Workday payslips come from large and mid-sized employers whose employees self-serve documents from the company's own Workday tenant. Critically, the payslip layout is employer-configured: section order, labels, branding, and even which columns appear vary from company to company and change when employers update their configurations. That makes Workday uniquely resistant to template-matching—a reviewer who rejects a payslip because it “doesn't look like Workday” is making an error, and a reviewer who accepts one because it looks polished is making the opposite error. The checks that survive this variability are structural: earnings math, statutory withholding plausibility, year-to-date accumulation, and the file's consistency with a self-service download.
Two cautions apply with particular force here. First, enterprise polish is cheap to imitate, so a crisp, corporate-looking payslip is not evidence of authenticity; material decisions should escalate to employment verification rather than rest on appearance. Second, genuine Workday payslips can look unfamiliar, dense, or sparse depending on the employer's configuration, and employees frequently submit browser-printed or phone-photographed copies that mangle formatting further. An odd-looking payslip earns a follow-up request for a cleaner original—it does not earn a fraud conclusion. Everything below is designed to work without assuming any particular Workday layout.
A polished pay stub is not proof of authenticity. Unusual metadata is not proof of fraud. Every signal here is a reason to ask a better question—never a verdict.
What a genuine Workday pay stub typically contains
Because each employer configures its own Workday payslip, hedge every layout expectation: these are traits commonly observed across many tenants, and legitimate deviations are routine. Anchor your review in the properties real payroll cannot escape—internally consistent arithmetic and identifiers—rather than in any remembered Workday appearance:
- The payslip typically leads with the employer's name and often the employer's own branding rather than Workday's; visible Workday marks are frequently absent from genuine output.
- A pay-period date range and a separate payment date appear explicitly, with cadence—commonly biweekly or semimonthly at Workday-scale employers—consistent from slip to slip.
- Earnings are tabulated by type; hourly lines commonly expose rate and hours whose product matches the line amount, while salaried lines show a stable period amount.
- Tax lines are itemized—federal income tax, Social Security (sometimes labeled OASDI), Medicare, and applicable state or local withholdings—separate from benefit and retirement deductions.
- Current-period and year-to-date pairs run through earnings, taxes, and deductions, and many configurations also state taxable-wage bases that make withholding math directly checkable.
- Net pay is explicit, equals gross minus all itemized taxes and deductions, and is often accompanied by payment-election details such as a masked account reference.
- A payslip exported from Workday self-service is typically a text-layer PDF; an image-only file signals a print, photo, or reconstruction and shifts weight toward source verification.
Field-level checks anyone can run
1. Ask for the self-service export
The best artifact is the PDF the employee downloads from their employer's Workday tenant and sends unmodified. Screenshots of the payslip screen and browser prints lose structure. If the applicant can only screenshot, note that limitation and lean harder on escalation. Never solicit their Workday credentials.
2. Fingerprint before you inspect
Generate a SHA-256 hash of the received file first, so the exact document behind your decision is provable later. Ocolta's free scanner computes the hash locally without uploading the payslip.
3. Rebuild net pay from the slip itself
Whatever the employer's Workday configuration shows, gross earnings minus every itemized tax and deduction must equal net pay exactly. Perform the subtraction on paper. Layout variety gives forgers cover; arithmetic gives them none.
4. Check rate-times-hours where exposed
When the configuration prints rate and hours, multiply them and compare against the line amount, and check that overtime lines carry a premium consistent with the base rate. If the layout hides rates entirely, that is a configuration choice, not a red flag—shift weight to other checks.
5. Audit YTD continuity
Across consecutive payslips, each year-to-date value must equal the prior slip's YTD plus the current amount, and YTD may never move backward mid-year. On a lone slip, compare YTD gross with the number of pay periods elapsed by the payment date for basic plausibility.
6. Test withholding against stated wage bases
Many Workday configurations print taxable-wage figures, making this concrete: Social Security or OASDI withholding commonly equals 6.2% of the Social Security wage base shown, capped annually, and Medicare 1.45%. Pre-tax benefits legitimately shrink those bases below gross, so compute from the slip's own numbers.
7. Confirm cadence and deposit correspondence
Payment dates should recur on a stable schedule, and semimonthly employers commonly pay on fixed calendar days. Cross-check against bank statements in the file: deposit dates and net amounts should line up with the payslips, allowing for weekends and holidays shifting dates slightly.
8. Follow document or payment references
Where the configuration includes a check number, payment ID, or document reference, sequential payslips should show sensible progression rather than duplicates or reversals. Absent references are common in direct-deposit configurations and prove nothing either way.
9. Zoom in on high-value figures
At 400% magnification, inspect net pay, gross, and YTD totals for baseline drift, font substitution, or alignment breaks against the column. Enterprise payslips are machine-set with high consistency, so a genuinely anomalous digit stands out under zoom more than it would on a noisier document.
10. Match employer identity to the application
The employer name on the payslip should match the application, offer letter, and the entity the applicant names verbally—large companies pay through specific legal entities, so modest naming differences can be legitimate but deserve one clarifying question. Any printed EIN should follow the standard nine-digit format.
11. Read creator, producer, and revision metadata
A payslip presented as a fresh Workday export whose PDF metadata names a general-purpose editor, or which contains incremental revisions layered after creation, warrants requesting a new self-service download. Browser print-to-PDF also produces unusual metadata legitimately, so ask before you conclude.
12. Question suspicious roundness
Real enterprise payroll—percentage taxes, prorated benefits, imputed income—almost always yields odd cents on multiple lines. A payslip where gross, every withholding, and net are whole dollars fits generic fabrication patterns better than Workday-processed payroll and justifies corroboration.
What Ocolta’s free scan checks automatically
Several of the checks above are mechanical, and mechanical work belongs to software. Ocolta’s free Integrity Scan runs entirely in your browser—the file never leaves your device—and reports the supported signals it can actually observe: whether the declared file type matches its binary signature, which software the PDF says created and produced it, creation and modification timestamps, incremental revision pointers, embedded scripts or attachments, and a SHA-256 fingerprint of the exact file you reviewed. For paystubs it also recomputes the core arithmetic—gross pay minus deductions against net pay—and explains benign causes to consider for each observation. The PDF tamper checker runs the structural subset on any PDF. Every result keeps “unable to determine” on the table; the scan never claims a pay stub is authentic or fraudulent.
When to escalate beyond file review
For material decisions, do not stop at file review. Verify employment and income through an authorized verification service, or make a documented call to the employer's HR or payroll function using contact information obtained independently—the company's published main line or verified HR channel, never a number on the payslip. Large Workday-using employers often route such requests through a designated verification process; use it. Keep a written policy, apply uniform criteria to every applicant, document each step, and obtain legal review before an adverse action rests on document findings.
When the file itself deserves a deeper look before you escalate externally, Ocolta’s AI Deep Review ($5 per document, no subscription) asks a model to organize fraud-risk and AI-generation indicators—evidence locations, confidence, benign explanations, limitations, and next checks. It reports observations, not verdicts, and it can return “unable to determine.” See pricing for 5-review and 25-review packs.
Frequently asked questions
Can Ocolta tell me whether a Workday payslip is fake?
No tool can. Ocolta's free scan runs locally and examines structure, metadata, revision history, and the slip's arithmetic—net reconciliation, withholding plausibility, YTD continuity—reporting supported observations and an explicit unable-to-determine outcome where evidence is thin. It never certifies authenticity or alleges fraud, and it does not contact Workday or the employer.
What is the fastest first check on a Workday payslip?
Recompute net pay—gross minus every itemized tax and deduction must equal the stated net—then confirm each YTD figure exceeds its current-period figure by an amount plausible for the payment date. These checks hold across every employer configuration, take minutes, and fail loudly on careless fabrications.
This payslip looks nothing like other Workday payslips I've seen. Is it fake?
Not on that basis. Each employer configures its own payslip inside its own Workday tenant, so genuine slips differ substantially in layout, labels, and branding, and change when configurations are updated. Unfamiliar appearance alone justifies nothing; test the arithmetic and, if doubts remain, verify employment through independent channels.
Does clean metadata prove a Workday payslip is genuine?
No—metadata can be curated by a determined forger, and conversely genuine slips acquire messy metadata through browser printing and file merging. Treat metadata as one input that can trigger a request for a fresh self-service export, never as proof in either direction. Provenance and employment verification carry the real weight.
Do not tell an applicant that a document is “fake” based on file review alone. State the observation, request the same follow-up your written policy requires in comparable cases, apply consistent criteria to every applicant, and preserve an unable-to-determine outcome. Obtain legal review before using document findings in an adverse decision.