Sample Forensic Report: AI-Generated Paystub Caught at Mortgage Origination
A real forensic report on an AI-generated paystub caught at mortgage origination. The full evidence chain, the contributing layers, and the counterfactual.
A mortgage applicant submitted three paystubs supporting an income claim of $128,000 a year. The paystubs looked clean. The employer name matched a real company. The pay rate, deductions, and YTD totals were internally consistent. The visual format passed manual review.
The forensic engine flagged the documents at 97% confidence as AI-generated. The lender held the application, contacted the named employer, and confirmed the applicant was not employed there. The forensic report below is a real output, with names redacted.
The submitted documents
The applicant submitted three paystubs covering the most recent six weeks. Each was a one-page PDF with the named employer's logo, address, and EIN. Pay structure was bi-weekly with reasonable federal, state, and FICA deductions. YTD totals progressed appropriately week over week. Manual review by the loan officer raised no flags. The lender's automated underwriting engine accepted the documents. Then the forensic engine ran.
Layer 1: Metadata forensics
PDF creator was identified as ChatGPT (gpt-4-paystub-template). PDF producer was iLovePDF (post-processing). Edit history showed the document was created, modified, and exported all on 2026-04-22 — a single-day cycle inconsistent with payroll workflow. Layer confidence: 91% AI-generated.
Layer 2: Visual forensics
Pixel-level diffusion artifacts present at 0.4% density. Font rendering inconsistency detected on the line 'Federal Income Tax W/H'. Layout grid alignment off by 0.3 points on three table cells. Logo edge analysis showed the logo was pasted, not generated. Layer confidence: 78% AI-generated.
Layer 3: Content forensics
Employer name matched public records. Employer EIN was correctly formatted with valid checksum. Pay rate calculation was internally consistent across pay periods. Deduction percentages matched expected federal and state rates for stated zip code. YTD progression mathematically valid. Layer 3 alone would not flag — content is internally consistent and externally verifiable for static fields. Layer confidence: 12% AI-generated.
Layer 4: Issuer cross-reference (the critical signal)
The Work Number: applicant not on file at named employer. ADP: applicant not on file at named employer. Argyle: named employer is not an Argyle-integrated payroll source. Layer 4 verdict: applicant does not appear in any verified payroll source for the named employer. Layer confidence: 99% AI-generated.
Layer 5: Generator attribution
Probable generator: ChatGPT or GPT-based dedicated paystub tool. Confidence: 92%. Pattern match: matches signatures from the 'PaystubGen' template family active since November 2025. Layer 5 confidence: 92% AI-generated.
Combined verdict and counterfactual
Decision: AI-Generated (97% confidence). Recommended action: Hold application for manual review. Contact named employer directly to verify employment. Decision latency: 412ms total across 3 documents.
Counterfactual analysis. The decision would change to 'human-generated' only if (1) applicant appeared in The Work Number, ADP, or Argyle records for the named employer; (2) PDF creator metadata did not reference a known AI generator; (3) document creation, modification, and export timestamps showed a workflow consistent with payroll processing (2 to 14 days between creation and final export).
What the lender did with the report
The loan officer received the forensic report 412ms after document submission. The report appeared in the underwriting workflow as a hold flag with the layer-by-layer summary. The loan officer contacted the named employer's HR department. The employer confirmed the applicant was not and had never been employed there. The application was withdrawn.
Total time from document submission to fraud identification: 11 minutes. For reference, the lender's average time-to-fraud-identification for paystub fraud prior to deepidv deployment was 12 to 18 days, typically discovered when the loan defaulted within the first six months.
Sample Forensic Report FAQ
- Is this report a real output from deepidv?
- Yes. The structure, language, and layer outputs are unchanged from a real forensic report. Names, account numbers, and identifying details are redacted.
- What document types does the forensic engine support?
- Twelve types: paystubs, W-2 / 1099, bank statements, government IDs, utility bills, receipts, medical records, insurance claim photos, contracts, educational credentials, employment letters, and tax returns.
- How fast does the report return?
- Sub-500ms per document on standard formats. Larger files like multi-page tax returns take up to 2 seconds.
- What is the false-positive rate?
- Under 2 percent on production traffic for paystubs. Configurable per workflow. High-stakes workflows can be tuned for lower false-positive rates at the cost of higher false-negative rates.
- Can I integrate this into my existing underwriting workflow?
- Yes. API or SDK integration. Reference integrations available for Encompass, Blend, nCino, MeridianLink, Total Expert, and most major loan origination platforms.
- What about real documents that have been edited?
- The metadata and visual forensic layers detect human edits to real documents. Edit-history forensics surfaces modifications. Counterfactual analysis tells you which specific edits were made.
Relevant Articles
Financial Groups Unveil 20-Point Plan to Fight AI Identity Fraud
ABA, Better Identity Coalition, and FSSCC release a 20-point plan to combat deepfake fraud.
Apr 7, 2026
Synthetic Identities at Scale — The $40 Billion Problem
How generative models build people who don't exist.
Apr 3, 2026
AI Fraud Agents Are Coming
Autonomous attackers that don't need a human operator.
Apr 4, 2026
Deepfakes Defeated a Dutch Bank's Face Recognition — 46 Times
What it takes to stop them.
Apr 6, 2026
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds, catch deepfakes that liveness checks miss, and let honest users through while keeping bad actors out.
Learn More