Malte ZanderContents
- Why are education providers a target?
- Which threats do academies, schools and test providers face?
- How do fake verification pages work?
- Who checks your certificates, and how?
- How do you make certificates harder to forge?
- How do you find fakes of your brand early?
- What should you do when you find a fake?
- What does a 90-day plan look like?
- How does AI Fraud Protect help?
- FAQ
Education providers get copied because their certificates open doors to jobs, visas and study places. The main threats are forged certificates, fake verification pages that confirm them, lookalike domains, fake exam registrations and phishing on learning platforms. You protect your brand with verifiable digital certificates, one official verification channel, early detection and fast takedowns.
- The UK degree verification service Hedd has identified more than 300 bogus education providers (Prospects Luminate).
- In a YouGov survey for Hedd in April 2025, 67% of large companies reported more fraudulent job applications and 45% had uncovered false qualification claims (Prospects Luminate).
- Only 52% of large, 37% of medium-sized and 29% of small businesses verify all academic credentials of applicants (Prospects Luminate).
- European Digital Credentials are sealed with an e-seal, which gives them a legal presumption of authenticity across the EU (Europass).
Why are education providers a target?
Because a certificate is a key. It unlocks a job offer, a visa, a university place or a professional license, and the person checking it usually trusts the name of the issuer. Criminals borrow that trust in two directions: they sell forged certificates to people who want the key without the exam, and they imitate the issuer to collect fees, logins or personal data from real learners.
Size does not protect you. Large brands are copied because their names are known, and smaller academies, test centers and chambers are copied because their certificates are rarely checked against the source. In the fourth quarter of 2025 alone, phishing campaigns targeted 866 different brands (APWG).
Which threats do academies, schools and test providers face?
Six patterns cover most cases. Each needs a different first response:
| Threat | What it looks like | Who is harmed | First response |
|---|---|---|---|
| Forged certificates | Copies of your certificate with invented names, grades or levels | Employers, authorities, honest graduates | Offer a fast way to verify, collect the forgeries, report sellers |
| Fake verification pages | A page that confirms a forged certificate as valid, with your logo | Everyone who checks the certificate | Take down the page and its domain, warn verifiers |
| Lookalike domains and fake exam registration | A copy of your site that sells exam slots or "guaranteed" certificates | Candidates who pay and get nothing, or get a fake | Report host and registrar, publish your official channels |
| Bogus institutions using your name | A degree mill that claims partnership or accreditation with you | Students, employers, your reputation | Document the claims, demand removal, inform accreditation bodies |
| Phishing on learning platforms | A cloned login page for your LMS or student portal | Learners and staff whose accounts are taken over | Takedown, password resets, phishing-resistant login |
| Fake courses and ads | Ads and social posts selling your courses through other sites | Paying customers, your support team | Report to the ad platform, document, take down the landing page |
The Goethe-Institut, for example, warns against offers that sell "original" certificates with or without an exam, promise a guaranteed pass or register candidates for a fee through third parties. It points to its own online verification and names trademark infringement and document forgery as possible offences (Goethe-Institut).
How do fake verification pages work?
A fake verification page answers the one question a verifier asks: is this certificate real? The forged certificate carries a QR code or a link that looks like yours, for example [your-brand].results-check.[random].com/results?cid=[id]. Opened with these exact parameters, the page shows "certificate valid", your logo and the forged details. Opened without them, it shows nothing at all.
That makes these pages almost invisible. Search engines and scanners do not have the parameters, so they never see the deception. Only the people holding the forged certificate and the link can find it: employers, authorities, universities. This is why education providers need two things: a verification address that is clearly their own, and a simple way for verifiers to report a page that looks wrong. When the link is spread through a QR code, this is also called quishing.
Who checks your certificates, and how?
Mostly HR teams, authorities and admissions offices, and many of them check less than you think. Only 52% of large businesses verify all academic credentials of applicants, and among small businesses it is 29% (Prospects Luminate). Those who do check often use the link or QR code printed on the document, which is exactly what a forger controls.
Make the correct path obvious:
One verification address on your own domain, for example verify.your-brand.com, listed on your website and in your certificates.
A clear rule for verifiers: type the address yourself or start from your website, never trust a link printed on the document alone.
A list of your official domains that verifiers and candidates can compare against.
A short checklist for HR teams, so they can verify certificates and degrees without falling for a copy of your verification page.
How do you make certificates harder to forge?
You make forgery pointless by making verification instant and trustworthy. A PDF or paper certificate can be copied perfectly. A digitally signed certificate cannot be changed without breaking the signature, and the check takes seconds:
Issue verifiable digital certificates. European Digital Credentials are sealed with an e-seal and enjoy a legal presumption of authenticity across the EU, as well as equivalence to paper certificates with the same content (Europass). The advantage of verifiable credentials over PDF certificates: authenticity is checked through the seal, not through a web page that can be faked.
Host verification on your own domain and point every QR code there. A QR code that leads to your domain is easy to check; one that leads anywhere else is a warning sign.
Use unique certificate IDs that can be looked up, and show only the data a verifier needs.
Publish what a real certificate looks like, including where the verification link points.
How do you find fakes of your brand early?
You find them at the points a fake has to pass, and through the people who see them first:
New domains that contain your name, a typo of it or a lookalike character, often registered days before a campaign starts.
Certificate Transparency logs, where new TLS certificates for such domains appear publicly, because Chrome only trusts certificates that are logged there (Chrome).
Search ads and social media, where fake courses, exam slots and "certificates without exam" are advertised.
Reports from verifiers and candidates. A report widget on your verification page lets an HR team or authority send a suspicious link or certificate in one step.
Your own support inbox. Questions about payments you never requested or exams you never offered are early signals.
What should you do when you find a fake?
Work the case in the same order every time:
Secure evidence of the page, the domain, the certificate and the lure before anything else. See Securing evidence of a fake website.
Frame the case. A fake verification page is a certificate forgery, a cloned login is phishing, a copied site that sells exam slots is brand impersonation. The framing decides the channels.
Report in parallel to the host, the registrar, the DNS provider and Google Safe Browsing. The full process is in How to take down a fake website.
Warn the people at risk: candidates who might pay, verifiers who might be fooled. How to warn customers about a fake website has a template.
Involve your legal team when forged documents circulate or a seller is identifiable. Forging certificates can be a criminal offence; your lawyers decide on complaints and claims.
Keep the case open and watch for the same fake on new domains.
What does a 90-day plan look like?
A focused start takes three months and one owner:
| Phase | Goal | Tasks |
|---|---|---|
| Days 1 to 30 | Know your exposure | List official domains and verification pages, run a scan for lookalikes and fake pages, collect known forgery cases |
| Days 31 to 60 | Close the obvious gaps | Move verification to your own domain, publish official channels, add a report option for verifiers, take down active fakes |
| Days 61 to 90 | Make it routine | Set up monitoring, define who handles reports, brief support and admissions, plan the move to digitally signed certificates |
How to turn this into a standing process is covered in Building a brand protection program from scratch.
How does AI Fraud Protect help?
AI Fraud Protect finds lookalike domains, cloned websites, phishing pages and fake verification pages that use your name. The report widget on your verification page lets employers, authorities and candidates report a suspicious link or upload a certificate as PDF, so hidden pages reach you even when no search can find them. Every find gets an evidence package, and the reports to host, registrar, DNS provider and Google go out in parallel after a person has reviewed them.
Start the free fraud scan for a short report within 48 hours, or request a demo to see the report widget and takedown in the app.
FAQ
Is it illegal to sell fake certificates?
In most countries, yes. Depending on the case, selling or using forged certificates can be document forgery, fraud or trademark infringement; the Goethe-Institut names trademark offences and document forgery for its certificates. This is not legal advice.
How can employers check whether a certificate is real?
By verifying with the issuer directly: through the issuer's verification page reached from its official website, a digital signature check or a written request. A link or QR code printed on the document should never be the only check.
Should we put QR codes on certificates?
Yes, if the code always leads to a verification page on your own domain and you tell verifiers which domain that is. A QR code is only as trustworthy as the address behind it.
Can we take down a degree mill that uses our name?
You can get pages and domains that misuse your name or trademark removed and report false claims of partnership or accreditation. Shutting down the operator itself usually needs authorities, so document everything.
Do digital certificates stop forgery completely?
No, but they make it pointless. A forger can still copy the look of a certificate, but not a valid signature. Once verifiers know how to check, forgeries fail at the first look.
Sources
Prospects Luminate: Degree fraud, the changing landscape and what employers can do about it, November 2025
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026