The Fake Employment Letter: Anatomy of a 20-Minute Forgery

Of all the documents that move money, the employment verification letter might be the least verifiable on its face. It has no standard format, no check digits, no issuing authority, no register. It is a claim — name, title, salary, tenure — typed above a signature, styled with a logo anyone can download. A convincing one takes twenty minutes to fabricate from scratch, and a perfect one takes five if you start from a real letter and change three fields.

Landlords, lenders, immigration processes, and background-check teams accept thousands of these daily. Here's how the fakes are built, and the one check that beats all of them.

Key takeaways

• Employment letters have no intrinsic verifiability — every element (letterhead, signature, phone number) is attacker-controlled.
• The three fake variants: fully invented employers, real employers with inflated details, and accomplice-verified letters with a co-conspirator answering the callback.
• Never verify through contact details printed on the letter — independent source lookup is the entire game.
• File forensics catches the lazy majority: edited PDFs, template-generator metadata, and mismatched fonts in the salary line.

Three grades of fake

The invented employer. A company name, a stock logo, a Gmail-adjacent domain registered last month. These fail the ten-minute existence check: no web footprint older than the application, no business registration, an address that's a mail drop. A structured company verification — registration records, domain age, phone type — dismantles them almost mechanically.

The inflated reality. The applicant works at the company — as a contractor, or in a junior role, or until last month — and the letter upgrades title, salary, or tenure. These survive the existence check and die on the callback, if the callback goes anywhere real.

The accomplice. The letter lists a "HR manager" phone number answered by a friend, or a paid verification-fraud service that exists to answer callbacks convincingly. This is the variant that catches even diligent verifiers — the diligence was real, the target was fake.

The source-check that wins

The defense is the same discipline as every callback-verification problem, including bank account change fraud: independently establish the channel. Find the employer's main line yourself — registry records, the company's own site reached by typing the domain, a directory — and ask for HR. Not the number on the letter. Not the mobile of the signer. If HR confirms employment, title, and dates through that independently found channel, you have something. If the only confirmation path routes through details the applicant supplied, you have a loop that proves nothing.

For US employers, many route verification through payroll-provider services; a refusal to support any standard verification path is itself a data point. The FTC's employment background-check guidance sets out what verifiers can and should confirm (ftc.gov).

Read the artifact first

Before any phone call, the file itself deserves two minutes, because most fakes are lazy:

• Metadata. A letter "issued" by a company but created yesterday in a consumer editor, or bearing a template-site generator string, is finished before the callback.
• Typography. The salary and name are the edited fields; they betray themselves with font substitution, baseline drift, or spacing that doesn't match the body text.
• The signature. Pasted signature images carry their own history — compression edges, resolution mismatch against the rest of the page.
• The letterhead. Logos scraped from the web arrive at web resolution; a crisp letter with a fuzzy logo is assembled, not issued.

None of this proves fraud alone — plenty of real letters are ugly. But an edited artifact plus an applicant-controlled verification path is a pattern, and patterns are what reviews are for.

Structural fix: stop accepting claims

The durable fix is to treat the letter as a pointer, not a proof: it tells you whom to verify with, and even that only loosely. Teams that process volume put the artifact check in the pipeline — every uploaded letter machine-screened for editing traces and generator fingerprints before a human dials anything — and reserve the humans for the independent callbacks. That split is exactly what an automated document check is for: let software read the file's history, and spend the human minutes on the phone call the fraudster can't control.