A W-2 is harder to fake well than almost any other income document — and that's exactly why fraudsters keep trying. The form is a federally-standardised template with a fixed box structure and mathematical relationships that the IRS, SSA, and every major payroll system enforce automatically. A real W-2 produced by an actual payroll system can't have Box 4 mismatched against Box 3, or Box 6 mismatched against Box 5, or a Box 12 code that contradicts the relationship between Box 1 and Box 3. The whole point of the form is that these relationships are deterministic.
AI generators don't always know that. Producing a W-2 that looks correct is now trivial. Producing one whose internal math survives a five-minute review is much harder, because the constraints multiply with every box. This is the structural reason W-2 detection is different from pay stub detection: a pay stub varies in format across thousands of payroll systems, but a W-2 is one form, the IRS publishes its instructions, and the math is the same for every employer in the country.
This guide is the 2026 detection workflow for AI-forged W-2s and the broader tax document category — 1099 forms, 1040 tax returns, and tax transcripts. It assumes you've read our companion piece on AI-generated pay stubs; the visual-tells methodology there carries over, and we won't repeat it here. The focus instead is on what's unique to W-2s and tax documents: the box-by-box diagnostic relationships, the EIN cross-reference that's not available for pay stubs, the IRS verification path through Form 4506-C and the Income Verification Express Service (IVES), and the 2026 form changes from the One Big Beautiful Bill Act that have already created a new class of detection signals.
TL;DR — the highest-yield W-2 checks in 2026
CheckWhat you're looking forWhy it catches AI fakesBox 4 = Box 3 × 6.2%Social Security tax withheld matches Social Security wagesFixed rate; deterministic; AI often gets this wrongBox 6 = Box 5 × 1.45%Medicare tax withheld matches Medicare wagesFixed rate; no cap; deterministicBox 1 vs Box 3 vs Box 5 relationshipsDifferences explained by Box 12 codes (401(k), HSA, etc.)AI struggles to keep these three lines internally consistentEIN validity (Box b)Real 9-digit EIN that traces to the listed employerEIN is publicly cross-referenceable; AI generators often inventIRS Form 4506-C / IVES transcriptWage and income transcript pulled directly from IRS recordsThe single most authoritative check available2026 form revisionBox 14, 9, 14a changes per IRS 2026 W-2 instructionsPre-2026 templates are now obsolete; using one is a tellControl number patternBox d format matches a known payroll provider's schemeMajor payroll providers use characteristic control number formatsIssuer signature / QRCryptographic signature or verifiable QR from issuerForgery-resistant by design
The Box 4 / Box 6 FICA checks alone catch the majority of low-effort AI fakes. The 4506-C / IVES transcript is the gold standard for high-stakes decisions.
Why W-2 fraud is structurally different from pay stub fraud
Three properties of the W-2 form change the detection problem entirely.
The form is standardised. Every W-2 in the United States uses the same box numbering and the same field meanings. There is no "ADP-style W-2" or "Workday-style W-2" the way there is for pay stubs. A reviewer who learns the box relationships once can apply them to every W-2 they ever see. The IRS publishes detailed General Instructions for Forms W-2 and W-3 annually; the 2026 version is the current reference.
The relationships between boxes are deterministic. Pay stubs have variable layouts, optional fields, and employer-specific quirks. W-2s have fixed mathematical relationships that hold for every taxpayer: Box 4 is always 6.2% of Box 3 up to the Social Security wage base; Box 6 is always 1.45% of Box 5; the differences between Box 1, Box 3, and Box 5 are explained by specific Box 12 codes. AI generators producing W-2s have to thread these constraints simultaneously, and they don't always succeed.
There's an external paper trail. Every W-2 issued in the United States is also filed with the Social Security Administration via the SSA's Business Services Online portal. The IRS receives the data and makes it available, with the taxpayer's consent, via Form 4506-C and the Income Verification Express Service (IVES). For pay stubs, no such authoritative external source exists. For W-2s, the IRS itself can confirm or deny what the form says — and lenders use this routinely.
The combined effect: W-2s are easier to fake convincingly at the visual level than pay stubs (because there's only one format to learn), but harder to fake at the structural level (because the math is fixed and the IRS has the real record).
What's new on the 2026 W-2
If a W-2 you're reviewing for tax year 2025 or 2026 doesn't reflect the recent form changes, the form may have been generated from an outdated template. The IRS 2026 General Instructions for Forms W-2 and W-3 document the changes; the highlights:
Public Law 119-21 (the One Big Beautiful Bill Act), enacted 4 July 2025, introduced several W-2 reporting changes:
The wage reporting threshold for cases where no federal income tax, Social Security tax, or Medicare tax was withheld increased from $600 to $2,000, effective for wages paid after calendar year 2025.
New deductions for qualified tips and qualified overtime are reflected in updated reporting.
Employer contributions to Trump accounts (a new tax-advantaged savings vehicle introduced under the legislation) appear as Box 12 codes.
Form-level changes for tax year 2026:
Box 14 has been revised to accommodate the new reporting categories.
Boxes 9 and 14a have been changed to reflect new state Paid Family and Medical Leave (PFML) reporting requirements under Revenue Ruling 2025-4.
Penalties for late or incorrect filing have been increased.
New procedures for requesting extensions of time to furnish recipient copies of Form W-2.
A practical detection consequence: a W-2 generated by an AI tool trained on pre-2025 templates may use the old Box 14 format, omit the new boxes 9 and 14a changes, or show a wage reporting threshold inconsistent with the current rules. None of these is by itself diagnostic — small employers may use older templates, and edge cases exist — but they're worth checking.
Box-by-box: the diagnostic relationships
This is the highest-yield section of the article. The relationships below hold for every legitimate W-2; departures from them are evidence of either a real error (worth questioning) or fabrication.
The FICA boxes (the easiest catches)
Box 4 (Social Security tax withheld) should equal Box 3 (Social Security wages) × 6.2%, capped at the 2026 Social Security wage base of $184,500. Computing this: for a Box 3 value of $80,000, Box 4 should be approximately $4,960.00. For a Box 3 value of $200,000 (above the wage base), Box 4 should be exactly $11,439.00 (6.2% × $184,500).
If Box 4 doesn't match this calculation within rounding, the W-2 is either fabricated or contains a real error that the taxpayer should have already corrected with their employer. There are essentially no legitimate explanations for a mismatch on a properly-issued W-2.
Box 6 (Medicare tax withheld) should equal Box 5 (Medicare wages and tips) × 1.45% with no wage base cap. For higher earners, additional Medicare tax of 0.9% on wages above $200,000 may also appear, but this is typically reflected in additional withholding rather than the base Box 6 calculation.
For Box 5 = $90,000, Box 6 should be $1,305.00. A mismatch here is as diagnostic as a Box 4 mismatch.
These two checks together take about 30 seconds with a calculator. They catch the majority of AI-generated W-2s from generators that didn't carefully implement the FICA arithmetic.
- Box 1 vs Box 3 vs Box 5 (the harder check)
These three "wage" boxes report different concepts:
Box 1 (Wages, tips, other compensation) is the amount subject to federal income tax. Pre-tax deductions like traditional 401(k) contributions, HSA contributions, and certain cafeteria-plan benefits reduce Box 1.
Box 3 (Social Security wages) is the amount subject to Social Security tax. Some pre-tax deductions that reduce Box 1 don't reduce Box 3 — traditional 401(k) contributions are the classic example. HSA contributions and Section 125 cafeteria plan benefits typically reduce both.
Box 5 (Medicare wages and tips) is the amount subject to Medicare tax. Similar rules to Box 3 but with a few specific differences for very high earners and certain compensation types.
The diagnostic check: any difference between these three boxes should be explainable by specific Box 12 codes. The most common patterns:
Box 12 Code D (401(k) elective deferrals): reduces Box 1 but not Box 3 or Box 5. So if Box 12D = $10,000, you should typically see Box 3 ≈ Box 5 ≈ (Box 1 + $10,000).
Box 12 Code W (HSA contributions through cafeteria plan): reduces Box 1, Box 3, and Box 5 equally.
Box 12 Code DD (employer-sponsored health coverage cost): informational only, doesn't affect any wage box.
AI generators that produce W-2s with inconsistent relationships among Box 1, Box 3, Box 5, and Box 12 are common. A W-2 showing Box 1 = $70,000, Box 3 = $70,000, Box 5 = $70,000, and Box 12 Code D = $8,000 is internally inconsistent — the 401(k) contribution should have created a $8,000 gap between Box 1 and Boxes 3/5.
Conversely, a real W-2 from someone with no pre-tax deductions will show Box 1 = Box 3 = Box 5 (up to the SS wage base), and that's also legitimate. The diagnostic isn't that the numbers must differ; it's that any differences must be explained.
Box 2 (Federal income tax withheld) sanity check
Federal income tax withholding varies with filing status, allowances, and additional withholding requests on Form W-4. The exact amount is hard to verify without knowing the taxpayer's W-4. But a rough sanity check: Box 2 as a percentage of Box 1 should typically fall between 8% and 25% for most middle-income employees, with allowances for the new withholding tables introduced under recent tax law.
Numbers materially below 8% (especially with no offsetting Box 12 codes that would reduce taxable wages) or above 25% are worth a closer look. Numbers of exactly $0 with non-zero Box 1 are extremely rare and worth investigating — they imply the employee specifically claimed exemption from withholding, which has narrow legal grounds.
The control number (Box d)
Box d is an optional field most major employers populate with a control number from their payroll system. The formats are characteristic:
ADP typically uses a control number with a specific alphanumeric pattern.
Workday uses control numbers tied to their internal employee ID format.
Paychex, Gusto, Rippling, and other major providers have their own conventions.
A W-2 from an employer who normally uses ADP that has a blank or atypical Box d is worth a second look. Smaller employers may leave Box d blank legitimately, so this isn't conclusive — but a blank Box d combined with other anomalies is a signal.
Box 16, 17 (state wages and tax withheld)
State wage and tax amounts should generally track the federal amounts, adjusted for state-specific pre-tax deduction rules. A W-2 with federal wages of $80,000 and state wages of $40,000 in a state with no notable federal-state difference is suspicious. A W-2 from an employee in a state with no income tax (Florida, Texas, Nevada, etc.) showing state income tax withheld is internally inconsistent.
EIN verification — the unique-to-W-2 cross-reference
The Employer Identification Number in Box b is one of the highest-yield external checks available for W-2 verification.
A valid US EIN follows the format XX-XXXXXXX (two digits, hyphen, seven digits). The first two digits indicate the IRS Service Center that issued the EIN — for example, EINs beginning with 02, 03, 04 were issued by certain offices; 30, 32, 35 by others. The full list of prefixes is published by the IRS and is one quick sanity check: an EIN starting with 88 or 99 doesn't match any current IRS prefix and is almost certainly invented.
Beyond format checks, EINs can be cross-referenced:
For public companies, EDGAR (the SEC's filing system) lists the EIN of every company that has filed with the SEC. Search by company name; the EIN appears in the filing's first few pages.
For non-profits, the IRS Tax Exempt Organization Search shows EINs.
For state-registered businesses, many state corporation databases include EIN or the federal employer reference number.
Specialised business databases (Dun & Bradstreet, ZoomInfo, LexisNexis) carry EIN data for a wide range of US businesses.
A W-2 with an EIN that doesn't match the employer name in any of these sources is a strong signal of fabrication. Conversely, a verified EIN doesn't prove the W-2 is real — only that the listed employer exists — so it's a necessary but not sufficient check.
The IRS verification path: Form 4506-C and IVES
For high-stakes decisions — mortgages, large loans, anything where the cost of being wrong outweighs the cost of one extra verification step — the cleanest verification available is to pull the data directly from the IRS.
The mechanism is Form 4506-C, IVES Request for Transcript of Tax Return. This is the IRS form by which a taxpayer authorises a designated third party (the IVES participant) to receive their tax transcripts. IVES participants are authorised firms — typically a mortgage industry verification service that the lender works with — and the transcripts come back from the IRS through a secure mailbox.
Two transcript types matter for W-2 verification:
Wage and Income Transcript shows the information the IRS has on file from W-2s, 1099s, and other employer-filed informational returns. This is the most direct check on a W-2's authenticity: if the form was real, the IRS has a copy.
Tax Return Transcript shows line items from the taxpayer's filed 1040. This verifies what the taxpayer actually reported, which is useful for cross-checking tax-return-based income claims.
Process highlights:
The taxpayer must sign the 4506-C, authorising the disclosure. Lenders can also request this electronically through the taxpayer's IRS online account, with delivery in near real-time.
A $4 fee applies per transcript.
IVES participants must be IRS-authorised; lenders typically don't request directly but go through an authorised firm.
The transcript reveals what the IRS has on record, which for current-year W-2s requires the employer to have filed (typically by January 31).
A W-2 that doesn't match the IRS wage and income transcript is fabricated, modified, or — rarely — there's been a filing error by the employer that the taxpayer should reconcile. In any case, the discrepancy is a hard stop for underwriting.
The IRS publishes detailed guidance on the IVES program and on how taxpayers authorise transcript requests.
Beyond W-2: the broader tax document category
The detection principles above generalise, with adjustments, to the other tax documents in this category.
Form 1099 (various)
The 1099 family covers payments to non-employees: 1099-NEC (non-employee compensation), 1099-MISC (miscellaneous income), 1099-INT (interest), 1099-DIV (dividends), 1099-K (third-party network payments), and others. AI-generated 1099-NECs are now common because they're the gig-economy equivalent of pay stubs for income verification.
Detection differences from W-2s:
1099-NEC has no built-in tax withholding (unless backup withholding applies), so the FICA-style math checks don't apply.
The payer EIN check is the same as the W-2 employer EIN check.
The 1099 is also reported to the IRS, so the 4506-C wage and income transcript will reflect 1099 data — the same external cross-reference works.
1099-K thresholds changed significantly in recent years; using outdated thresholds (e.g., the old $20,000 / 200 transactions threshold) is a tell.
Form 1040 (income tax return)
A purported "1040 we filed last year" produced by an applicant raises the question of which version: the as-filed return, an amended return, or a copy retained by the taxpayer. The diagnostic checks shift to internal consistency (does the income flow from W-2s/1099s through Schedule items to the bottom line?) and external cross-reference (does it match the IRS transcript?).
The IRS transcript service provides direct verification when the taxpayer can authorise it.
Tax transcripts themselves
Counterintuitively, tax transcripts can also be fabricated — though this is rarer because the format is fixed and recipients often know what a real transcript looks like. The structural defence is that authentic transcripts have specific formatting, watermarks, and Tracking Number (sometimes called the Customer File Number) that can be cross-checked. Transcripts received through the IVES system come directly from the IRS through a secure channel and are inherently trusted because of the delivery path, not because of any feature of the transcript document itself.
State tax documents
State income tax returns, state W-2 equivalents, and state-issued income statements vary widely. The principles transfer — fixed-format diagnostic relationships, external cross-reference to state tax authorities — but the specifics vary by jurisdiction.
The arms race, and the durable answer
Every detection technique in this guide is fighting a moving target. Each year, AI generators get better at producing W-2s with internally consistent box relationships, plausible EINs, and credible employer details. The 2026 detection signals will be partly obsolete by 2027, and the cycle will continue.
The durable answer is the same as for pay stubs and every other document category in this cluster: issuer-side verification. If a W-2 is issued with a cryptographic signature and a QR code linking to a hosted proof page on the employer's payroll provider's domain (ADP, Gusto, Workday, etc.), the recipient verifies in a single scan instead of running through the diagnostic battery above. The math is still right, but you don't have to check it — the signature confirms the document is exactly what the payroll system issued.
This is starting to happen. Major payroll providers are adding verifiable issuance for the documents they produce, beginning with the highest-fraud categories. Our scan-to-verify documents pillar guide covers the full pattern, the cryptographic mechanics are in QR code signature validation, and the certificate-style lifecycle for credentials including W-2s is in QR code certificate verification.
The practical 2026 move for organisations receiving W-2s is two-pronged. For documents that arrive without issuer-side verification, run the detection battery above and use 4506-C / IVES for high-stakes cases. For employers and payroll providers, start issuing verifiably — the request from the recipient side is already there, and the cost of not doing it is showing up as fraud loss in your borrowers' applications.
- Frequently asked questions
Is creating a fake W-2 illegal?
Submitting a fabricated W-2 to a lender, landlord, or employer to obtain a loan, lease, or job constitutes fraud under federal law (18 USC § 1001 for false statements, plus various statute-specific provisions depending on the use). Creating a W-2 with knowledge it will be used fraudulently is itself a crime even before submission. The IRS also imposes civil penalties for fraudulent filing of W-2s under 26 USC § 7434.
Can I tell if a W-2 was generated by ChatGPT specifically?
No tool reliably identifies the specific generative model used. What you can identify is whether the W-2 passes the structural checks in this guide — and that's the right question. The model used to produce the fake is incidental; the diagnostic question is whether the document represents a real payroll event.
How quickly can I get a 4506-C / IVES transcript?
Through the IRS online account authorisation path, transcripts are delivered in near real-time after the taxpayer authorises. Through the traditional fax-based 4506-C process, turnaround is typically days. Lenders running material decisions should use the online path.
What if the employer is small and uses a hand-typed W-2?
A handful of very small employers still produce W-2s manually rather than through a payroll system. These look different from large-employer W-2s — blank Box d, hand-keyed font choices, possibly slightly off-IRS formatting. They can still be legitimate. The math relationships should still hold; the EIN should still be valid; the IRS transcript path still works. Manual W-2s warrant extra scrutiny but aren't by themselves suspicious.
Do AI detection tools catch AI-generated W-2s?
Detection tools catch a meaningful share, particularly W-2s produced by widely-available templates. They miss the more sophisticated and the bespoke. Layered defence — visual + box-relationship math + EIN check + IRS transcript for high-stakes cases — outperforms any single tool. See our companion pay stub article for the broader detection philosophy.
What about international tax documents?
Non-US employer tax documents (P60 in the UK, T4 in Canada, equivalents in other jurisdictions) follow the same principles — fixed format, deterministic math relationships, external cross-reference paths — adapted to local tax authorities. The specific boxes differ, but the methodology transfers.
Are tax transcripts received from the IRS themselves forgeable?
In principle yes; in practice rarely successfully, because the IVES delivery channel itself is the source of trust. A transcript that arrives through your authorised IVES participant's secure mailbox is trusted because of the delivery path. A transcript that arrives as a PDF in an email is not — even if the formatting is correct, the delivery channel doesn't establish provenance.
What's the relationship between a W-2 and an SSA wage record?
Employers file W-2s with the Social Security Administration via SSA's Business Services Online (BSO). The SSA records the wages, which feed into the worker's Social Security earnings record. The IRS receives the data via its data-sharing arrangement with SSA. So the IRS transcript reflects what was filed with SSA — same data, different access path. Workers can independently view their earnings record at ssa.gov/myaccount.
Should I ever accept a W-2 without an IRS transcript for high-stakes underwriting?
For mortgages, large business loans, and similar decisions, most lenders now run 4506-C / IVES as a matter of policy. Skipping it for time pressure is the wrong trade — the marginal cost is $4 and a few minutes against the marginal risk of approving a fabricated income claim worth hundreds of thousands.
VerifyDoc.ai issues HR and payroll documents with verifiable cryptographic signatures and QR codes that recipients can confirm in one scan — no transcripts to pull, no math to check. For the HR-issuance workflow that includes W-2-adjacent documents, see our tamper-proof offer letters playbook.
