Detect tampered and deepfake Certificate

What a genuine certificate contains

A certificate names a person, something they achieved, and who says so. Expect the holder's full name, the title of the award or the standard met, the issuing body with its address and accreditation marks, the issue date, an expiry or valid-until date where the qualification carries a renewal cycle, a certificate or registration number, and an authorised signature with a printed name and job title beneath it. Many now add a QR code or a short verification URL pointing back at the issuer's own lookup page.

The fields hold each other in place through the issuing body's scheme. A certificate number is allocated in sequence or encodes the course date, so a number far out of range for its issue date is wrong. Expiry follows issue by the fixed validity period the standard sets, commonly one, two, or three years, which makes any other interval an invented date. The award title has to be one the issuing body is accredited to give, and the accreditation mark printed beside it has to belong to a scheme that actually covers that award.

How certificate forgeries are made

• Expiry extension

  The valid-until date on a lapsed certificate is advanced by a year or two so the holder keeps site access or stays on an approved list. Four characters change on a document that was entirely genuine the day it was issued, which is why it passes visual review so easily.

• Holder name substitution

  One qualified worker's certificate is reused to cover an unqualified colleague. The name is the only edited region on the page, so it sits in isolation: different rendering, different compression history, and often different sub-pixel positioning from every other line of text.

• Certificate number invented or borrowed

  A number is made up, or copied from a genuine holder's certificate so that any lookup by number returns a valid record under a different name. Invented numbers usually break the issuer's own format or sit outside the range the issue date implies.

• Accreditation mark pasted in

  The logo of a recognised accreditation scheme is dropped onto a certificate from a provider that holds no such accreditation. Lifted from a website, the mark arrives at a lower resolution than the surrounding artwork and frequently carries residual background from wherever it was cut out.

• One template issued to many holders

  A stolen certificate is used as a master and reissued under different names across a workforce. The signature is identical pixel for pixel on every copy, and the certificate number is often reused unchanged, which shows up the moment two of them are compared.

• Certificates assembled by generative tools

  Whole certificates are produced from a prompt or a form-filling template, complete with a QR code that resolves nowhere and a signature that has no stroke variation. Field cross-checks pass on these because the fields were invented together, so they are identified through generation signatures instead.

What TamperCheck checks on a certificate

TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.

• Security print, foil, and hologram analysis

  A genuine security overlay or guilloche background behaves differently from a printed picture of one. A reproduction loses the structure that made the feature a security feature in the first place, and that loss is measurable even when the copy looks convincing on screen.

• Embossed seal analysis

  A physically embossed seal deforms the paper it sits on. A seal that was scanned and reprinted is flat, and the two separate cleanly under analysis even when they are hard to tell apart by eye.

• Signature forgery analysis

  Signature regions are assessed for ink consistency and for how the stroke sits on the page, which distinguishes a genuine pen stroke from a pasted image of one.

• And many more checks

  The three above are the layers that carry the most weight on a certificate. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.

Who verifies a certificate, and why

Employers and accreditation bodies confirming qualifications. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.

How to verify a certificate in 4 steps

1. 1

   Check the fields against each other

   Read holder name, award date, and issuing body together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.

2. 2

   Inspect the file metadata

   Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.

3. 3

   Ask for a second document

   Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.

4. 4

   Run a forensic check

   Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a certificate and returns a risk score from 0 to 100 within seconds, at $0.50 per document.

Frequently asked questions