Document Forensics at Scale: Catching Fake Paystubs and SEP Letters

To catch a fabricated paystub or an altered Special Enrollment Period letter at scale, you score every document across four independent forensic signals: template deviation, font substitution, metadata anomalies, and OCR consistency. When two or more of those signals fire together, you route the document to a human reviewer with the specific evidence attached. That combination catches template-consistent fabrications that overloaded eligibility staff miss, without cutting off legitimate enrollees on a single false positive.

I have watched eligibility reviewers process documents until the words blurred. They catch the crude forgeries: the paystub with a company logo pasted at a visible angle, the termination letter dated three years in the future. What they miss are the fabrications that look right, because looking right is exactly what a decent forgery is engineered to do.

This article walks through how those documents actually fail under machine inspection, the signal layers that expose them, and the guardrails you need before any automated flag touches a denial decision. Machines flag. Humans decide. That division of labor is the whole game.

The Reviewer Who Approved 400 Paystubs Before Lunch

Picture the reviewer at a state-based marketplace during open enrollment. She has a stack of income verifications and coverage-loss letters, an SLA that demands a decision within days, and a supervisor tracking her throughput. By 11:30 she has cleared 400 documents. She is good at her job. She caught six obvious fakes.

She also approved four fabricated paystubs generated from the same online template, each one internally consistent, each one with clean fonts and plausible numbers. She did not have time to run arithmetic on every deduction line, cross-check the payroll processor format, or notice that four unrelated applicants submitted the identical document skeleton with only the name and dollar figures changed.

That is the volume problem. Human attention is expensive, finite, and degrades under load. Forensic signals are the opposite: cheap to compute, consistent at the thousandth document as at the first, and blind to fatigue. The Government Accountability Office has repeatedly flagged the marketplace verification process as vulnerable to fabricated documentation, and its undercover testing has successfully enrolled fictitious applicants using counterfeit supporting documents [1].

The thesis is simple. You move the pattern-detection work to machines, which never get tired at 11:30. You keep the judgment work with humans, who owe applicants due process. The mistake teams make is either extreme: dumping everything on reviewers, or letting an algorithm auto-deny. Both fail. The right design flags with evidence and lets a person decide.

The Four Signal Layers That Expose a Fabricated Document

No single signal is trustworthy on its own. A weird font can be a legitimate regional employer. Stripped metadata can be an accessibility remediation. What makes forensics defensible is corroboration: independent signals pointing at the same conclusion.

Template deviation compares the submitted layout against known-good templates for that employer or issuer. ADP, Paychex, and Gusto each render paystubs with predictable field positions, column spacing, and alignment grids. A fabricated document built in a word processor drifts: the net-pay field sits two pixels off, the deduction table uses inconsistent row heights, the header logo is a different aspect ratio than the genuine article.

Font substitution detects where someone edited numbers inside an otherwise genuine-looking document. The tell is mixed font families, inconsistent kerning around edited digits, or rendered text sitting on top of a different embedded font. When a fraudster changes gross pay from 2,400 to 4,200, the new digits often render in a substitute font the editor guessed at, and the kerning between characters breaks.

Metadata is the quietest and loudest signal at once. PDF producer strings reveal the software that touched the file. A paystub whose metadata says it was last modified in Photoshop, or run through an online PDF editor after being issued by a payroll system, is telling you something. Modification timestamps that postdate the pay period, stripped EXIF data on a photographed document, and editing-software fingerprints all belong here.

OCR consistency cross-checks the values a machine reads against the embedded text layer and against arithmetic logic. Gross minus itemized deductions must equal net. Year-to-date figures must progress correctly across sequential pay periods. Dates must be internally coherent. When OCR extracts a net-pay number that does not reconcile, that is not a rendering quirk. That is math that does not add up.

The lowest false-positive layer is OCR arithmetic consistency, because legitimate paystubs almost never fail to reconcile. That is why it carries the heaviest confidence weight in a scoring model.

How Fabricated Paystubs Actually Fail

Here is a concrete failure. An applicant submits a paystub showing gross pay of 3,600, deductions itemized as 450 federal, 220 state, 275 FICA, and a net of 2,900. Add the deductions: 945. Subtract from gross: 2,655. The stated net of 2,900 is off by 245 dollars. A human scanning at speed reads "net: 2,900" and moves on. A reconciliation check flags it in milliseconds.

The pipeline looks like this: OCR extraction pulls every labeled numeric field, a parser maps them to gross, deductions, and net, an arithmetic validator confirms the relationships, and a template matcher confirms whether the layout corresponds to a known payroll processor.

def validate_paystub(doc):
    fields = ocr_extract(doc)              # {'gross': 3600, 'fed': 450,
                                           #  'state': 220, 'fica': 275,
                                           #  'net': 2900}
    deductions = fields['fed'] + fields['state'] + fields['fica']
    expected_net = fields['gross'] - deductions

    signals = []
    if abs(expected_net - fields['net']) > 1.00:
        signals.append(('ocr_math_mismatch',
                        expected_net, fields['net'], weight=0.45))

    meta = read_pdf_metadata(doc)
    editors = ('Photoshop', 'GIMP', 'iLovePDF', 'Smallpdf')
    if any(e in meta.get('producer', '') for e in editors):
        signals.append(('editor_fingerprint',
                        meta['producer'], weight=0.30))

    if meta.get('mod_date') and meta['mod_date'] > fields['pay_date']:
        signals.append(('post_issue_edit', weight=0.20))

    return score(signals)   # multi-signal corroboration, not a single flag

Generators leave signatures because they optimize for looking real, not for surviving forensics. They apply consistent artifact fonts across the whole document, use uniform decimal formatting where genuine payroll systems vary, and frequently forget that YTD figures must progress across consecutive pay stubs. A fraudster who submits three stubs often reuses one YTD number, or increments it by a round figure that does not match the per-period math. Real payroll accumulates. Fabricated payroll guesses.

This is where the document forensics layer earns its keep: the arithmetic never gets tired, and the template library only grows.

Altered SEP Letters: The Coverage-Loss Fraud Pattern

Special Enrollment Period letters are a different animal from paystubs, and a favorite target. To qualify for an SEP outside open enrollment, an applicant needs a qualifying life event, most commonly loss of prior coverage. A coverage-loss letter or employer termination notice is the proof. Alter the date, and you manufacture eligibility you do not have.

The common edits are backdating the coverage-loss event to fit inside the 60-day SEP window, and forging employer or carrier letterhead. The forensic signals map cleanly: letterhead-logo resolution mismatch where a low-res logo was pasted onto a high-res document, date-field font substitution where the termination date was changed, missing or altered issuer metadata, and boilerplate language that deviates from the real carrier template.

Carriers and employers use consistent notice language. When a submitted letter uses phrasing that no real issuer template contains, or omits standard regulatory boilerplate that always appears on genuine notices, that deviation is detectable against a reference corpus.

The second scenario is where this connects to organized fraud. A ring obtains one genuine termination letter, alters the name field, and submits the same document skeleton across dozens of unrelated applications. Each individual letter might pass a solo review. But the same underlying document structure, the same letterhead artifacts, and the same boilerplate reused across applicants who share no employer is a screaming ring indicator.

That is why document forensics feeds directly into broker and agent ring behavioral analytics. One altered letter is a case. The same altered letter across forty applications is a network. The document signal and the behavioral signal corroborate each other: the skeleton match proves reuse, and the application clustering proves organization.

A Program-Integrity Signal Checklist

Scoring is where individual signals become a defensible decision. No single weak signal denies anyone. Instead, each signal contributes a weighted score, and the combined score determines routing. A metadata anomaly alone might score 0.30. Add an arithmetic mismatch at 0.45, and you cross the threshold for human review with two independent corroborating signals.

The checklist below is what a reviewer or an automated pipeline inspects, field by field. Confidence weight reflects how much each signal should count toward the routing threshold, calibrated so that low-false-positive signals carry more weight.

When a document crosses the multi-signal threshold, the output is not a denial. It is a referral packet: the document, the specific signals that fired, the arithmetic that failed, the metadata that flagged, and the applications sharing the same skeleton. That packet is what makes a referral to a Medicaid Fraud Control Unit or CMS defensible, because it carries the forensic evidence rather than an opaque risk number.

False-Positive Guardrails So You Don't Cut Off Real Enrollees

Every guardrail exists because legitimate documents are messy. A regional employer with a homemade payroll template will fail template matching. A paystub photographed on a phone will have stripped EXIF and shifted fonts. An accessibility-remediated PDF, run through remediation software for a screen-reader user, will carry editing-software metadata that looks exactly like tampering. A re-saved file will show a modification timestamp after the pay date. None of these are fraud.

The guardrail table below pairs each signal with its most common benign explanation and the corroboration you should require before escalating.

This aligns with the progressive trust model and with CMS MARS-E security and privacy controls, which govern how state-based marketplaces handle applicant data and adverse decisions [5]. Human-in-the-loop review is not a nicety. It is a due-process requirement, and it is the difference between a defensible program and a lawsuit.

Frequently Asked Questions

How do you detect a fake paystub automatically? Run OCR to extract every numeric field, validate that gross pay minus itemized deductions equals net pay, check that year-to-date figures progress correctly across pay periods, and compare the layout against known payroll processor templates. Fabricated paystubs usually fail the arithmetic reconciliation or use a template that no real processor produces.

What makes an altered SEP letter detectable? Backdated coverage-loss dates often show font substitution in the date field, forged letterhead shows logo-resolution mismatches, and altered files carry metadata revealing image or PDF editors. Reused document skeletons across unrelated applicants are the strongest indicator of an organized ring.

Can you deny an application based on document forensics alone? No. A single forensic signal is a hypothesis. Require multiple corroborating signals and route every potential adverse action to a human reviewer with the evidence attached, consistent with CMS MARS-E controls and due-process obligations.

What is a referral-grade evidence packet? It is the document, the specific signals that fired, the failed arithmetic, the flagged metadata, and any applications sharing the same skeleton, assembled so a Medicaid Fraud Control Unit or CMS can act on concrete forensic evidence rather than an opaque score.

What to Do in the Next 30 Minutes

Pull 50 recently approved income documents. Run the arithmetic reconciliation by hand or in a spreadsheet: gross minus itemized deductions should equal net, and YTD should progress across sequential stubs. You will find at least one that does not reconcile. That single exercise tells you whether fabricated income is already flowing past your reviewers.

This week, start tracking one metric: the percentage of submitted documents that trip two or more forensic signals, and the downstream confirmed-fraud rate on those flagged documents. That ratio tells you whether your signals are calibrated. If your multi-signal flag rate is high but confirmed-fraud is low, your weights are too aggressive and you are burning reviewer time. If confirmed-fraud on flagged documents is near total, you are catching real fraud and can safely widen the net.

Detectory's document forensics layer operationalizes all four signals with weighted scoring, a case queue that routes only multi-signal hits to reviewers, and referral packets that attach the specific forensic evidence for MFCU and CMS handoff. The point is not to replace your reviewer. The point is to hand her the four fabricated paystubs she would have approved before lunch, with the failed arithmetic circled, so she can make the decision that was always hers to make.

Machines flag. Humans decide. Build the system so that stays true.

References

[1] U.S. Government Accountability Office, "Health Insurance Marketplaces: CMS Needs to Improve Its Oversight of Eligibility Verification," 2016 (GAO-16-784, undercover testing results still cited in oversight reviews). https://www.gao.gov/products/gao-16-784

[2] Centers for Medicare & Medicaid Services, "Medicaid and CHIP Enrollment Trends Snapshot," 2025. https://www.medicaid.gov/medicaid/national-medicaid-chip-program-information/medicaid-chip-enrollment-data/index.html

[3] Centers for Medicare & Medicaid Services, "2024 Medicaid and CHIP Improper Payments Report," 2024. https://www.cms.gov/data-research/monitoring-programs/improper-payments-measurement-programs

[4] U.S. Department of Health and Human Services, Office of Inspector General, "Medicaid Fraud Control Units Fiscal Year 2023 Annual Report," 2024. https://oig.hhs.gov/fraud/medicaid-fraud-control-units-mfcu/

[5] Centers for Medicare & Medicaid Services, "Minimum Acceptable Risk Standards for Exchanges (MARS-E) 2.0," 2024. https://www.cms.gov/marketplace/technical-guidance