How to issue experience letters that employers can actually verify
Everyone worries about the fake letters coming in. Almost nobody fixes the letters going out, and that half you control completely.
Most discussion of experience letter fraud is about detection, how to spot a fake letter a candidate has handed you. Far less attention goes to the other half: the letters your own organisation issues, which is the half you control entirely.
Why your letterhead is the problem
Every experience letter you send out is a working template for anybody who wants one. Your layout, your phrasing, your signature block, your letterhead. All of it reusable by a former employee, or by anybody they share the file with.
Nothing on a conventional letter resists this. Letterheads can be copied from any PDF. Signatures can be lifted. Dates can be edited in a free tool in under a minute. And the verification route printed on the letter is usually an HR email address, which for a fabricated letter is an address the candidate controls.
Meanwhile your HR team spends real hours each month confirming employment for people who left years ago, because there is no way for anyone to check without asking.
What makes a letter verifiable
Four properties, and they solve both problems at once.
A unique reference per letter. Not the employee ID, a reference for this specific document. An employee may receive several letters over time.
A public verification page. Hosted on a domain the recipient can trust, openable without an account. Anyone holding the letter can check it in seconds.
A signature over the contents. Not a scanned image of somebody's handwriting, but a cryptographic signature over the actual data: employee name, designation, dates. If a copy is edited, verification fails rather than passing.
A revocation path. Letters do get issued in error, with wrong dates or to the wrong person. You need a way to mark one invalid without pretending it never existed.
What to show on the verification page
Enough to end the enquiry, and no more. Employee name, designation, employment start and end dates, and the letter's status. That answers what a verifier needs.
Leave off salary, reason for leaving and performance commentary. Those are between you and the former employee, and a page anyone can open is the wrong place for them.
What it changes
For the receiving side, a forged copy of your letterhead no longer verifies, the verification page either does not exist or does not match the document. For your own side, verification requests stop arriving, because the asker can answer their own question.
There is a third benefit that is easy to miss: your genuine former employees stop being penalised. When an honest candidate's previous employer has been acquired or shut down, an independently verifiable letter is the only thing that still speaks for them.
Rolling it out
- Count the verification requests HR answered last quarter. That is the current cost.
- Take one letter you issued and try to alter it in a PDF editor. Time yourself.
- Add a unique reference and a verification URL to the template.
- Use it for all new leavers from a fixed date.
- Backfill older letters only when somebody actually asks about one.
You will not fix hiring fraud from one HR department. You can stop your own letters being part of the raw material.
