Malte ZanderContents
Language certificates get forged because a single level such as B1 can decide citizenship, a residence permit, a university place or a job. Forgers sell certificates on social networks and build verification pages that confirm the fake as valid through a QR code. What helps test providers most is a verification address on their own domain, a simple way for authorities and employers to report suspicions, early detection of lookalike domains and fast takedowns.
- For naturalization in Germany, German language skills count as sufficient when the requirements of a B1 level language test are met (Section 10, German Nationality Act).
- According to the German government, forged B1 certificates in naturalization cases were first described at a meeting of the large naturalization authorities in June 2025. The forgeries are offered on social networks, among other places (German Bundestag).
- In a survey of the federal states by the German interior ministry in August 2025, Bavaria alone reported 213 forged language certificates (Bavarian State Parliament).
- The Goethe-Institut warns against offers of "original" certificates, pass guarantees and paid stand-ins, and runs its own online authenticity check (Goethe-Institut).
Why are language certificates such a common target?
Because so much depends on a single level. German naturalization law requires B1. Universities, employers and recognition bodies require B1, B2 or C1 depending on the goal, and the same pattern exists in many countries that tie visas, study or work to a language level. Anyone who has not yet reached the level, or wants to skip the exam, becomes a target for forgers, and forgers know exactly which level is in demand.
Two more properties make language certificates especially vulnerable. They are issued in large numbers and at many locations, so verifiers rarely know exactly what a genuine certificate looks like. And checks often happen under time pressure, based on a copy and a QR code. That is precisely where the most dangerous forgery comes in: the fake verification page.
What does the fraud look like in practice?
Five patterns come up again and again. Each needs a different countermeasure:
| Pattern | What it looks like | What helps |
|---|---|---|
| Sold forgeries | Certificates "without an exam" with invented names and results, advertised on social networks and messengers | Document and report the offers, point verifiers to the official verification route |
| Fake verification pages | The QR code on the forgery leads to a page that copies your results page and shows "valid" | Get the page and domain removed, verification address on your own domain |
| Altered genuine certificates | Name, level or result changed in a genuine PDF | Match against your records, digitally signed certificates |
| Stand-ins and pass guarantees | Someone else sits the exam, or someone promises a pass for money | Identity checks on exam day, clear warnings, criminal complaint |
| Fake registration and phishing | Cloned registration pages collect exam fees or ID documents | Takedown, publish your official registration routes |
For providers, the fake verification page is the most dangerous pattern because it does not just claim the forgery is genuine, it confirms it. It usually shows the result only when it is opened with the parameters from the QR code, for example [your-brand].result-check.[random].com/results?cid=[id]. Without those parameters it shows a neutral page with no logo. Hidden fakes explains how these pages work.
Where do forged language certificates get noticed?
Wherever they are checked: naturalization and immigration offices, universities, HR departments and recognition bodies. According to the German government, the phenomenon is known to police nationwide, and the interior ministry updated its guidance for naturalization authorities in August 2025 (German Bundestag).
The figures from the states mostly show what gets noticed. Bavaria says it does not record these cases in a standardized way, but it reported 213 forged language certificates in the August 2025 survey (Bavarian State Parliament). Hesse estimates around 35 to 40 cases for 2024 and around 30 for 2025 up to the time of the inquiry (Hessian State Parliament). A good forgery with a convincing verification page never shows up in figures like these.
For providers, that leads to a simple conclusion: the people who see a forgery first work at authorities and in HR departments, not at your organization. They need a fast way to pass their suspicion on to you.
Which measures help test providers most?
Sorted by impact relative to effort:
A verification address on your own domain, named on your website, on the certificate and in letters to authorities. Every QR code leads there and nowhere else.
A clear rule for verifiers: type the verification address yourself and never rely only on the link or QR code on the document.
A reporting route on the verification page, where authorities and employers can report a suspicious link or upload the certificate as a PDF. A report widget turns that into a single step.
Monitoring for lookalike domains that combine your name with terms like b1, certificate, exam or result.
Fast takedowns through the host, registrar, DNS provider and Google Safe Browsing, with the full link as evidence.
Digitally signed certificates whose authenticity can be checked through the signature instead of a web page that can be copied.
A fixed contact for authenticity inquiries, such as a dedicated email address that authorities know.
The first three points cost little and work immediately, because they take away the forger's most important lever: trust in a link the forger controls.
What should you do when a fake verification page appears?
Follow the same order every time:
Capture the full link with every parameter, plus screenshots with and without the parameters. Without the exact link, the host often cannot find the page. See Securing evidence of a fake website.
Frame the case as certificate forgery. The framing decides the channels and the grounds, see Takedown framing.
Report in parallel: first to the host, plus the registrar, DNS provider and Google Safe Browsing. How to take down a fake website shows the full process.
Tell whoever reported it that the page is fake, and give them the correct verification route.
Check the affected records. If the forgery uses genuine certificate numbers, flag them for future inquiries.
Involve your legal team. Decide on a criminal complaint together with your law firm.
Keep the case open. The same template often comes back under new domains, see The resurfacing problem.
How does AI Fraud Protect help?
AI Fraud Protect finds lookalike domains, cloned websites and fake verification pages that use your name. On a schedule, the domain scanner checks variants of your domains, including terms like certificate or exam. Through the report widget on your verification page, authorities and employers report a suspicious link in full or upload the certificate as a PDF, and the AI analyzes the page right away. Every case gets an evidence package, the reports are prepared to fit the certificate forgery framing, and every message is reviewed and sent by a person.
Start the free fraud scan for a short report within 48 hours, or request a demo to see the report widget and takedowns in the app.
FAQ
Is buying a fake language certificate a crime?
In many countries, yes. Making or presenting a forged certificate can count as forgery of documents and, depending on the case, as fraud. The Goethe-Institut also names trademark infringement for its certificates. This is not legal advice.
How should authorities verify a language certificate?
With the issuer: through the issuer's verification page, opened from its official website, or by asking the issuer directly. A link or QR code on the document presented is not a verification route, because that is exactly what the forger controls.
Why can't a search engine find fake verification pages?
Because many of them only show something with the parameters from the QR code. Without them, a neutral page with no logo appears, and no variant of your domain leads there. The people most likely to find them are those holding the forged certificate. That is why a reporting route matters so much.
What should candidates know?
That a certificate only comes after passing the exam, that nobody can guarantee a pass, and that registration only works through your official channels. Publish those channels prominently and in your candidates' languages.
Sources
German Bundestag: hib 528/2025, 17 October 2025
Bavarian State Parliament: printed paper 19/8603, answer of 21 October 2025