Social Media Users Advertise Inauthentic Pay Stub Creation
Across Facebook, Pinterest, TikTok, and Instagram, we identified four accounts and an active, 354-member Facebook group promoting services to create fraudulent pay stubs.
Key Finding
Across Facebook, Pinterest, TikTok, and Instagram, we identified four accounts and an active, 354-member Facebook group promoting services to create fraudulent pay stubs. Posts and comments are soliciting direct messages and contact via Telegram and WhatsApp, sometimes mentioning the U.S., the U.K., Canada, or the United Arab Emirates; creating and using fake pay stubs is illegal in those countries and facilitates financial fraud.
Online Activity
- The Facebook account “documents editing service” recently posted, “hit me for paystubs...bank statement...W2 Dr Notes” and provided a WhatsApp contact number. The Payslips | Paystubs | Document Editor Facebook group predominantly features posts advertising document falsification, many including WhatsApp numbers and explicitly promoting pay stub services. The group has received 211 posts in the past month, and gained 30 new members in the last week.
- On Pinterest, searching for “pay stub editor” surfaced two pins displaying pay stubs. Both attracted comments from an account promoting “document editing” and a WhatsApp phone number.
- On TikTok, "paystubseditor" has posted several videos demonstrating document falsification and promoting inauthentic pay stubs, bank statements, and W-2 tax documents, some boasting over 48k views and with hashtags such as #paystubfixer and #howtoeditpaystubs. Searching for the phone number linked in the account bio surfaced the Facebook account Paystubs and Docs Editor (1.5k followers), which links to an Instagram account, legitdocumentseditor; both post similar content about falsifying pay stubs, bank statements, and other documents.
How We Analyze the Information Environment
Graphika's intelligence is built on a proprietary methodology developed over more than a decade of network analysis and open source investigation. Every insight we publish is grounded in rigorous, evidence-based research across the platforms, communities, and narratives that shape online discourse.
Network Mapping
We identify and map online communities based on how they interact, not just what they say, revealing the structural relationships between actors and audiences.
Narrative Tracking
We monitor how narratives form, evolve, and spread across platforms, distinguishing organic conversation from coordinated amplification.
Behavioral Analysis
We analyze patterns of behavior across accounts and networks to detect coordination, inauthentic activity, and influence operations.
Cross-Platform Intelligence
Our analysis spans mainstream and niche platforms, giving a complete picture of how information moves across the broader online ecosystem.
Expert Validation
Every finding is reviewed by our team of analysts, researchers, and subject matter experts before publication.
Graphika is the most trusted provider of actionable open-source intelligence to help organizations stay ahead of emerging online events and make decisions on how to navigate them. Led by prominent innovators and technologists in the field of online discourse analysis, Graphika supports global enterprises and public sector customers across trust & safety, cyber threat intelligence, and strategic communications, spanning industries including intelligence, technology, media and entertainment, and global banking.
Related Insights
Facebook, X Users Solicit Mifel Bank Card and Account Details, Presenting Risk of Fraud
Spanish-language Facebook and X users are soliciting access to payment cards, account details, and card verification value (CVV) numbers of Mexico-based Mifel Bank accounts to purchase high-demand sports and music event tickets.
Read the Insight
Coordinated Network Impersonates US Assistant Attorney General Across Platforms in Likely Attempt to Scam Fraud Victims
We identified a very likely coordinated network of accounts across Facebook, Instagram, Pinterest, Threads, TikTok, X, and YouTube that is impersonating U.S. Assistant Attorney General Colin McDonald, who serves in the Department of Justice’s National Fraud Enforcement Division.
Read the Insight
Pro-Iran Hacktivist Group 313 Team Claims It Disrupted eBay, Uses Media Attention to Bolster Credibility
The pro-Iran hacktivist group Islamic Cyber Resistance in Iraq – 313 Team claimed on April 26 that it conducted a distributed denial of service (DDoS) attack against the e-commerce platform eBay.
Read the InsightSee How Graphika Can Help Your Team Act on This Intelligence
This insight is one of 600+ investigations Graphika’s team has published. Our platform gives your analysts continuous access to the same intelligence — plus the tools to apply it to your specific threat environment.