TL;DR: To check if a certificate is real, ask the organisation that issued it, never the look of the document. Open the certificate's verification link or scan its QR code and confirm that it opens a matching record on the issuer's own domain, or paste the link, document ID or PDF into TRUE Verify, which is free, needs no account and returns a security level in seconds. Of the documents people uploaded to TRUE Verify between April and August 2026, nearly nine in ten came back at the lowest security level, with no proof found.
You check if a certificate is real by asking the issuer, not by studying the document. The quickest route is the certificate's own verification link or QR code, and the next is TRUE Verify, a free tool from TRUE Original that reads a link, a document ID or a PDF and returns a security level in seconds. Seals, signatures and layout prove nothing on their own, because a forger can copy every one of them.
The order matters. A link or a QR code gives you the issuer's answer in seconds. TRUE Verify tells you what kind of proof the document carries, and an email to the issuer is the fallback when it carries none. Everything else, from the paper to the embossed seal, is decoration. All three steps run on a phone or in a browser. Checking whether a certificate is original or fake online takes minutes and no phone call.
Many certificates carry a certificate number or ID instead of a link. LegalClarity, a legal information site, lists what an issuer's lookup usually asks for: "the certificate holder's full name, the unique certificate number or ID, the date of issue", along with the type of certificate and the name of the issuing body (LegalClarity). A TRUE Original document carries its own document ID, and TRUE Verify accepts that ID as readily as the link.
TRUE Verify rates every document on five security levels, and the level shows what kind of security the issuer used when the document was issued. A document at the top two levels, Signed + Secured and Secured, is tamper-proof and can be verified without the issuer, and TRUE Verify puts its risk of fabrication at none. A document at the lowest level carries no proof that TRUE Verify can find, and its risk of fabrication is very high.
Every TRUE Original document is anchored on a public blockchain, which is what the Secured level checks for. An issuer that also signs with an eIDAS signature reaches Signed + Secured, the strongest combination TRUE Verify reports.
A QR code on a certificate proves something only when it opens a record held by the issuer, on the issuer's own domain, that matches the document in your hand. A QR code is a printed link. Anyone can print one that leads to a lookalike page, to a file host or back to a copy of the same PDF.
Read the address bar before you read the page. A verification page on the issuer's domain, showing the holder's name, the course and the date of issue, is the issuer speaking. A page that only repeats what the certificate already says, with nothing behind it to check, proves nothing. Paste the address into TRUE Verify and it looks for the proof behind the page rather than at the page itself.
No, you cannot tell if a certificate is fake by looking at it. Layout, logos, seals, signatures and watermarks are all trivially reproducible, and they are where a forger spends the effort. The only test that holds is a check against the issuer's record or a cryptographic proof.
The Council for Higher Education Accreditation and UNESCO have published on degree mills since 2009, and the reference case is still Axact, the Pakistani company that ran more than 370 fake university and accreditation websites and sold over 3,000 fake qualifications into the United Kingdom alone, including to people working in healthcare. The Axact case shows how far a forger's effort on looks can go. On 21 December 2016 the US Attorney for the Southern District of New York charged an executive of Axact over a diploma mill that according to the complaint collected at least approximately $140 million from tens of thousands of consumers. Axact claimed an affiliation with approximately 350 fictitious high schools and universities. Its diplomas, the complaint says, were affixed with fake stamps supposedly bearing the seal and signature of the U.S. Secretary of State.
"Hamid allegedly took hefty upfront fees from young men and women seeking an education, leaving them with little more than useless pieces of paper," said Preet Bharara, then the Manhattan US Attorney, in the Department of Justice announcement.
Generative AI has made a convincing layout cheaper still. A record on a blockchain does not care how good the copy looks, which is how blockchain catches AI-generated fake certificates that pass a visual check.
You check that the institution behind a certificate is real by looking it up on an official register of recognised institutions, never on the institution's own website, which a diploma mill controls. In the United Kingdom that register check is Hedd, which calls itself "the UK's official degree verification hub" and lets anyone "Check if a UK university or college is a recognised degree-awarding body". A certificate from a real institution still needs the document check, and TRUE Verify does that part for free.
The register matters because diploma mills build websites that look like universities. On 4 October 2026 Hedd's site held details of 471 recognised UK institutions and 243 bogus ones (Hedd). Axact alone ran more than 370 fake university and accreditation websites.
A certificate that cannot be verified makes a claim and offers no way to test it. There is no issuer record to query, no signature to check and no ledger entry to compare against. The certificate is not proven false. It is unproven, and it stays that way.
That is a different problem from forgery, and it is far more common. A forged certificate is a crime someone committed. An unverifiable certificate is a gap nobody noticed, usually left by an organisation that did nothing wrong except send a PDF. It may be entirely genuine and still carry nothing a stranger can check.
Anyone who has hired knows the moment. An application arrives with a diploma attached. The name is right, the logo looks right, the layout looks like every other diploma. And there is no way to confirm that the person completed the course, short of contacting the school and waiting for a reply.
In TRUE Verify's data, nearly nine times in ten. Between 20 April and 13 August 2026, people outside TRUE Original uploaded documents to TRUE Verify to find out whether they were real, and nearly nine in ten came back at the lowest level TRUE Verify reports: no origin, no security, no proof found. Fewer than one in twenty carried real proof: a cryptographic signature, an issuer record or a seal that would survive a check.
The count leaves out TRUE's own monitoring, TRUE's own infrastructure and every document issued through TRUE Original. What remains is other organisations' documents, brought in by whoever was holding them.
The uploads say more than the links. Someone with a verification link clicks it and gets an answer. Someone uploading a file has been handed a document with no link to click, and is trying to work out what it is worth.
People who take the trouble to check a document often already suspect something. This is what arrives at a verification tool, not a random sample of every certificate in circulation. The figure describes the documents people chose to question, which is the population that matters to anyone who hires.
Degree fraud reaches nearly half of employers, and the numbers that exist have been pointing the same way for years. In a survey of 313 UK employers in September 2019 by the graduate careers organisation Prospects, which runs the United Kingdom's official degree verification service, 49 percent of large businesses and 48 percent of small and medium businesses had encountered a candidate who lied about their degree qualifications. HireRight's 2025 Global Benchmark Report found that more than three-quarters of businesses had found candidate discrepancies during screening in the previous 12 months, with education and employment discrepancies among the most common.
Checking is where the gap opens. In the same Prospects survey, 83 percent of employers believed that some of their hires would have lied about their degrees, yet a fifth did not verify degree qualifications. Prospects' research also found that 66 percent of employers ask for a certificate, and 76 percent of those never check it with the awarding body.
"Coupled with the multitude of fake universities and degree certificates in circulation, degree fraud is a high-risk business for employers."
Chris Rea, head of higher education services at Prospects, in the Prospects press release
The published research asks employers what they found. TRUE Verify's data records what happens when someone finally tries to check.
A verifiable certificate carries its own proof: it points back to the organisation that issued it, and that organisation's record confirms it without anyone having to pick up a phone. The proof takes one of a few forms. A cryptographic signature fails if a single character changes, an issuer record can be queried by anyone who checks, and a hash anchored on a public blockchain shows that the document is the same one that was issued, on the day it was issued.
None of that requires the reader to trust the sender. A PDF asks to be believed. A TRUE Original document asks to be checked.
TRUE Original anchors every document it issues on one of several public blockchains, among them Ethereum and Polygon, and the document lives on the issuer's own domain. Anyone can verify it by QR code or in TRUE Verify without contacting the issuer.
A PDF certificate cannot prove that it is real because nothing inside an ordinary PDF ties it to the issuer's record. A PDF can be edited, and an edited copy looks exactly like the file that was sent.
The PDF does its job on the day it is sent. A course ends, certificates go out by email, and every participant has something to show. The test comes months later, in a hiring process the issuer never sees, when a recruiter has to tell that file apart from one made in a design tool in twenty minutes. The organisation issuing the certificate carries none of the cost of it being uncheckable. The person holding it does.
An issuer should send certificates that can be checked without the issuer. The test is simple. If someone receives a certificate from you today and wants to confirm it in two years, when the person who signed it has left and the course has been retired, can they? If the answer depends on someone at your organisation answering an email, the certificate is one you would vouch for if asked, not one that proves itself.
"Nearly two years ago I spoke to a student at Karolinska Institutet. She said she was glad they had moved to verifiable certificates, because otherwise nobody would know in five years that she had done the programme. With everything happening in AI, she was right."
Patrik Slettman, co-founder of TRUE
TRUE Original issues certificates, diplomas and other documents that carry that proof, for more than 200 issuers and over 900,000 recipients. Each one can be checked in TRUE Verify in seconds.
Of the documents people brought to TRUE Verify to check between April and August 2026, fewer than one in twenty could be verified.
Every organisation we work with started with the same question. Give us thirty minutes and we will show you what your own documents would be worth.
Book a callNot sure where to start? Let us help!
Trusted by leading organisations worldwide
