Malte ZanderContents
Always verify certificates and degrees with the issuer, through a route you found yourself, and never through the link or QR code on the document. The checklist below takes you through ten steps from receiving the documents to recording the result. For the most common credentials there are official verification routes, such as issuer verification portals, language test providers' online checks, certification registers and recognition databases.
- In a YouGov survey for the UK verification service Hedd in April 2025, 67% of large employers reported more fraudulent applications, and 45% had uncovered false degree claims (Prospects Luminate).
- Only 52% of large, 37% of medium and 29% of small employers check all of their candidates' degrees (Prospects Luminate).
- In Germany, the free IHK Zeugnis-Check lets employers verify vocational certificates from participating chambers online, for exams taken since 2007 (IHK Kassel-Marburg).
- European Digital Credentials carry an electronic seal and are legally presumed authentic across the EU (Europass).
Why isn't looking at the document enough?
Because good forgeries look perfect, and many now come with their own confirmation. A forged certificate often carries a link or QR code that leads to a cloned verification page, which then shows "valid". Anyone following that route is checking with the forger. The most important rule in this checklist is therefore: you find the verification route yourself, not the document.
The checklist before the offer
Ten steps to go through for every credential that matters for the decision:
Request complete documentation: the document plus the details the issuer needs for a check, such as certificate number, exam date and date of birth.
Clarify consent and data protection. Tell the candidate that you verify credentials with the issuer, and agree the process with your data protection officer.
Find the issuer independently through its official website, which you open yourself. Do not use links, phone numbers or addresses printed on the document.
Use the official verification route: an online check, a register or a written inquiry, as the issuer describes on its website.
Check digital credentials technically. Verify signed certificates through the signature or the issuer's verification tool, using the original file.
Place foreign degrees, using the recognition body or database of your country, such as anabin in Germany, and have the issuer confirm authenticity.
Cross-check industry certificates, such as ISO certificates, through the certification body's register and the accreditation body's database.
Don't judge mismatches alone. A negative result can be a typo. Ask the issuer before you decide.
Report suspicious verification pages to the issuer whose name the page uses, ideally through the issuer's reporting route.
Record the result: who checked, when, through which route, and with what outcome.
Which verification route fits which credential?
The most common credentials have established routes:
| Credential | Verification route | What to watch for |
|---|---|---|
| Vocational or chamber certificate | The chamber's online check or an inquiry to the issuing chamber | Online checks often cover only certain years or participating chambers |
| Digitally signed certificate | The issuer's verification tool with the original file | The check fails if the file was altered or re-saved |
| Language certificate | The test provider's online check or an inquiry, such as with the Goethe-Institut | Always open the verification page from the official website |
| ISO or management system certificate | The certification body's register, plus IAF CertSearch | Not every certificate is listed in IAF CertSearch |
| Degree | The university's verification service or registry, plus accreditation and recognition databases | Only the issuer can confirm the individual document |
| European Digital Credential | Check the electronic seal | Legally presumed authentic across the EU |
Language test certificate fraud and Fake certification registers give more background on specific credentials.
How can you recognize a fake verification page?
By features a genuine verification page never has:
The domain doesn't match the issuer's official website, even if the issuer's name comes first, as in [issuer].result-check.[random].com.
You can only reach the page through the document. Nothing on the issuer's website leads there.
The page shows "valid" without you entering anything, because all the details are already in the link.
The domain is new, registered shortly before or even after the document's issue date.
The imprint, contact or privacy pages are missing or lead nowhere.
Hidden fakes explains pages that only show something with the right link.
Template: authenticity inquiry to the issuer
If the issuer offers no online check or the result is unclear, a short inquiry helps:
Subject: Verification of a certificate
Dear Sir or Madam,
As part of a recruitment process, a candidate has presented a credential issued by your organization. The candidate has agreed to this check. Please confirm whether the following credential was issued by you and whether the details match.
Name: [first name last name], date of birth: [DD/MM/YYYY], credential: [title, level or grade], number: [certificate number], issued on [DD/MM/YYYY].
A copy is attached. We deliberately did not use the verification link on the document. It leads to [address from the document]. If this address does not belong to you, we wanted to make you aware of it.
Kind regards
[name, role, company, email, phone]
What should you do if you suspect a forgery?
Calmly, and in this order:
Don't accuse anyone prematurely. A database error or a typo is possible.
Ask the issuer, using the contact you found yourself and the template above.
Report the fake verification page if the link leads to someone else's domain. The issuer can get it removed.
Involve HR leadership and legal before you speak to the candidate. Decide on next steps there.
Record everything, including the issuer's reply.
How does AI Fraud Protect help?
AI Fraud Protect protects the issuers whose verification routes you rely on. Where an issuer uses the report widget on its verification page, you can report a suspicious link or upload the certificate as a PDF right where you already check. The report goes to the issuer, the AI analyzes the page right away, and a fake verification page is pursued until it is removed. If your company issues certificates itself, for example through a corporate academy, AI Fraud Protect protects your own verification route too.
Start the free fraud scan for a short report within 48 hours, or request a demo to see the report widget and takedowns in the app.
FAQ
Are we allowed to contact the issuer?
Usually yes, if the candidate has been informed and you only share the details needed for the check. Clarify the legal basis with your data protection officer. This is not legal advice.
What if the issuer doesn't reply?
Follow up after a week, and ask the candidate to request a confirmation that the issuer sends to you directly. Forwarded "confirmations" do not replace a check.
Are QR codes on certificates safe?
Only as safe as the address behind them. Compare the domain the code leads to with the domain of the official website you found yourself. If they don't match, that is a warning sign.
How common are fake degrees?
Precise figures are rare, because many forgeries are never noticed. In the YouGov survey for Hedd, 45% of large employers had uncovered false degree claims, and many employers do not check every degree.
Sources
Prospects Luminate: Degree fraud, the changing landscape and what employers can do about it, November 2025
IHK Kassel-Marburg: verifying vocational certificates online
anabin: information portal on the recognition of foreign qualifications