TriNet is a professional employer organization: small and mid-sized companies contract with it to run payroll, benefits, and HR under a co-employment arrangement. The consequence that trips up reviewers is right on the stub—TriNet, or a TriNet entity, commonly appears as the employer of record, while the company the applicant actually works for shows up as the worksite or client employer, sometimes less prominently. An applicant who says they work at a twelve-person startup and hands over a stub headed by TriNet is describing a completely ordinary PEO arrangement, not a contradiction. Rejecting such stubs as mismatched is one of the most common unforced errors in income verification.
The usual cautions still bind. A stub with a flawless PEO layout is not proven genuine—the co-employment format is publicly visible and imitable, and a careful fabricator can copy it, so material decisions still warrant escalation to verification through the employment relationship itself. And a confusing stub is not proven fraudulent: PEO arrangements begin and end mid-year, worksite companies rebrand, and employees rarely understand their own co-employment paperwork well enough to explain it crisply. The checks below combine the standard payroll arithmetic with the handful of questions specific to reading a TriNet stub correctly.
A polished pay stub is not proof of authenticity. Unusual metadata is not proof of fraud. Every signal here is a reason to ask a better question—never a verdict.
What a genuine TriNet pay stub typically contains
TriNet's stub formats vary over time and with client setup, so treat these as commonly observed traits of genuine stubs under a PEO arrangement, not fixed rules. The distinctive feature is dual identity—TriNet as employer of record beside the worksite company—wrapped around the same interlocking payroll math every real stub must obey:
- TriNet or a TriNet entity is typically identified as the employer of record, with the worksite or client company named as well—often in a secondary position that surprises reviewers seeing a PEO stub for the first time.
- A pay-period date range and a separate pay date are explicit, recurring on a stable cadence—biweekly and semimonthly being common across TriNet's client base.
- Hourly earnings rows carry rate, hours, and an amount equal to their product, with overtime and supplemental pay itemized on their own labeled rows.
- Withholdings are itemized—federal income tax, Social Security, Medicare, and applicable state or local lines—reflecting the worksite employee's actual tax jurisdictions, separate from benefit deductions.
- Current-period figures pair with year-to-date columns across earnings, taxes, and deductions, and the YTD side accumulates consistently with the pay date's place in the year.
- Net pay is explicit and equals gross minus all itemized taxes and deductions, commonly near a check or advice reference and a masked deposit indication.
- Stubs pulled from TriNet's employee self-service are typically text-layer PDFs; a flat-image file indicates capture or reconstruction and shifts weight toward verification through the employment relationship.
Field-level checks anyone can run
1. Request the self-service original
Ask the applicant to download the stub from TriNet's employee portal or app and send that exact file. The first-generation PDF preserves the text layer and metadata most checks rely on, unlike screenshots or rescans. Never ask for the applicant's TriNet credentials.
2. Fingerprint the document at intake
Compute a SHA-256 hash on receipt and file it with your notes, binding your review to one specific document. Ocolta's free scanner performs the hashing locally in your browser as part of its scan.
3. Identify both employers before judging anything
Locate TriNet as employer of record and the worksite company's name before applying any other test. A stub naming only TriNet with the claimed employer nowhere at all is worth a question—but the dual-name PEO structure itself is expected, not anomalous.
4. Reconcile gross to net
Add the earnings rows into gross, subtract each tax and deduction line, and require exact agreement with the printed net. Co-employment changes who administers payroll, not how its arithmetic works—the equation must balance on a TriNet stub as on any other.
5. Multiply out the earnings lines
Each hourly row's rate times hours must equal its amount, with overtime bearing a coherent premium. Salaried rows should hold steady period to period absent a documented change. A failed multiplication gives you the precise figure to raise with the applicant.
6. Chain the year-to-date columns
Across consecutive stubs, each YTD value must equal the prior stub's YTD plus the current amount, and YTD can never fall mid-year. Note that a company joining TriNet mid-year can legitimately reset how accumulations are presented—ask about the transition rather than assuming manipulation.
7. Check withholding plausibility
Social Security withholding commonly equals 6.2% of Social Security taxable wages up to the annual wage base, Medicare 1.45%. Pre-tax benefit deductions—common under TriNet-administered benefits—reduce taxable bases below gross, so compute from the taxable figures shown on the stub itself.
8. Confirm cadence and bank alignment
Pay dates should recur on the claimed schedule, and deposits on any accompanying bank statement should match the stubs' net amounts and dates. Note the depositor name on the statement may reference TriNet rather than the worksite company—another PEO trait that is expected, not suspicious.
9. Follow the payment reference sequence
Check or advice numbers on sequential TriNet stubs should progress consistently for the same employee. Duplicated references across pay dates or sequences that reverse are specific, documentable anomalies to include in an escalation request.
10. Examine critical figures under zoom
At 400%, look for baseline drift, font substitution, or alignment breaks in net pay, gross, and YTD totals. Machine-generated numerals are uniform across a genuine stub; a retouched digit usually differs subtly from its neighbors in weight or position.
11. Vet identities and metadata together
The worksite company should match the application, an EIN if printed should fit the XX-XXXXXXX format, and the PDF's creator, producer, and revision history should be consistent with a fresh portal download. Anomalies in any of these justify requesting the original—none of them alone establishes fraud.
12. Question improbable round numbers
Percentage taxes and benefit prorations leave odd cents all over genuine payroll. A TriNet-attributed stub where gross, every withholding line, and net are whole dollars resembles template output more than processed co-employment payroll, and it warrants corroborating documents.
What Ocolta’s free scan checks automatically
Several of the checks above are mechanical, and mechanical work belongs to software. Ocolta’s free Integrity Scan runs entirely in your browser—the file never leaves your device—and reports the supported signals it can actually observe: whether the declared file type matches its binary signature, which software the PDF says created and produced it, creation and modification timestamps, incremental revision pointers, embedded scripts or attachments, and a SHA-256 fingerprint of the exact file you reviewed. For paystubs it also recomputes the core arithmetic—gross pay minus deductions against net pay—and explains benign causes to consider for each observation. The PDF tamper checker runs the structural subset on any PDF. Every result keeps “unable to determine” on the table; the scan never claims a pay stub is authentic or fraudulent.
When to escalate beyond file review
Escalate material decisions with the PEO relationship in mind: employment exists at the worksite company while payroll runs through TriNet, so verification may involve both. Use an authorized employment-verification service, or place documented calls using contact details you obtained independently—the worksite employer's published number, or TriNet's public verification channel—never a number printed on the stub. Expect the worksite manager to confirm the role and the PEO records to confirm pay. Apply one written policy uniformly, and obtain legal review before any adverse action rests on document findings.
When the file itself deserves a deeper look before you escalate externally, Ocolta’s AI Deep Review ($5 per document, no subscription) asks a model to organize fraud-risk and AI-generation indicators—evidence locations, confidence, benign explanations, limitations, and next checks. It reports observations, not verdicts, and it can return “unable to determine.” See pricing for 5-review and 25-review packs.
Frequently asked questions
Why does the stub say TriNet instead of the employer?
Because TriNet is a professional employer organization: it serves as employer of record for payroll, benefits, and tax purposes while the applicant performs work for the worksite company. Genuine stubs therefore commonly lead with TriNet and name the worksite employer secondarily. The apparent mismatch is the arrangement working as designed, not a discrepancy.
Can Ocolta tell me whether a TriNet stub is fake?
No tool can. Ocolta's free scan runs locally in your browser, checking structure, metadata, revision history, and the stub's math—net reconciliation, earnings multiplication, YTD chaining—and reports supported observations with an explicit unable-to-determine outcome. It never rules a document genuine or fraudulent, and it does not contact TriNet or the worksite employer.
What should I check first on a TriNet stub?
After confirming both employer identities are present, run the recomputation: gross minus every itemized tax and deduction must equal net, and YTD columns must exceed current amounts in proportion to the pay date's month. That arithmetic is objective and fast, and it fails loudly on careless fabrications.
Is odd metadata or an unfamiliar layout proof a TriNet stub is fake?
No. PEO stubs already look unfamiliar to many reviewers, formats change over time, and printing, rescanning, and merging rewrite metadata on genuine documents. Both signals justify exactly one response—requesting a fresh self-service download and, for material decisions, verifying through the employment relationship—never an accusation by themselves.
Do not tell an applicant that a document is “fake” based on file review alone. State the observation, request the same follow-up your written policy requires in comparable cases, apply consistent criteria to every applicant, and preserve an unable-to-determine outcome. Obtain legal review before using document findings in an adverse decision.