How a Fabricated Rental Application Fell Apart Under Forensics

A landlord came to us uneasy about a prospective tenant. On paper the application was excellent: a steady employer, an employment letter, pay stubs with correct tax math, a credit report, and a comfortable six-figure salary. The keys were nearly handed over. But something small did not sit right, and that instinct turned out to be worth a great deal.

This is a real case, anonymized and shared with permission, with every identifying detail removed. It is a good illustration of what document forensics actually looks at, and why a polished application is not the same as a genuine one. To be clear up front: forensics reports technical indicators and likelihood, not proof, and never a verdict on a person. What it did here was turn a vague bad feeling into a clear, evidence-backed decision.

The application that looked perfect

Strong rental applications share a certain look. This one had it. The income was well above what the unit needed, the tax deductions on the pay stubs matched the public rates, the employment letter was on letterhead, and the credit report showed a real history. An automated check of the math would have passed it without complaint.

The first thing that gave the landlord pause was mundane: the supporting documents were months old by the time move-in approached. When they asked for current pay stubs, fresh ones appeared quickly. That is not suspicious on its own. Plenty of honest applicants send whatever they have on hand. But it is the kind of detail worth noticing, and it is exactly where a closer look begins.

The first crack: a payment under a different name

The clearest early signal had nothing to do with the paperwork's contents. A deposit arrived by e-transfer, and the name on the payment did not match the applicant at all. A payment coming from a third party, under a different name than the person on the lease, is one of the most reliable warning signs there is. It is simple, it is hard to explain away innocently in this context, and it does not require any forensic tooling to spot.

That was enough for the landlord to ask us to look properly before anything else changed hands.

What the documents actually showed

We ran a full document-forensics review of the set: the employment letter, the pay stubs, the credit report, and the employer and people named across them. Every document was internally consistent. The problem was that each one, examined on its own terms, did not hold up.

• The employer had almost no real footprint. The company named as the applicant's employer had a website, but the domain had been registered only months earlier and served a thin, unrelated template. There was no independently verifiable business behind it. More telling, the phone number given for employment verification was the same number the applicant had listed as their own.
• The credit report had been assembled, not delivered. Its own file data indicated it had been exported from a phone rather than downloaded through the bureau's normal delivery path, carried mismatched internal totals, and showed signs of having been stitched together from more than one source. A real report from the bureau does not look like that.
• The pay stubs were built in batches. The newer stubs shared a template creation date years older than the pay periods they claimed, and their own file timestamps showed they had been created within minutes of each other on the morning they were requested. The on-page math was clean. That is the point worth sitting with: clean math is not authenticity. A competent fake gets the arithmetic right.
• The stated income could not be verified. With no genuine employer to confirm it and synthetic stubs to support it, the six-figure salary could not be substantiated. No income figure, high or low, could be established from the documents.
• More than one name ran through the file. Across the application, the payment, and other paperwork, several different names attached to what appeared to be one person. That pattern points toward an assumed or layered identity, which usually means there is a real victim somewhere whose details are being used.

Each of these is an indicator, not a conviction. Taken together, they told a coherent story, and it was not the one the application told.

The tell that automation misses

A free metadata scanner, including our own BadgerForensics tool, might well have flagged the edited PDFs. That is genuinely useful, and it is a good first step. But the metadata was not what settled this.

What settled it was the connective work a person does: noticing that the employer's domain was days old rather than established, that the verification phone was the applicant's own number, that the payment name matched none of the identities in the file, and that the pieces only made sense as a single fabricated set. Those are judgments about how the parts relate to each other, not a single field in a file. That depth is the difference between a scan and an assessment.

How it ended

We delivered a graded findings report the landlord could actually act on, with each finding tied to the specific file behind it. With a documented, evidence-backed report in hand, they and their agent cancelled the agreement, and the other side agreed to walk away. The result: no deposit or rent lost, no keys surrendered long term, and none of the multi-month Landlord and Tenant Board eviction that a fraudulent tenant already in possession usually means. A stressful, ambiguous situation became a clear decision in a matter of hours, and a property was kept from becoming an address used for ongoing identity fraud.

This is an account of one engagement, not a promise of the same outcome or turnaround. Every file is different, and a clean report is a real and common result too.

What landlords and realtors can take from this

You do not need to be a forensic analyst to catch a lot of this. A few patterns are worth pausing on whenever you screen an applicant:

• A payment that arrives under a different name than the applicant.
• Supporting documents that are weeks or months old by move-in.
• An employer you cannot independently verify, with little or no established web or registry presence.
• An employment verification number that matches the applicant's own.
• An e-transfer standing in for the certified funds the deal called for.
• Clean-looking math, which proves nothing on its own. Where a document came from matters more than whether it adds up.

We keep a fuller, printable version of these in our rental red-flags guide, written for people who screen applications regularly.

Where forensics fits

Document forensics is one input, and an honest one about its own limits. It reports technical indicators and a likelihood, not proof. Metadata can be stripped, so a clean read is never a guarantee, and a report is never a statement that a person committed fraud. It is also not legal advice: for a tenancy decision, a dispute, or anything before the Landlord and Tenant Board, that is a conversation for a qualified lawyer or paralegal, and any rental decision has to follow the Ontario Human Rights Code.

What a careful assessment does give you is a clear, referenced picture of how well a document set holds together, so a decision rests on evidence rather than a gut feeling. If you have an application you are unsure about, you can read more about our tenant fraud assessment, or try BadgerForensics for free to look at a single document yourself first.