Fake Employment Contract Detection Lending Fraud Guide

A fake employment contract is a fabricated, altered, or AI-generated offer letter or verification-of-employment (VOE) document submitted to a lender to misrepresent an applicant's job status, tenure, or income stability. Unlike a pay stub, which mainly evidences pay, an employment document proves the type of employment — full-time versus contract, probationary versus confirmed — which directly affects how a lender weighs ability-to-repay risk. This article covers what makes employment-document fraud distinct from fake payslip detection and fake tax notice fraud, covered elsewhere in this series, and sets out the forensic signals and regulatory obligations specific to this document type in the United States.

This article is provided for informational purposes only and does not constitute legal or regulatory advice. Regulatory references are accurate as of the date of publication.

Why Employment Documents Are Now a Primary Fraud Target

Employment documents are targeted because they let an applicant convert a precarious job into an apparently stable one without needing to falsify a full income history. Cotality (formerly CoreLogic), which publishes the industry-standard Mortgage Application Fraud Risk Index, put the rate at roughly one in every 119 US mortgage applications showing fraud indicators in late 2024, up 7.3% year-over-year by Q1 2025 (Cotality mortgage fraud risk report). Income and employment misrepresentation is the largest single category in that index, and Fannie Mae's own loan-review findings show income-related fraud accounting for more than half of confirmed cases (reported in Mortgage Professional America).

A specific and under-reported pattern is job-type misrepresentation: an applicant in a genuine but temporary or 1099 role submits a document altered to read "full-time" — a single word change that shifts a marginal application from decline to approval in many automated underwriting engines. Because the underlying employer and salary are real, this fraud is harder to catch than a wholly fabricated employer, and it rarely appears in pay-stub-only checks since pay stubs do not usually state employment classification.

Three applicant profiles account for most employment-document fraud referred to lenders: those inside a probationary period who remove the clause, those on genuine temporary assignments who change the end date or type, and those with an informal offer who fabricate a formal letter before their actual start date.

How Fraudsters Fabricate Employment Documents

Fabrication ranges from a copy-paste edit of a real document to a fully AI-generated contract. Four techniques dominate cases referred to US lenders in 2026.

Template and word-processor editing of a genuine document. The applicant opens their real offer letter in a PDF editor and changes specific fields — employment type, end date, job title, salary band — leaving surrounding text and letterhead untouched. This is the most common method: it requires no technical skill and preserves an otherwise-authentic structure, defeating visual review.

Full AI generation with cloned employer branding. Generative tools can reproduce a named employer's letterhead, logo and HR signature block from public job postings, producing a document for a relationship that does not exist. These are internally consistent but fail on external cross-checks.

Fabricated or borrowed business registration details. Employment documents reference a company name and sometimes a state registration or EIN, checkable against a state's Secretary of State registry. Fraud rings invent an identifier, transpose digits from a real one, or copy the details of an unrelated dormant entity.

Forged or scanned-and-pasted signatures. Genuine e-signed documents (DocuSign, Adobe Sign) embed a certificate and audit trail; a forged document typically shows a signature image with different compression or resolution from the surrounding text — evidence it was pasted in rather than applied by the signing platform.

Forensic Signals That Expose a Fake Contract

The signals that separate genuine from fabricated employment documents fall into four categories: structural, cross-referential, cross-document, and behavioural.

Cross-validating the employment document against the applicant's pay stubs and bank deposits is the strongest counter-measure, because a fabricated contract describing a full-time role at $95,000 cannot be reconciled with three months of bank credits consistent with a lower, irregular contract wage. This is the same principle underlying AI document fraud detection techniques applied across pay stubs, bank statements and tax documents — no single document is assessed in isolation. A bare registry existence check is not sufficient alone, since fraudsters increasingly borrow the details of a real, active company in an unrelated industry.

What Borrowers and Loan Officers Ask on Finance Forums

On forums such as Reddit's r/FirstTimeHomeBuyer and Bogleheads, three recurring questions expose both borrower misunderstanding and a verification gap lenders have to close.

On threads about editing an offer letter to "qualify for more," posters have asked whether changing a document to show full-time status would realistically be noticed by an underwriter — with other members correctly noting this is federal bank fraud regardless of whether the underlying job and salary are genuine.

Applicants have separately asked why a lender requests a full offer letter in addition to pay stubs, when the pay stubs alone appear to demonstrate income. The answer is regulatory: since the post-2008-crisis ban on "stated income" loans, Regulation Z's Ability-to-Repay/Qualified Mortgage rule (12 CFR 1026.43) and its Appendix Q require creditors to verify income and employment using independent documentation (CFPB ATR/QM rule; Appendix Q).

A third recurring question, from small-business owners, asks whether a contract with their own LLC or S-corp satisfies employment evidence requirements. It generally does not: lenders treat majority-owner business income as self-employment, requiring signed tax returns, IRS transcripts via Form 4506-C, or CPA statements instead, since a self-issued contract is not independent of the applicant.

Regulatory Obligations for US Lenders

US consumer and mortgage lenders operate under overlapping federal and state duties requiring employment evidence to be independently verified, not merely collected.

A lender that extends credit on an employment document never independently checked against a state registry, metadata forensics, or cross-document consistency is exposed to supervisory criticism under the CFPB's UDAAP authority and, for mortgages, a direct violation of the Reg Z prohibition on stated-income underwriting. Findings of inadequate verification can lead to repurchase demands, civil penalties, and enforcement action. State regulators layer additional requirements on top: a loan originator licensed under a state's SAFE Act implementation, tracked through the Nationwide Multistate Licensing System (NMLS), can face license suspension for knowingly processing a fabricated document, independent of any federal charge.

Data privacy also differs from jurisdictions with a single national law: there is no US-wide data-protection regime. Lenders instead navigate state statutes — notably California's CCPA/CPRA — layered on the sector-specific Gramm-Leach-Bliley Act safeguards rule.

Multi-Layer Detection in Practice

A layered protocol lets underwriting teams check every employment document without extending processing times: OCR extraction of employer name, type, dates and salary; a live state registry lookup; metadata and signature forensics; font and layout checks around commonly-edited fields; and cross-document reconciliation against pay stubs and bank deposits.

AI-generation signal detection functions as a complement to existing structural controls — metadata forensics, registry lookups, arithmetic and cross-document checks — rather than a replacement for them. According to the ACFE 2024 Report to the Nations, manual review identifies only 37% of document fraud, with an average detection delay of 87 days — a gap that often means funds have already been advanced before the fabrication is found.

CheckFile applies this layered approach across employment contracts, pay stubs and supporting income documents for lending and KYC teams. For consumer credit and asset finance workflows, see financing and leasing document verification; for retail banking onboarding, see banking KYC verification. Deployment options are covered in the document security overview, and current packages are listed on the pricing page.

Criminal Penalties for Fabricated Employment Documents

Submitting a fabricated employment contract to obtain credit exposes the applicant, and anyone who helped produce it, to serious federal criminal liability. Bank fraud under 18 USC §1344 carries up to 30 years' imprisonment and a $1,000,000 fine; wire fraud under 18 USC §1343 carries up to 20 years, rising to 30 where a financial institution is affected; and a knowingly false statement to a lender under 18 USC §1014 also carries up to 30 years. Most states separately criminalize forgery and mortgage fraud. A discovered fabrication typically leads to withdrawal of the credit offer, referral to the FBI (and, for FHA loans, HUD's Office of Inspector General), an entry in specialty mortgage-fraud reporting databases, and, for existing lending, acceleration of the facility.

For a broader view of document verification obligations across regulated sectors, see our industry document verification guide. For how AI-generation signals apply to forged and synthetic documents specifically, our deepfake and AI document detection page sets out how this complements — rather than replaces — existing manual and structural checks.

Frequently Asked Questions

Can a genuine employer's letterhead be used on a fake contract?

Yes. Fraudsters commonly copy a real employer's logo and HR signature block from a job posting onto a fabricated document for a role the applicant does not hold. A state registry check confirms the company exists, but only cross-document validation against pay stubs and bank deposits reliably exposes that no genuine employment relationship supports the figures claimed.

Is changing "contract" to "full-time" on a real offer letter still fraud?

Yes. Even where the employer, salary and role are genuine, altering the stated employment type to misrepresent job security is fraud under 18 USC §1014 and, once credit is obtained, 18 USC §1344. The underlying employment being real does not remove criminal liability for the alteration.

Why do lenders ask for an offer letter as well as pay stubs and bank statements?

A pay stub evidences pay but not the type or security of employment. Regulation Z's Ability-to-Repay/Qualified Mortgage rule and Appendix Q prohibit mortgage lenders from relying on stated income, making an independently-verified employment document part of a compliant income evidence file.

What should a lender do if a submitted employment document is suspected to be forged?

Preserve the document and its metadata, decline or pause the application, and record the suspicion through internal fraud reporting. Where the lender is covered by FinCEN's rules, a Suspicious Activity Report must generally be filed within 30 days, and suspected fraud should also be reported to the FBI and, for FHA-insured loans, HUD's Office of Inspector General.