Most fake W-2s in circulation are not printed forgeries — they are a real IRS Form W-2 PDF with a wage box retyped, a control number changed, or an employer swapped in. The form looks right because most of it is genuine. What gives it away is the arithmetic between the boxes, the fonts, and the file’s own record of being changed.
W-2 fraud clusters into a small number of techniques, mostly aimed at inflating income for a loan or a job application. Each leaves a different trace.
Run these before treating a W-2 as proof of income. The first two need nothing but the document itself.
Box 1 (wages), Box 3 (Social Security wages) and Box 5 (Medicare wages) follow predictable relationships once you account for pretax deductions like a 401(k) or health premiums. A gap that no stated deduction explains, or one box changed without the others, is the single most common tell in an inflated W-2.
Payroll software (ADP, Paychex, Gusto, a company’s own system) sets every box in one font, at one size. Zoom to 400% on the figure you doubt and compare it against a box you trust — a different glyph shape or a baseline that doesn’t line up means that box was typed in afterward.
A genuine W-2 PDF is produced once by payroll software and never touched again. If the producer string names a consumer PDF editor, or the modification date is later than the date it claims to have been issued, the file was opened and re-saved after the fact. Our free PDF X-ray reads this without an account.
PDFs saved incrementally keep the earlier version inside the same file. Recovering it lets you compare the before and after directly — a wage figure or an employer name that was different in the previous revision is decisive evidence, not an inference.
A convincing W-2 can still name a company that doesn’t check out — a defunct entity, a mismatched EIN, or an address that isn’t a real place of business. That verification happens off the document itself, against the entity it names.
A constructed example — not a real customer file — showing the kind of finding Docurensic surfaces.
Box 1 is set in a different embedded font from every other figure on the form and sits in its own appended revision. The recovered earlier revision carries $24,800.00 in the same position.
Forensics · font + revision · strongBox 3 (Social Security wages) still reads $24,800.00 — a $100,000 gap against Box 1 that no stated deduction explains.
Validation · arithmetic · definitiveA fake W-2 is not a bad photocopy. It is the real form with one or two boxes changed, which means everything a reviewer actually looks at — the IRS boilerplate language, the layout, the employer’s logo if there is one — is genuine, because none of it was touched. A reviewer is being asked to catch the one wrong number among a dozen correct ones, from a form they see for ten seconds.
The evidence that settles it isn’t on the page. It’s in the file: which software produced it, whether the boxes reconcile with each other, how many times it was saved, and whether an earlier revision is still recoverable inside the same document. Docurensic reads that layer, checks the arithmetic between the boxes, and reports what changed and where.
Five layers, one verdict. Every document runs through security, forensics, reasoning, validation, and external lookups — see how the engine works.
Often, yes — and specifically. If the file was saved incrementally, the earlier revision is still inside it and can be recovered and compared, which shows exactly which box changed. Failing that, mismatched fonts on a single box, wages that don't reconcile across Boxes 1/3/5, and metadata naming a consumer PDF editor are strong indicators the form was altered after it was issued.
Rasterizing a W-2 destroys the text layer and the revision history — which is exactly why an edit is sometimes hidden this way. That's itself a finding, because payroll software issues a digitally generated PDF. The checks then move to the pixels: a genuine scan or photo carries sensor noise, while a fabricated one is typically noiseless and flat.
No. Docurensic is a forensic analysis of the document you were given — it establishes whether that file was altered after it was created, not whether the employer or the income exists. It pairs well with direct employer verification or a Form 4506-C income transcript, which answer the other half of the question.
Seconds for a typical W-2. You upload the PDF and get a plain-English verdict with each finding located on the box it appears in, so a reviewer can see the evidence rather than take the score on trust.
Other document types
Bank statements · Pay stubs & payslips · Invoices · Utility bills · IDs & driver’s licenses · Lease agreements · Diplomas & certificates · All document fraud detection
Free to start. No install, no sales call.