Forged Salary Slip Detection Without Slowing Approvals
Last reviewed: November 2026
Forged salary slip detection is the set of checks a lender runs to confirm that a borrower's payslip was issued by the stated employer, has not been edited, and matches the salary that reaches the bank account and the tax records. It combines document forensics, payslip arithmetic and cross-checks against independent data.
This guide is for CROs and heads of credit operations at NBFCs, banks and fintech lenders that underwrite salaried borrowers. It covers how payslips are forged, which checks catch them, and how to run those checks at login without adding days to good approvals.
Key Takeaways
- A payslip is the easiest income document to fake, because most employers issue it as a plain PDF that a lender cannot validate at source.
- Form 26AS and the Annual Information Statement (AIS) show what an employer reported to the tax department, which a forger cannot easily change.
- From tax year 2026-27, the salary TDS certificate Form 16 becomes Form 130 under the Income-tax Act, 2025, according to press coverage.
- RBI's NBFC Fraud Risk Management Directions, 2026 require a show-cause notice and at least 21 days to respond before a borrower is classified as fraud.
Why Are Forged Salary Slips a Leadership Problem?
Forged salary slips are a leadership problem for three reasons: they inflate income exactly where limits are set, they often arrive through channels paid on volume, and they surface only after the loan goes bad. For unsecured personal loans, the payslip is often the main income evidence, so one edited figure flows straight into eligibility and pricing.
The fixed obligations to income ratio (FOIR) is the share of monthly income already committed to EMIs. Inflate the stated salary enough and a borrower far above your FOIR cap falls comfortably below it, as the worked example later shows.
Forgery and the making of false documents are listed fraud categories in RBI's 2026 NBFC fraud directions, and a confirmed fraud must be reported to RBI within 14 days of classification.
How Are Salary Slips Typically Forged?
Salary slips are typically forged in five ways: editing a genuine payslip, generating one from an online template, inventing an employer, reusing someone else's slip, or inflating salary with a cooperative employer. Each pattern leaves a different trace.
| Forgery Pattern | What Gets Changed | Where It Usually Shows |
|---|---|---|
| Edited genuine payslip | Gross pay, allowances, net pay | PDF metadata, incremental saves, font mismatch, broken arithmetic |
| Template-generated slip | The whole document | Producer software, generic layout, missing employer identifiers |
| Shell or fake employer | Employer name and address | No matching deductor in Form 26AS, employer not traceable |
| Someone else's slip | Name and employee code | Mismatch with PAN, KYC and bank account holder |
| Collusive employer | Nothing on the file; the salary is real on paper only | Part of each credit leaves the account soon after |
The last pattern passes file forensics because the document is genuine. That is why forensic checks need data cross-checks alongside them.
How Do Lenders Detect a Forged Salary Slip?
Lenders detect a forged salary slip with four checks, applied from the document outward. Each catches a type of forgery that the others miss.
- Document forensics: confirm the PDF has not been edited or generated from a template.
- Payslip arithmetic: confirm earnings, deductions and net pay are internally consistent.
- Bank credit match: confirm the net pay actually lands in the borrower's account.
- Tax records: confirm the employer reported a similar salary to the tax department.
Check 1: Has the Payslip File Been Edited?
Payroll systems produce payslips in batches, so genuine files from one employer tend to share producer software, page size, fonts and naming. A slip whose metadata shows a consumer editor, or a modification date long after creation, needs a second look.
Incremental saves are the next clue. When a PDF is edited and saved, the new content is often appended, and earlier versions of the changed lines can sometimes be recovered.
Hash every uploaded payslip as well. If the same file or template appears for unrelated borrowers, you are likely looking at a forgery service, and Digiqt's lending fraud detection AI agent shows how such cross-application signals can be scored together.
Check 2: Does the Payslip Add Up?
Payslip arithmetic is a quick, cheap filter. Gross earnings minus deductions must equal net pay, and year-to-date totals should match the monthly figures across the slips provided.
Check 3: Does the Salary Reach the Bank Account?
Net pay on the slip should appear as a regular credit in the borrower's account, with a narration that names the employer. A slip showing ₹1,40,000 against bank credits of ₹72,000 needs no further forensics.
Fetch the account through an account aggregator for lenders where possible, because that data comes from the bank rather than the borrower. Then confirm ownership with penny drop bank account verification before relying on the credits.
Check 4: Do Tax Records Show the Same Employer and Salary?
Tax records are the hardest source to fake. Form 26AS, the annual tax credit statement, lists tax deducted at source (TDS) reported against the borrower's PAN, with the deductor's name and the amount paid or credited.
The AIS on the income tax portal shows a wider set of reported information, downloadable as PDF, JSON or CSV. Ask the borrower to fetch both in a live, assisted session rather than accepting a forwarded file.
Form 16, the employer's TDS certificate, carries a certificate number that taxpayers can check on the TRACES portal. From tax year 2026-27, the new Act renames Form 16 as Form 130 and Form 26AS as Form 168, so update checklists before borrowers start submitting them.
Digiqt's income verification AI agent shows how payslips, bank credits and tax records can be compared without manual review.
How many inflated payslips did your credit team approve last quarter without knowing it?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how DocuForge checks uploaded PDFs for tampering before they reach underwriting.
How Does Forged Salary Slip Detection Work on a Real Loan File?
On a real file, each check adds evidence, and together they show both that the slip is false and what the true income is. In this illustrative scenario, a direct selling agent (DSA) uploads three payslips for a ₹12 lakh personal loan over 48 months at 15%.
The slips show net pay of ₹1,40,000 a month. The new EMI is about ₹33,400 and existing bureau EMIs are ₹22,000, so FOIR on the stated salary is about 40%.
| Check | Finding |
|---|---|
| Metadata | All three slips were created on the same day by a consumer PDF editor, a week before upload |
| Arithmetic | On one slip, gross minus deductions exceeds stated net pay by ₹4,000 |
| Bank credits | Salary credits from the named employer are ₹72,000 a month |
| Form 26AS | Employer-reported salary for FY 2025-26 is about ₹9.6 lakh, roughly ₹80,000 a month gross |
On the real net salary of ₹72,000, total obligations of ₹55,400 put FOIR at about 77%, not 40%. Most policies would decline the file.
The hash check also matches the payslip template to two other recent applications from the same DSA. Those files go to the fraud desk before disbursal.
The lesson for leadership: the slips looked perfect on screen, and only independent data exposed the true salary. Visual review alone would almost certainly have approved the loan.
Which Approach Fits Your Lending Model?
The right approach depends on ticket size, sourcing channel and borrower segment. High-volume lenders need automated checks on every slip, while low-volume lenders can review flags manually.
| Situation | Recommended Approach |
|---|---|
| Small-ticket digital personal loans | AA salary credits as primary proof, payslip forensics as backup |
| DSA-sourced personal loans | Forensic scoring on every slip plus DSA-level template clustering |
| Large salaried home loans | Payslips plus Form 26AS or AIS, with employer confirmation for high exposures |
| Employer tie-up programmes | Employer-confirmed salary data, with spot forensics on any slips received |
For segment-specific automation ideas, see how AI agents for personal loans handle high-volume income checks.
Should You Stop Accepting Payslips Altogether?
No, but you should stop treating them as primary proof. Treat the payslip as a claim and bank and tax data as the evidence, and when they disagree, the payslip should never win.
How Should Payslip Checks Fit Into the Credit Workflow?
Payslip checks should run at upload, produce a risk band and feed the decision engine automatically. Three design choices matter most.
First, score every uploaded file before a person sees it. Digiqt's DocuForge runs 12 layers of forensic checks on uploaded PDFs, including metadata verification, incremental update tracking, trusted PDF source validation and hash integrity, and combines them into a document risk score.
Second, route by risk band rather than pass or fail. Low-risk files pass straight through, medium-risk files go to a reviewer with the reason shown, and high-risk files go to the fraud desk.
Third, pass the score and any income gap into your credit decision engine, so a high-risk slip cannot reach sanction. For a wider view of automated credit, see AI agents in loan underwriting.
Keep the evidence trail, because RBI's 2026 NBFC directions require a show-cause notice, 21 days to respond and a reasoned order before any fraud classification.
Which Metrics Show Payslip Checks Are Working?
Five metrics show whether payslip checks are working: flag rate by channel, income gap rate, confirmed forgery rate, review turnaround and early default on passed files. Read them together, because a low flag rate can mean clean sourcing or weak checks.
| Metric | Formula | What a Weak Number Signals |
|---|---|---|
| Flag rate by channel | Flagged payslips ÷ payslips received, by DSA or branch | One partner far above peers needs review |
| Income gap rate | Files where verified income is over 20% below stated ÷ all files | Stated income is not being tested |
| Confirmed forgery rate | Confirmed forgeries ÷ flagged files | Rules are too noisy, or reviewers clear too easily |
| Review turnaround | Hours from flag to decision | Good borrowers are waiting too long |
| Early default on passed files | First-EMI defaults ÷ passed files | Forgeries are slipping through |
Review these monthly, and make DSA payouts reflect verified income quality, not just volume. Forged salary slip detection only pays off when sales incentives point the same way.
Which Mistakes Let Forged Payslips Through?
Four mistakes let most forged payslips through, and all of them are process choices rather than technology gaps.
- Checking the slip against itself. A forger controls every number on the slip, so only outside data can prove it wrong.
- Accepting slips forwarded by intermediaries. Files sent by a DSA over email or WhatsApp have no chain of custody.
- Ignoring the employer. Small or unfamiliar employers deserve a check that they exist and appear as a deductor in tax records.
- Not closing the loop. Confirmed forgeries should update rules, template blocklists and DSA payouts.
What Is Changing Next?
Two shifts are under way: forgery is getting cheaper, and verified data is getting easier to fetch. Generative tools can now produce a convincing payslip in minutes, so visual review will catch less each year.
Account aggregator coverage and tax data make bank and tax records practical as the default income evidence. The Income-tax Act, 2025's renamed forms are a good moment to rebuild income checklists around that principle and build them into your digital lending platform.
Want every payslip scored for tampering before your credit team opens it?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how DocuForge and our lending platform stop income document fraud before disbursal.
