Fake certification registers: how to spot and remove them

Contents

What is a fake certification register?
Why is the register the real target?
What forms do fake registers take?
How should buyers and clients verify a certificate?
How do you get a fake register taken down?
How can you prevent it?
How does AI Fraud Protect help?
FAQ

In short

A fake certification register is a copy of your certificate database or verification page that shows forged certificates as valid. For testing and certification bodies it is more dangerous than any forged document, because the register is what buyers, clients and authorities trust in the end. Protect your register with one unmistakable address, monitoring for lookalike domains, a reporting route for verifiers and fast takedowns.

Key facts

According to the IAF, the global database IAF CertSearch detects an estimated 20,000 fake certificates per year (IAF).
The IAF says forgers create not only certificates that look identical, but also fake databases and QR codes, and that generative AI raises this risk (IAF).
In March 2025, Germany's national accreditation body DAkkS warned of an almost indistinguishable clone of IAF CertSearch. Similar names and misspellings of its address had not been registered (DAkkS).
In the EU, each member state appoints a single national accreditation body (Regulation (EC) No 765/2008).

What is a fake certification register?

A page that pretends to be the authoritative source on your certificates. Usually it is a copy of your own register or verification page on someone else's domain, with your logo, your layout and your fields. Enter the number of a forged certificate and it shows "valid". The QR code on the forged certificate often leads straight to the copy.

There is a second form as well: supposed aggregator databases that list certificates from many bodies and look neutral. They confirm forgeries without copying a specific brand and use your name as just one entry among many.

Why is the register the real target?

Because a forged certificate on its own fails the first serious check. Procurement, supplier management and public tender teams look a certificate up in the register before relying on it. Whoever controls the register they open passes that check with any forgery. That is why forgers invest in verification pages, not just in documents.

A case from March 2025 shows how realistic this is: even the central database IAF CertSearch was cloned, and so well that DAkkS described the copy as almost indistinguishable from the original (DAkkS). If the global reference is a target, the register of a single body certainly is.

What forms do fake registers take?

Four forms cover most cases:

Form	Hallmark	Risk	First response
Copy of your register	Your layout and logo on someone else's domain	Confirms forgeries in your name	Takedown, warn clients and verifiers
QR code to a fake verification page	The code on the forged certificate leads to a lookalike domain	Often invisible to search and scans	Offer a reporting route, capture the full link
Fake aggregator database	Lists certificates from many bodies and looks independent	Looks like a neutral source	Document, report to the host, inform the accreditation body
Invented accreditation	An unrecognized "accreditation body" vouches for a certification body	Fakes competence	Point to the national accreditation body

The second form is the most treacherous. Many of these pages only show anything with the parameters from the QR code. Hidden fakes explains why and how to find them anyway.

How should buyers and clients verify a certificate?

With an order of steps that leaves nothing to the document. Share these steps with your clients so they can pass them on to their own suppliers:

Open the register yourself, from the certification body's official website and never through the link or QR code on the certificate.
Check the certification body's accreditation in the database of the national accreditation body, such as DAkkS in Germany or UKAS in the UK.
Use IAF CertSearch as a cross-check. According to the IAF, it holds roughly half of the around 2.4 million accredited management system certificates worldwide (IAF). A certificate missing there is therefore not automatically fake.
Ask directly when in doubt, using a contact you found independently of the certificate.
Report mismatches to the certification body whose name is on the document.

How do you get a fake register taken down?

Like any fake, with two differences: the framing is usually certificate forgery, and you have more people to warn.

Capture evidence: screenshots, the full link from the QR code, domain, DNS and hosting data. See Securing evidence of a fake website.
Frame it correctly. If the page confirms certificates, it is certificate forgery. If it only copies your website, it is brand forgery. See Takedown framing.
Report in parallel: host, registrar, DNS provider and Google Safe Browsing. How to take down a fake website shows the process.
Inform those affected: whoever reported it, clients whose names appear in the copy and, if needed, your accreditation body.
Keep the case open. A copied register is quickly back online under a new domain, see The resurfacing problem.

How can you prevent it?

By taking away the means that made the IAF clone so effective:

A fixed register address on your own domain that never changes and is named the same way everywhere.
QR codes that only lead to your domain. A code that leads anywhere else then becomes a warning sign for every verifier.
Register the obvious variants of your register domain yourself, especially misspellings and add-ons like register, check or verify. That is exactly the gap DAkkS pointed out in the IAF CertSearch clone.
Make certificates machine-verifiable. DAkkS recommends its digital accreditation symbol, which accredited bodies can use to confirm the authenticity and accreditation status of their certificates (DAkkS).
A reporting route on the register page, where buyers and clients can report a suspicious link or certificate.
Monitoring for new domains that contain your name or abbreviation.

How does AI Fraud Protect help?

AI Fraud Protect finds copies of your register, lookalike domains and fake verification pages that use your name. On a schedule, the domain scanner checks variants of your domains, and through the report widget on your register page verifiers report a suspicious link in full or upload the certificate as a PDF. The AI compares every finding with your real page and names what was copied. The evidence package is compiled automatically, the reports to host, registrar, DNS provider and Google are prepared to fit the framing, and every message is reviewed and sent by a person.

Protect the register your clients trust.

Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedowns in the app.

Start the free fraud scan Request a demo

FAQ

Is IAF CertSearch a safe way to verify?

A good cross-check if you type the address yourself. The March 2025 clone shows that even a central database can be copied, and it does not contain every accredited certificate. Since January 2026, the IAF has been part of the new Global Accreditation Cooperation (IAF).

What is the difference between a certification body and an accreditation body?

The certification body certifies companies, products or people. The accreditation body confirms that a certification body is competent to do so. In the EU, there is exactly one national accreditation body per member state.

Should we inform clients whose names appear in a fake register?

In most cases, yes, because their reputation and their tenders are affected. Decide how and when with your legal team. This is not legal advice.

What if the fake register copies many bodies at once?

Then a joint approach pays off. Report the page for your own entries, inform the other bodies affected and the accreditation body, and mention in your report that several rights holders are affected.

Sources

More in this series

Back to the blog Auf Deutsch lesen