Social Media Users Advertise Inauthentic Pay Stub Creation
Across Facebook, Pinterest, TikTok, and Instagram, we identified four accounts and an active, 354-member Facebook group promoting services to create fraudulent pay stubs.
Key Finding
Across Facebook, Pinterest, TikTok, and Instagram, we identified four accounts and an active, 354-member Facebook group promoting services to create fraudulent pay stubs. Posts and comments are soliciting direct messages and contact via Telegram and WhatsApp, sometimes mentioning the U.S., the U.K., Canada, or the United Arab Emirates; creating and using fake pay stubs is illegal in those countries and facilitates financial fraud.
Online Activity
- The Facebook account “documents editing service” recently posted, “hit me for paystubs...bank statement...W2 Dr Notes” and provided a WhatsApp contact number. The Payslips | Paystubs | Document Editor Facebook group predominantly features posts advertising document falsification, many including WhatsApp numbers and explicitly promoting pay stub services. The group has received 211 posts in the past month, and gained 30 new members in the last week.
- On Pinterest, searching for “pay stub editor” surfaced two pins displaying pay stubs. Both attracted comments from an account promoting “document editing” and a WhatsApp phone number.
- On TikTok, "paystubseditor" has posted several videos demonstrating document falsification and promoting inauthentic pay stubs, bank statements, and W-2 tax documents, some boasting over 48k views and with hashtags such as #paystubfixer and #howtoeditpaystubs. Searching for the phone number linked in the account bio surfaced the Facebook account Paystubs and Docs Editor (1.5k followers), which links to an Instagram account, legitdocumentseditor; both post similar content about falsifying pay stubs, bank statements, and other documents.
How We Analyze the Information Environment
Graphika's intelligence is built on a proprietary methodology developed over more than a decade of network analysis and open source investigation. Every insight we publish is grounded in rigorous, evidence-based research across the platforms, communities, and narratives that shape online discourse.
Network Mapping
We identify and map online communities based on how they interact, not just what they say, revealing the structural relationships between actors and audiences.
Narrative Tracking
We monitor how narratives form, evolve, and spread across platforms, distinguishing organic conversation from coordinated amplification.
Behavioral Analysis
We analyze patterns of behavior across accounts and networks to detect coordination, inauthentic activity, and influence operations.
Cross-Platform Intelligence
Our analysis spans mainstream and niche platforms, giving a complete picture of how information moves across the broader online ecosystem.
Expert Validation
Every finding is reviewed by our team of analysts, researchers, and subject matter experts before publication.
Graphika is the most trusted provider of actionable open-source intelligence to help organizations stay ahead of emerging online events and make decisions on how to navigate them. Led by prominent innovators and technologists in the field of online discourse analysis, Graphika supports global enterprises and public sector customers across trust & safety, cyber threat intelligence, and strategic communications, spanning industries including intelligence, technology, media and entertainment, and global banking.
Related Insights
Pinterest, TikTok Accounts Very Likely Promoting Prescription-Less Ozempic Sales in Comments and Posts
We identified two websites that state they are "Authorized FIFA ticketing partners," and two companion TikTok accounts advertising FIFA World Cup tickets and hospitality packages for sale.
Read the Insight
Pro-Iran Hacktivist Group 313 Team Claims It Disrupted eBay, Uses Media Attention to Bolster Credibility
The pro-Iran hacktivist group Islamic Cyber Resistance in Iraq – 313 Team claimed on April 26 that it conducted a distributed denial of service (DDoS) attack against the e-commerce platform eBay.
Read the Insight
Fraudulent Credit, Debit Cards Advertised Across Platforms
We identified 15 accounts across Facebook, Instagram, Pinterest, and TikTok advertising credit and debit cards in posts and comments, directing usersto make contact via Telegram or direct message (DM).
Read the InsightSee How Graphika Can Help Your Team Act on This Intelligence
This insight is one of 600+ investigations Graphika’s team has published. Our platform gives your analysts continuous access to the same intelligence — plus the tools to apply it to your specific threat environment.