Malte ZanderContents
Diploma mills and forgers need a page that confirms a bought or forged degree. That is why they copy the online verification of real universities or invent their own confirmation pages using those universities' names. Universities protect themselves with a verification address on their own domain, digitally sealed degrees, a reporting route for employers and fast takedowns.
- The UK degree verification service Hedd has identified more than 300 bogus education providers (Prospects Luminate).
- In a YouGov survey for Hedd in April 2025, 67% of large employers reported more fraudulent applications, and 45% had uncovered false degree claims (Prospects Luminate).
- Only 52% of large, 37% of medium and 29% of small employers check all of their candidates' degrees (Prospects Luminate).
- The US Council for Higher Education Accreditation (CHEA) runs a database of more than 8,200 institutions accredited by recognized US accrediting organizations (CHEA).
Why do forgers copy university verification?
Because a degree is only worth as much as its confirmation. A printed diploma is easy to copy, but employers, authorities and other universities increasingly check online. Anyone selling a bought degree has to be able to answer that check. So they build a page that does exactly that: a copy of your verification or a confirmation page of their own that carries your name.
It pays off for forgers because many degrees are never checked at all. When only 29% of small employers check every degree, a good forgery is often enough on its own. And those who do check often follow the link or QR code on the document, which is exactly the route the forger controls.
Which fakes hit universities?
Five patterns, each with its own first response:
| Pattern | What it looks like | First response |
|---|---|---|
| Forged diplomas | A diploma or certificate with your seal and an invented name | Publish your verification route, collect cases, consider a complaint |
| Copied verification | A lookalike domain that rebuilds your degree check and shows "confirmed" | Get the page and domain removed, warn employers |
| Diploma mill using your name | A provider claims a partnership, recognition or accreditation from you | Document the claims, demand removal, inform the relevant bodies |
| Forged transcripts | Transcripts or grade reports for sale, often marketed as "replacement documents" | Report the offers, verification through your office |
| Phishing against students | Cloned login pages for the portal, email or learning platform | Takedown, password resets, phishing-resistant login |
The most damaging pattern for your reputation is the copied verification. It turns a forgery into a seemingly confirmed degree and makes your university look like the source of that confirmation.
How can employers spot a diploma mill?
By a pattern of offers no real university makes. Typical signs are degrees for payment without meaningful study, degrees based on "life experience", very short times until the diploma arrives and accreditation from bodies nobody has heard of. CHEA warns that degree mills and accreditation mills mislead and harm students and the public, and its database lets employers check whether a US institution is accredited by a recognized accreditor (CHEA).
For foreign degrees in Germany, the anabin database of the Central Office for Foreign Education is the first place to look. It provides information on foreign degrees and on whether an institution is recognized (anabin). The certificate verification checklist for HR shows how HR teams can go about it.
How do universities protect their online verification?
With a few decisions that take away the forger's most important lever:
A verification address on your own domain, such as verify.your-university.edu, named on your website and on every diploma.
A rule for verifiers: type the verification address yourself and never rely only on the link or QR code on the document.
Digitally sealed degrees. European Digital Credentials carry an electronic seal and are legally presumed authentic across the EU (Europass). Their authenticity then no longer depends on a web page.
Data-minimal verification: show only what verifiers need and require an input, such as a number and date of birth, instead of serving results through open links.
A reporting route on the verification page, where employers can report a suspicious link or upload a diploma as a PDF.
Monitoring for lookalike domains that combine your name or abbreviation with terms like degree, verify or check.
A fixed office for authenticity inquiries that also collects cases and passes them on to your legal team.
What should you do about a fake confirmation page?
Handle every case in the same order:
Capture evidence, including the full link with parameters, screenshots and domain data. See Securing evidence of a fake website.
Frame it as certificate forgery if the page confirms degrees, otherwise as brand forgery. See Takedown framing.
Report in parallel to the host, registrar, DNS provider and Google Safe Browsing. How to take down a fake website shows the process.
Warn whoever reported it and give them the correct verification route.
Involve your legal team when forged diplomas are in circulation or a seller can be identified.
Keep the case open, because diploma mills switch domains quickly.
How does AI Fraud Protect help?
AI Fraud Protect finds copies of your degree verification, lookalike domains and phishing pages that use your university's name. Through the report widget on your verification page, employers and authorities report a suspicious link in full or upload the diploma as a PDF. That way you also reach confirmation pages that only show something with the parameters from the QR code. The AI compares every finding with your real page, the evidence package is compiled automatically, and every report to host, registrar, DNS provider and Google is reviewed and sent by a person.
Start the free fraud scan for a short report within 48 hours, or request a demo to see the report widget and takedowns in the app.
FAQ
Is using a bought degree a crime?
In many countries it can be. In Germany, for example, using an academic degree without being entitled to it can be an offence under Section 132a of the Criminal Code, and a forged diploma can also count as forgery of documents. Rules differ by country. This is not legal advice.
How do employers verify a foreign degree?
Start with the official recognition body or database of the country where you hire, such as anabin in Germany, and with the accreditation databases of the country that issued the degree. The authenticity of the individual document is always confirmed with the issuer.
Should universities issue degrees digitally?
Yes, as long as verification runs through the signature or a page on your own domain. A digitally sealed degree cannot be altered without breaking the seal. Read more about the difference between verifiable credentials and PDF certificates.
Can we get a diploma mill that names us as a partner taken offline?
You can get pages and domains that misuse your name removed, and you can report false claims of a partnership. Stopping the operator itself usually takes the authorities, so document every finding.
Sources
Prospects Luminate: Degree fraud, the changing landscape and what employers can do about it, November 2025
anabin: information portal on the recognition of foreign qualifications