How to Spot AI-Generated Fake IDs, Deepfakes & Fake Pay Stubs Before a Showing

Short answer: You probably can't spot a 2026 AI-generated fake ID, pay stub, or deepfake by eyeballing it — generative AI now forges pixel-perfect documents for as little as $15. The only reliable defense is system-level: verify the person's identity with bank-level ID verification, and never release a self-showing access code until they pass.

One property manager we interviewed had a scammer impersonate a prospect, grab the lockbox keys, and start running an unauthorized leasing service out of the unit. That's not a bad application sitting in a folder. That's loss of physical control of the asset — a stranger collecting deposits from phantom renters while you have no idea the unit is occupied.

This is what rental fraud looks like in 2026. The threat has moved past a forged pay stub you might catch if you squint hard enough. It now starts with a synthetic identity that passes visual inspection, obtains a code or key through your normal showing workflow, and then the scammer is inside your property before you know anything went wrong.

The old defense — eyeball the ID, eyeball the pay stub, check for mismatched fonts — is dead against AI. What replaced it is a structural principle: verify the person, not the paper, and gate access on that verification. The rest of this guide explains why visual inspection failed, what the fraud looks like today, and what actually holds.

What does AI-generated rental fraud actually look like in 2026?

AI-generated rental fraud is no longer a crude forgery — it's a pipeline. A scammer can now get a realistic fake driver's license for around $15, a convincing fake pay stub in about 90 seconds, and a complete package of fake income docs — pay stubs, bank statements, W-2s — for roughly $20. Each vector covers a different part of your screening process.

Fake IDs. Off-the-shelf generation tools can produce realistic driver's licenses and passports for dozens of countries, with the correct templates, holograms rendered as image layers, and the right micro-text. The $15 price point is real — and it means fraud that previously required skills and connections is now accessible to anyone with a prepaid card and a search engine.

Fake income documents. A convincing fake pay stub now takes about 90 seconds using AI-assisted PDF editors. Packages that include matching bank statements and W-2s sell for around $20 on forums — enough to satisfy most standard income-verification checklists. The most common methods are fraudulent PDF creators that generate fake bank statements and pay stubs, plus tools that insert false text to inflate income figures.

Deepfakes. Detected deepfakes quadrupled between 2023 and 2024 and now account for roughly 7% of all fraud attempts, according to the Sumsub Identity Fraud Report. The Entrust 2025 Identity Fraud Report found a deepfake attempt occurring every five minutes in 2024. These aren't crude face-swaps — modern deepfake tools produce convincing video that can fool both people and basic liveness checks that aren't specifically hardened against them.

The scale is significant: in 2024, 93.3% of apartment owners, developers, and managers reported experiencing some form of rental fraud in the prior 12 months, according to the NMHC Pulse Survey on Rental Application Fraud and Bad Debt. Among those, 84.3% saw fake pay stubs and 70% encountered fraudulent ID. These aren't edge cases — they're the baseline operating environment.

Why can't you tell a fake pay stub from a real one anymore?

The short answer: the cost and complexity of forgery collapsed. What once required a skilled counterfeiter now takes a browser tab and $20. When both the cost and the time drop by orders of magnitude, the volume goes up and the quality goes up with it.

The Entrust 2025 Identity Fraud Report found that digital document forgeries rose 244% year-over-year, surpassing physical counterfeits for the first time. The forgery has moved from the physical card to the PDF and the screen — exactly where human eyeball inspection is least reliable.

The tells that used to work — misaligned fields, wrong fonts, pixelated watermarks — get auto-corrected now. AI tools trained on real document templates produce outputs that match the layout, kerning, and watermark position of legitimate documents. The most common forgery methods today are fraudulent PDF creators generating fake bank statements and pay stubs, and AI tools inserting false text to inflate income figures, with mismatched fonts cleaned up automatically.

This matters not because property managers are bad at spotting fakes, but because the fakes are now structurally better than human inspection. You're not losing a skill contest — you're playing a game that's been rigged against visual review. The right response isn't to get better at looking at the document; it's to verify the person behind it through a channel the document can't fake.

The Deloitte Center for Financial Services projects that generative AI-enabled fraud losses will reach $40 billion by 2027, up from $12.3 billion in 2023 — a 32% compound annual growth rate. Residential leasing is one of the clearest targets: large transaction, time-pressured applicant review, and until recently, no structural verification requirement beyond uploading a PDF.

How fast is rental application fraud getting more sophisticated?

The number that matters isn't the raw fraud rate — it's how fast the sophistication is rising. The unsophisticated fakes are getting filtered out while the AI-generated ones get harder to catch.

The NMHC Pulse Survey found that 70.7% of property managers reported an increase in fraudulent applications and payments over the prior year. Roughly 70% specifically reported an increase in fraud involving identity theft and deceptive documents. Even where the headline rate holds flat, the quality of what's getting through is climbing sharply.

The cost of one slip matters here. The average eviction runs approximately $3,500 according to TransUnion — and that's before you add lost rent during the eviction timeline, turnover costs, and the legal fees if the tenant contests. One placement that makes it through screening can wipe out months of rent from other units. The math on catching fraud early is straightforward; the question is what mechanism actually catches it.

How do scammers get lockbox codes for self-showings — and how do you stop it?

A code-only self-showing system has a structural flaw: a code isn't tied to a person. It's a string of digits that anyone who holds it can use. Once a scammer obtains or intercepts a code — by requesting a showing, having someone forward it to them, or intercepting it through a phishing step — they have physical access to your unit with no further check.

A large Florida operator we interviewed described what happened before they added identity verification to their showing workflow. Their self-showings were attracting, in their words, "nothing but squatters, nothing but scam artists basically grabbing codes." The codes were accessible without any tied identity, so they circulated freely — the prospect who requested the showing wasn't necessarily the person who showed up.

The operators who got burned the worst often made the next mistake: they shut self-showings off entirely. The result was losing leads. Qualified prospects who could schedule a showing at 7 p.m. on a Tuesday couldn't get access to the unit, so they moved on. The fraud risk of code-only showings and the leasing-speed benefit of self-showings felt like a genuine tradeoff — you got one or the other.

That tradeoff is the false choice. One property manager in our calls described prospects bailing when the showing workflow asked for a raw Social Security number upfront: "I'm not comfortable entering in my social security number… I didn't know that you had to do that." The problem wasn't that verification existed — it was that the verification step was heavy, opaque, and felt like a data-collection request rather than a security check. Good prospects walked away. The friction wasn't keeping scammers out; it was keeping real renters out.

The principle that resolves both: never release a self-showing access code until the prospect's identity is verified. Gate the key, not the door. The showing stays available 24/7; the code release is what requires a verified identity behind it.

What is bank-level ID verification for showings, and how does it work?

Bank-level ID verification applies the same identity-confirmation rigor that financial institutions use — confirming that the person requesting access is who they say they are — before any access is granted. For self-showings, the flow looks like this:

1. The prospect requests a self-showing through the normal scheduling process.
2. Before a code is generated, they complete bank-level ID verification — the same standard a bank would apply to confirm identity, kept low-friction so a legitimate renter doesn't bail.
3. Only after identity verification passes does the access code release. Not before. The code is never generated until the person is confirmed.

The contrast with a code-only system is structural, not incremental. A code-only system trusts whoever holds the code. An identity-gated system trusts only the verified human — the code is downstream of the person, not independent of them.

This moves the check from the document to the person. A fake pay stub or a synthetic ID in an application folder might fool a visual review. But the human behind the showing request has to pass an identity check before the door ever opens. You're no longer inspecting what they uploaded — you're verifying who they are.

So what can a small or mid-size residential PM actually do?

The honest answer is that visual inspection should be treated as a weak signal, not a screen. There are still tells — but they're catching up fast, and building your process around them is a losing bet. Here's what that means in practice.

What still sometimes works (with caveats):

• Cross-check income docs against an independent source. Bank-verified income — directly from a bank statement that you pull through an account-verification link, not a PDF the applicant uploads — is harder to forge than a pay stub. An uploaded PDF is the easiest thing in the workflow to fake; a live bank connection is not.
• Watch for human inconsistencies AI still fumbles. Employer name doesn't match the industry, pay dates fall on weekends, the issuing state on the ID doesn't match the address history. These are weak signals — treat them as a reason to ask a follow-up question, not a definitive screen.
• Don't rely on visual formatting tells. Fonts, alignment, watermarks, and template layout are now auto-corrected by the forgery tools. The property manager who built their screening around those signals in 2021 is working with a checklist that stopped working in 2023.

What actually holds structurally:

• Verify the person, not the paper. Bank-level ID verification on the identity itself — not just on the document they hand you — is the check that scales. Documents can be forged; identity verification at the person level is a much harder target.
• Gate access on verification. Never let a code out ahead of an identity. The lockbox doesn't open until the person is confirmed — that's the structural fix the code-only showing workflow is missing.
• Keep it low-friction. A raw SSN request at the top of the showing flow drives good renters away. The bar is verification that's rigorous but doesn't make a legitimate prospect feel like a suspect. That design question matters as much as the verification standard itself.

LetHub's self-showing access code releases only after the prospect's identity is verified with bank-level ID verification — so a scammer is stopped at the gate, before they ever reach the lockbox. The principle is the same one that resolves the false choice between fraud prevention and leasing speed: verify the person, then release the code.

You can't out-inspect an AI forgery. You can refuse to release the key until the person is verified.

Frequently Asked Questions

Can a property manager spot an AI-generated fake ID before a showing?

Not reliably by sight. AI-generated IDs now match the layout, watermarks, and micro-text of legitimate documents at a level that visual inspection can't consistently catch. The only dependable defense is verifying the person's identity through a dedicated check before releasing access.

How much does it cost a fraudster to make a fake ID or pay stub with AI?

As little as approximately $15 for a fake ID and about 90 seconds for a fake pay stub; complete packages of fake pay stubs, bank statements, and W-2s sell for around $20 on fraud forums.

Is rental application fraud getting more sophisticated?

Yes. Roughly 70% of property managers reported that fraud involving identity theft and deceptive documents is increasing year-over-year, per the NMHC Pulse Survey — and digital forgeries now surpass physical counterfeits, so the fakes getting through are harder to catch by sight.

Why is visual document inspection no longer enough?

Digital forgeries rose 244% year-over-year and now exceed physical counterfeits, according to the Entrust 2025 Identity Fraud Report. The formatting tells that used to flag fakes — font mismatches, alignment issues, watermark errors — are now auto-corrected by the same AI tools generating the documents.

How do scammers get self-showing lockbox codes?

By requesting a showing through the normal workflow when the code isn't tied to a verified identity — a code-only system trusts whoever holds the code, so it can be passed along, intercepted, or obtained by someone other than the legitimate prospect who requested it.

What is bank-level ID verification?

Identity verification at the same rigor financial institutions use to confirm who someone is — applied to a rental showing workflow so the access code only releases after the person requesting it has been confirmed.

How do you verify identity before releasing a self-showing code?

Require the prospect to pass ID verification before the code is generated. The access code releases only after they pass — the code is downstream of the verified person, not independent of them.

What's the downstream cost of one fraudulent applicant?

The average eviction costs approximately $3,500 according to TransUnion, before accounting for lost rent during the eviction timeline, turnover costs, and legal fees if the placement is contested.

The math on verifying a renter's identity before handing over access is straightforward. See how LetHub verifies a renter's identity before the access code ever releases — book a demo.