-elapsed calculation" is something a leasing agent can act on and "flagged" is not.

Run it on one file

Take the most recent approved application with a pay stub. Divide the Medicare withholding by the gross for the period.

If it is not 1.45%, you have found something in under a minute.

What did it come to?

Keep reading

Document fraud forensics

How to spot a fake pay stub

A forged stub is built to fool your eyes, and it does. The signals that actually catch it live in the file data, not on the page. Here are the seven we check.

10 min read

Income math and qualification

How to calculate monthly income from a pay stub

Multiplying weekly pay by four undercounts by nearly 8%. Here are the correct multipliers for every pay frequency, and the three cases where the arithmetic does not apply.

8 min read
Schedule a Demo