How to Spot a Fake Certificate in Minutes
The visual red flags only catch sloppy fakes. Here is how to spot a fake certificate reliably, plus the single check that settles it.
If you hire, admit, or accredit people, you will eventually be handed a certificate that is not real. Spotting it is part instinct and part method, and the method is what protects you when the forgery is good.
Start with the obvious visual tells
Lazy fakes give themselves away. Look for mismatched fonts, a logo that is slightly blurry or the wrong colour, uneven spacing, or a signature that looks pasted in. Check whether the name, dates, and qualification are internally consistent. A certificate dated before the course existed, or a grade that does not match the institution's scale, is a warning sign worth chasing.
Question the document itself
Most fakes today are digital. A PDF or image proves nothing about authenticity because it can be edited or generated from scratch. Be suspicious of files where the recipient's details sit on a slightly different background, where text is sharper than the surrounding graphics, or where the metadata shows a recent edit by an unexpected author. But treat these as hints, not proof, since a careful forger leaves none of them.
Beware the screenshot trap
A common move is to send a screenshot of a verification page that appears to confirm the certificate. Never accept this. A screenshot can be faked as easily as the certificate. The only verification that counts is one you perform yourself, on the issuer's official channel, starting from a code or link on the document.
Verify against the issuer, not the file
The reliable method is to stop judging the paper and check the record behind it. Genuine modern certificates carry a way to confirm them independently:
- A QR code or short code that you scan or type yourself.
- A public verification page that loads the issuer's record, not the holder's file.
- A clear result naming the issuing organisation, the recipient, and the date.
If scanning the code returns a valid record that matches the document in front of you, it is real. If it fails, returns nothing, or shows different details, you have your answer.
Confirm the issuer is who they claim
A sophisticated fake may even host its own convincing verification page. Defend against this by checking that the verifier confirms a real, identified issuer, ideally tied to a known domain or registered business, rather than an anonymous page anyone could stand up. If the issuer's identity cannot be established, treat the certificate as unverified no matter how polished it looks.
Handle a suspected fake calmly
If something does not add up, do not accuse, investigate. Ask the candidate for the verification link or the issuer's contact, then check it yourself. Keep a note of what you found. Often the simplest explanation, a genuine certificate the person cannot verify, is itself a useful signal about how the credential was issued.
Do it with QRCertificates
Certificates issued through QRCertificates make this whole process quick. Each one is signed with Ed25519 over its canonical data fields, so we sign the data rather than the PDF, and any altered character causes verification to fail. A built-in QR code or short human-readable code gives you one-click public verification on any device, with no login and no app, and the result names a verified issuer confirmed by email, domain, or business registration. Verification is always free, so you can check as many as you need. When a certificate is built this way, spotting a fake stops being guesswork and becomes a five-second scan.
