Supported document type
Detect tampered and deepfake Compliance Certificate
PCI DSS does not issue certificates. The genuine artefact is an Attestation of Compliance on the council's own form, signed by a Qualified Security Assessor or by the entity itself under a self-assessment questionnaire, and the decorative certificate a vendor sends instead is often the first sign that nobody with standing assessed anything. The same holds across most standards: what carries weight is the assessor's qualification, not the seal. Read the issuer before you read the wording.
API slug: compliance_certificate
Last updated:
What a genuine compliance certificate contains
A compliance attestation identifies the standard by exact name and version, the entity assessed with its legal name and address, the scope of the assessment, the assessment date and validity window, the result, and the assessor. The assessor block is the part that matters: an individual's name, their qualification, and the firm's credential for that standard, a listed QSA company for PCI DSS, a CREST-accredited firm for Cyber Essentials Plus, a licensed CPA firm for SOC work. Form-based standards add their own references, such as the merchant level and the SAQ type completed.
These fields only agree when somebody qualified filled them in. The version cited has to be one that was current at the assessment date, so an attestation dated this year against a retired version describes an assessment that could not have happened. Scope and result move together, since an all-passing attestation across a broad scope signed off quickly is a combination real assessors rarely produce. The entity name has to be identical in the header, the scope statement, and the assessor's declaration, because those three are transcribed at different points in a real engagement and typed once in a forged one.
How compliance certificate forgeries are made
Standard name and version drift
A fabricated attestation names the standard imprecisely: a misspelling such as HIPPA for HIPAA, or a version retired years ago cited as current. These errors come from copy-paste and from language models working off stale training text, and they are the fastest read available on a document that otherwise looks professional.
Unqualified or invented issuer
The document is issued by a consultancy with no standing to assess the standard, or by a body that does not exist at all. PCI DSS attestation requires a QSA company listed by the council, and Cyber Essentials Plus requires a certification body under an accreditation scheme, so the issuer is checkable in a public list in both cases.
Scope widening
The scope statement is rewritten so an assessment of one payment channel or one environment appears to cover the whole business. Scope is where a real assessor is most precise and a forger is most vague, and a substituted sentence usually sits at a different line length and weight from the block it replaced.
Validity window extension
Assessment and expiry dates are moved so a lapsed attestation reads as current, the most common alteration made to an otherwise genuine document. The assessment date, the validity window, and the standard version printed alongside them have to be mutually consistent, and an edit to one leaves the other two describing a different engagement.
Assessor identity transplant
A real assessor's name, credential number, and signature are copied from a published attestation onto a new one. The signature is resampled artwork with its own compression and edge characteristics, and the credential number can be checked against the scheme's register, which is where transplants usually end.
Generator output
Certificate generators and document models produce a clean, plausible attestation in seconds. The content gives little away, so the evidence sits in the artefact: producer metadata pointing at an online PDF tool rather than the professional tooling an assessor works in, uniform text layers, and no signing history on a document that should carry one.
What TamperCheck checks on a compliance certificate
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Embossed seal analysis
A physically embossed seal deforms the paper it sits on. A seal that was scanned and reprinted is flat, and the two separate cleanly under analysis even when they are hard to tell apart by eye.
Date and validity consistency
Issue, expiry, and period dates are checked against one another and against the file's own creation metadata, which catches backdating and validity extension.
Field-level forensics
Every text region is analysed in its own right rather than as part of one whole-page image. This catches the smoothed and feathered edits that whole-image Error Level Analysis misses entirely.
And many more checks
The three above are the layers that carry the most weight on a compliance certificate. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a compliance certificate, and why
Security and procurement teams vetting vendors during third-party risk review. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a compliance certificate in 4 steps
Check the fields against each other
Read scope statement, validity dates, and auditor name together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a compliance certificate and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do I verify a vendor's compliance certificate?
Check the issuer against the scheme's own register before you read anything else, because most standards publish the firms qualified to assess against them. Then confirm the standard's version was current on the assessment date, that the entity name is identical in the header, the scope statement, and the assessor's declaration, and that the scope describes a bounded environment. TamperCheck then reads the file itself and names any field changed after the assessor signed it.
Can a PCI DSS certificate be faked?
Yes, and more easily than most, because the thing usually presented as a PCI DSS certificate has no official form behind it. The council's artefacts are the Attestation of Compliance and the Report on Compliance, so a decorative certificate with a logo and a date already sits outside the scheme's own paperwork. Verify the assessor against the council's list of QSA companies rather than inspecting the certificate.
What should a real PCI DSS attestation look like?
It should be an Attestation of Compliance on the PCI Security Standards Council's own form, naming the merchant or service provider, the assessment scope, the SAQ type or report reference, the merchant level, and the date, signed by a QSA employee of a listed QSA company or by an officer of the entity for a self-assessment. Anything framed as a certificate is the vendor's own summary of that document.
Why do fake compliance certificates misspell the standard?
Because most of them are assembled or generated rather than issued, and neither process has an assessor reading the output. A language model reproduces the misspellings present in its source text, and a template filled in by a salesperson carries whatever was typed. An assessor working under a scheme writes the standard's name and version exactly, every time, which is why a small error there is disproportionately informative.
TamperCheck analyses compliance certificate uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.