# Detect tampered and deepfake Certificate > Most certificate forgeries are about a date. A training or competence certificate expires, renewal costs time and money, and moving the expiry forward on a lapsed one is the cheapest way to stay on a site or a supplier list. The next most common edit is a name swap that lets one person's qualification cover a colleague. TamperCheck compares each field against the print around it and names the region that was altered. **Canonical URL:** https://tampercheck.ai/documents-support/certificate **API document class:** `certificate` **Last updated:** 2026-10-07 --- ## What a genuine certificate contains A certificate names a person, something they achieved, and who says so. Expect the holder's full name, the title of the award or the standard met, the issuing body with its address and accreditation marks, the issue date, an expiry or valid-until date where the qualification carries a renewal cycle, a certificate or registration number, and an authorised signature with a printed name and job title beneath it. Many now add a QR code or a short verification URL pointing back at the issuer's own lookup page. The fields hold each other in place through the issuing body's scheme. A certificate number is allocated in sequence or encodes the course date, so a number far out of range for its issue date is wrong. Expiry follows issue by the fixed validity period the standard sets, commonly one, two, or three years, which makes any other interval an invented date. The award title has to be one the issuing body is accredited to give, and the accreditation mark printed beside it has to belong to a scheme that actually covers that award. ## How certificate forgeries are made ### Expiry extension The valid-until date on a lapsed certificate is advanced by a year or two so the holder keeps site access or stays on an approved list. Four characters change on a document that was entirely genuine the day it was issued, which is why it passes visual review so easily. ### Holder name substitution One qualified worker's certificate is reused to cover an unqualified colleague. The name is the only edited region on the page, so it sits in isolation: different rendering, different compression history, and often different sub-pixel positioning from every other line of text. ### Certificate number invented or borrowed A number is made up, or copied from a genuine holder's certificate so that any lookup by number returns a valid record under a different name. Invented numbers usually break the issuer's own format or sit outside the range the issue date implies. ### Accreditation mark pasted in The logo of a recognised accreditation scheme is dropped onto a certificate from a provider that holds no such accreditation. Lifted from a website, the mark arrives at a lower resolution than the surrounding artwork and frequently carries residual background from wherever it was cut out. ### One template issued to many holders A stolen certificate is used as a master and reissued under different names across a workforce. The signature is identical pixel for pixel on every copy, and the certificate number is often reused unchanged, which shows up the moment two of them are compared. ### Certificates assembled by generative tools Whole certificates are produced from a prompt or a form-filling template, complete with a QR code that resolves nowhere and a signature that has no stroke variation. Field cross-checks pass on these because the fields were invented together, so they are identified through generation signatures instead. ## What TamperCheck checks on a certificate TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class. ### Security print, foil, and hologram analysis A genuine security overlay or guilloche background behaves differently from a printed picture of one. A reproduction loses the structure that made the feature a security feature in the first place, and that loss is measurable even when the copy looks convincing on screen. ### Embossed seal analysis A physically embossed seal deforms the paper it sits on. A seal that was scanned and reprinted is flat, and the two separate cleanly under analysis even when they are hard to tell apart by eye. ### Signature forgery analysis Signature regions are assessed for ink consistency and for how the stroke sits on the page, which distinguishes a genuine pen stroke from a pasted image of one. ### And many more checks The three above are the layers that carry the most weight on a certificate. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks. ## Who verifies a certificate, and why Employers and accreditation bodies confirming qualifications. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging. ## How to verify a certificate in 4 steps 1. **Check the fields against each other.** Read holder name, award date, and issuing body together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original. 2. **Inspect the file metadata.** Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look. 3. **Ask for a second document.** Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare. 4. **Run a forensic check.** Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a certificate and returns a risk score from 0 to 100 within seconds, at $0.50 per document. ## Frequently asked questions ### How do I check if a certificate is genuine? Go to the issuing body's own verification page and search by certificate number and holder name, rather than trusting the QR code printed on the document. Confirm the gap between issue and expiry matches the validity period that standard actually carries, that the number fits the issuer's format, and that the accreditation mark corresponds to a scheme covering this award. ### What software detects fake certificates? TamperCheck analyses certificates through a single REST endpoint. Upload a PDF, scan, or phone photo and receive a JSON verdict with a risk score from 0 to 100, returned within seconds, with findings tied to specific regions of the document so you can see which field was edited. Pricing is $0.50 per document with no subscription or minimum, and documents are processed ephemerally and not stored. ### Does a QR code on a certificate prove it is real? No. A QR code is just an encoded link, and a forger who builds the certificate also chooses where its code points, frequently to a page they control that confirms whatever the document claims. Read the URL before following it, confirm the domain belongs to the issuing body, and reach the verification page independently if there is any doubt. ### What is the most common certificate forgery? Extending the expiry date on a certificate the holder genuinely earned. The qualification was real, the training happened, and only the renewal lapsed, which makes the edit feel minor to the person making it and keeps every other field on the page consistent. It is also the edit most likely to put an unqualified person into a role that assumes current competence. ### Is a certificate from an unaccredited provider a forgery? No, it is a genuine document with no standing behind it, which is a different problem and needs a different check. Forensic analysis compares a document against itself and will report an unaccredited provider's certificate as unaltered, correctly. Establishing whether the issuer is recognised means checking the accreditation scheme's own register of approved providers. ## Related document types - Academic Transcript: https://tampercheck.ai/documents-support/transcript - Marksheet: https://tampercheck.ai/documents-support/marksheet - Degree Certificate: https://tampercheck.ai/documents-support/degree_certificate - Diploma: https://tampercheck.ai/documents-support/diploma - Admission Letter: https://tampercheck.ai/documents-support/admission_letter - Enrollment Certificate: https://tampercheck.ai/documents-support/enrollment_certificate --- Try TamperCheck now: https://tampercheck.ai/dashboard · Docs: https://tampercheck.ai/docs · Pricing: https://tampercheck.ai/pricing