Paychex sits alongside ADP as one of the payroll names reviewers encounter most, particularly from small and mid-sized employers and from businesses using Paychex's PEO arrangements. Genuine output varies: some stubs carry visible Paychex branding, others foreground the client employer with only structural hints of the processor, and PEO arrangements can add co-employment language that surprises reviewers who have not seen it before. Because the visual surface is so variable, the reliable verification target is the machinery underneath—earnings rows built from rate and hours, itemized statutory withholdings, paired current and year-to-date columns, and a net figure that the rest of the stub actually produces.
Hold two principles simultaneously. A stub that passes every check here can still be forged, because a careful fabricator can make a single document internally consistent; that is why leases, loans, and offers justify escalation to source verification. And a stub that stumbles on a check is not thereby fraudulent: employers configure Paychex output differently, employees photograph and rescan documents, and mid-year corrections such as voided and reissued checks produce genuine oddities. Every signal below is an invitation to request a stronger document or ask a sharper question—never a conclusion.
A polished pay stub is not proof of authenticity. Unusual metadata is not proof of fraud. Every signal here is a reason to ask a better question—never a verdict.
What a genuine Paychex pay stub typically contains
Paychex formats differ across products, client configurations, and years, so the traits below are commonly observed patterns in genuine stubs, not rules. When a document deviates, the right response is a follow-up question, and the deeper test is always whether the stub's numbers cohere as real payroll output would:
- The client employer's name and address typically anchor the header, with Paychex branding or a recognizable Paychex layout structure appearing on many, though not all, configurations.
- An explicit pay-period range and a separate check or pay date are printed, with the pay date sitting at or shortly after the period's end in a normal cadence.
- Hourly earnings lines carry rate, hours, and a current amount equal to their product, with overtime, holiday, or bonus pay broken out on separately labeled rows.
- Statutory withholdings are itemized—federal income tax, Social Security, Medicare, and state or local lines where applicable—distinct from voluntary deductions like insurance premiums or retirement contributions.
- Earnings, tax, and deduction lines are paired with year-to-date columns, and those YTD amounts grow in proportion to how far the pay date sits into the calendar year.
- Net pay is explicit and equals gross minus all itemized taxes and deductions, frequently alongside a check or voucher number and a deposit indication.
- Portal-downloaded stubs are typically text-layer PDFs with selectable figures; a stub delivered as a flat image forfeits most structural checks and elevates the value of a source-verified original.
Field-level checks anyone can run
1. Get the employee's own portal download
Ask the applicant to retrieve the stub directly from their Paychex employee portal or app and submit that exact file. A first-generation download preserves text layers and metadata that photos, screenshots, and rescans destroy. Do not accept an offer of the applicant's credentials—never log in as them.
2. Record a SHA-256 fingerprint
Hash the file the moment it arrives and store the digest with your notes. If a different version surfaces later, the fingerprint proves which document your review covered. Ocolta's free scanner performs this hashing locally in the browser.
3. Prove the net-pay equation
Sum the earnings rows into gross, subtract every tax line, subtract every deduction line, and require the result to match stated net pay to the cent. Fabrications commonly edit gross or net in isolation and leave the intermediate lines contradicting the headline number.
4. Recalculate each hourly line
Where a Paychex stub shows rate and hours, their product must equal the row's current amount, and any overtime rate should relate sensibly to the base rate. Salaried rows should repeat consistently across periods. A single failed multiplication localizes the edit precisely.
5. Chain year-to-date across stubs
Request two or three consecutive stubs when stakes warrant. Each YTD figure must equal the prior stub's YTD plus the current period's amount, and no YTD value may decline within a year. Even alone, a stub's YTD gross should be roughly proportional to elapsed pay periods.
6. Test statutory withholding rates
Social Security commonly withholds at 6.2% of Social Security wages up to the annual wage base and Medicare at 1.45%. Pre-tax deductions shift taxable bases—retirement deferrals typically reduce income-tax wages but not FICA wages—so compute from the taxable figures the stub itself reports where possible.
7. Confirm cadence and deposit alignment
Pay dates should recur on the schedule the applicant claims—every Friday, every other week, or fixed semimonthly dates. Where a bank statement accompanies the file, its payroll deposits should match the stubs' net amounts and land on or near the printed pay dates.
8. Watch the check-number progression
Across sequential Paychex stubs from one employer, check or voucher numbers should advance consistently. Identical numbers on different pay dates, or a numbering sequence that reverses between periods, are concrete anomalies you can cite when requesting source verification.
9. Magnify the critical figures
Zoom to at least 400% on net pay, gross, and the YTD row. Tampered digits often sit fractionally off the baseline, render in a slightly different weight, or break right-alignment against the rest of the column. Compare against identical digits printed elsewhere on the same stub.
10. Cross-reference employer identity
The employer's name, address, and any EIN must be internally consistent and match the application. An EIN should fit the standard XX-XXXXXXX shape. If the arrangement is a Paychex PEO, co-employment wording can legitimately appear—ask about it rather than penalizing it.
11. Examine document metadata and revisions
Check the PDF's creator and producer fields and its timestamps. Editing-tool signatures or incremental revisions inside a stub presented as an untouched download justify requesting the original from the portal. They do not, on their own, establish that anyone altered anything dishonestly.
12. Treat all-round-number stubs with suspicion
Genuine payroll processed through Paychex accumulates odd cents from percentage-driven taxes and prorated benefits. A stub whose every line is a clean whole-dollar figure is consistent with template output and merits corroborating documents, even though round numbers occasionally occur legitimately.
What Ocolta’s free scan checks automatically
Several of the checks above are mechanical, and mechanical work belongs to software. Ocolta’s free Integrity Scan runs entirely in your browser—the file never leaves your device—and reports the supported signals it can actually observe: whether the declared file type matches its binary signature, which software the PDF says created and produced it, creation and modification timestamps, incremental revision pointers, embedded scripts or attachments, and a SHA-256 fingerprint of the exact file you reviewed. For paystubs it also recomputes the core arithmetic—gross pay minus deductions against net pay—and explains benign causes to consider for each observation. The PDF tamper checker runs the structural subset on any PDF. Every result keeps “unable to determine” on the table; the scan never claims a pay stub is authentic or fraudulent.
When to escalate beyond file review
When the decision is material and any doubt survives file review, escalate: use an authorized employment- and income-verification service, or place a documented verification call to the employer using a number you sourced independently through directories or the company's own site—never one printed on the stub. If a PEO relationship is claimed, expect verification to involve the arrangement's records rather than only the worksite manager. Apply one written policy and identical criteria to all applicants, and secure legal review before findings drive an adverse action.
When the file itself deserves a deeper look before you escalate externally, Ocolta’s AI Deep Review ($5 per document, no subscription) asks a model to organize fraud-risk and AI-generation indicators—evidence locations, confidence, benign explanations, limitations, and next checks. It reports observations, not verdicts, and it can return “unable to determine.” See pricing for 5-review and 25-review packs.
Frequently asked questions
Can Ocolta tell me whether a Paychex stub is fake?
No tool can decide that. Ocolta's free scan runs in your browser and checks structure, metadata, revision history, and payroll arithmetic—net reconciliation, rate-times-hours, YTD chaining—then reports what it observed, including an explicit unable-to-determine result. It never labels a stub genuine or fraudulent and never contacts Paychex or the employer.
What is the quickest first check on a Paychex stub?
Recompute the net: gross earnings minus every itemized tax and deduction must equal the printed net pay, and each YTD column should exceed its current column by an amount plausible for the pay date's month. This objective arithmetic catches more careless fabrications than any amount of layout scrutiny.
Is strange metadata proof a Paychex stub was altered?
No. Printing to PDF, rescanning, page merging, and document-management stamps all rewrite metadata on perfectly genuine stubs. Anomalous creator fields or late modification dates are grounds to ask the employee for a fresh portal download—not grounds to accuse anyone of forgery.
The employer is a tiny business—why does the stub mention Paychex?
That is normal. Paychex's core market includes very small employers who outsource payroll precisely because they lack in-house capability, so processor branding beneath a small company's header is expected. In Paychex PEO arrangements, co-employment language may also appear legitimately. Neither trait signals fraud; judge the stub's internal math instead.
Do not tell an applicant that a document is “fake” based on file review alone. State the observation, request the same follow-up your written policy requires in comparable cases, apply consistent criteria to every applicant, and preserve an unable-to-determine outcome. Obtain legal review before using document findings in an adverse decision.