# Detect tampered and deepfake ISO Certificate > An ISO certificate is worth exactly as much as the accreditation behind it. The certificate itself is a single page issued by a certification body, and the mark that matters is not the ISO logo, which certifies nothing, but the accreditation body's mark: UKAS, DAkkS, ANAB, and their national equivalents. A certificate carrying no accreditation mark, or one whose mark does not belong to the body that signed it, is either unaccredited or fabricated. The second thing to read is the scope. **Canonical URL:** https://tampercheck.ai/documents-support/iso_certificate **API document class:** `iso_certificate` **Last updated:** 2026-10-07 --- ## What a genuine ISO certificate contains A certificate names four things and little else: the organisation certified, with its legal entity name and the sites covered; the standard and its edition, such as ISO/IEC 27001:2022; the scope of certification, a sentence describing which activities and locations the management system covers; and the dates, being the initial certification date, the current issue date, and the expiry. Around them sit the certificate number in the certification body's own format, the body's name and authorised signature, and the accreditation body's mark with its accreditation number. Those elements constrain each other tightly. A certification cycle runs three years from initial certification, with surveillance audits in between, so an expiry that is not three years from the initial date describes a cycle that does not exist. The accreditation mark has to belong to the body that signed the certificate, since accreditation is granted to a certification body by a specific national accreditation body for specific standards. Scope has the least freedom of all, drawn from the audited management system, so a scope wide enough to cover everything the organisation does has not been audited. ## How ISO certificate forgeries are made ### Scope broadening The scope sentence is rewritten to cover products, sites, or activities the audit never reached, turning a certificate for one office into apparent coverage of a whole group. Scope wording is drafted by the certification body and printed in a fixed block, so a rewritten sentence usually runs to a different length and breaks the block's line spacing. ### Validity extension The expiry date is moved so a lapsed certificate reads as live. Certification runs a three year cycle from the initial certification date, which is printed on the same page, so an extended expiry contradicts the date a line or two above it unless both are edited together. ### Accreditation mark transplant An accreditation body mark is copied from one certificate onto another issued by a body that does not hold that accreditation. Marks are supplied to certification bodies as controlled artwork with an accreditation number beside them, so a transplanted mark is resampled, often carries the wrong number, and pairs an accreditation body with a certification body it does not accredit. ### Certification body impersonation A recognised body's name, logo, and signature block are used on a certificate it never issued. This fabrication survives longest, because the reader recognises the brand and stops there. The certificate number is where it fails: each body follows a known numbering convention, and invented numbers rarely match the format or the length. ### Certified entity substitution The certified organisation is replaced with a related or unrelated legal entity, so a subsidiary's certification is presented as the parent's, or a supplier borrows another firm's certificate outright. The entity name appears in the body text and often inside the scope sentence, and an edit missing the second instance leaves two companies certified on one page. ### Generated certificates A single page certificate is the easiest assurance artefact to produce whole, and generated ones look excellent. They are caught on external coherence rather than appearance: a verification URL or QR code that resolves to nothing, a body and accreditation pairing that does not exist, and no print history behind an artefact normally issued as a signed PDF. ## What TamperCheck checks on an ISO certificate TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class. ### Security print, foil, and hologram analysis A genuine security overlay or guilloche background behaves differently from a printed picture of one. A reproduction loses the structure that made the feature a security feature in the first place, and that loss is measurable even when the copy looks convincing on screen. ### Embossed seal analysis A physically embossed seal deforms the paper it sits on. A seal that was scanned and reprinted is flat, and the two separate cleanly under analysis even when they are hard to tell apart by eye. ### Barcode and QR payload comparison Encoded payloads are decoded and compared against the human-readable values printed alongside them. Editing the visible text without re-encoding the barcode is a common and highly detectable mistake. ### And many more checks The three above are the layers that carry the most weight on an ISO certificate. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks. ## Who verifies an ISO certificate, and why Procurement and supply chain teams vetting suppliers. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging. ## How to verify an ISO certificate in 4 steps 1. **Search the certification body's own directory.** Accredited bodies publish a searchable register of live certificates. Query it on the certificate number printed on the document rather than the supplier's name, because a number that returns nothing is the fastest disqualifier available to you. 2. **Verify the body's accreditation, not only the certificate.** Look the certification body up on the accreditation body's register and confirm it holds accreditation for this standard. UKAS, DAkkS, ANAB and their counterparts all publish which bodies they accredit and for what. 3. **Read the scope against what you are buying.** Confirm the scope sentence covers the sites, services, and activities you intend to rely on. A certificate scoped to a head office says nothing about the delivery centre your data will actually sit in. 4. **Check the cycle dates, then the PDF.** Confirm the expiry sits three years from the initial certification date and that the certificate has not lapsed, then run the file through TamperCheck for evidence of fields changed after the body issued it. ## Frequently asked questions ### How do I verify an ISO certificate is genuine? Look the certificate number up in the certification body's own public directory, since most accredited bodies publish one, and confirm the entity name and scope match what you were sent. Check the accreditation body's register as well, to confirm that certification body actually holds accreditation for the standard. Read the scope sentence closely, then have TamperCheck scan the PDF for fields altered after the body signed it. ### Can ISO certificates be faked? Yes, and they are among the most frequently faked supplier documents, because a certificate is one page with no issuing security features. The common versions are an expired certificate with the date moved, a genuine certificate with the scope widened, and a wholly fabricated page carrying a well-known body's logo. Checking the issuer's public register is the single most effective step, and it takes a minute. ### What does the accreditation mark on an ISO certificate mean? It shows that the certification body issuing your certificate is itself audited and authorised by a national accreditation body, such as UKAS in the United Kingdom, DAkkS in Germany, or ANAB in the United States. The ISO logo carries no such meaning, because ISO writes standards and certifies nobody. A certificate showing an ISO logo and no accreditation mark is the pattern worth questioning. ### How long is an ISO 27001 certificate valid? Three years from the initial certification date, with surveillance audits in the intervening years and a recertification audit before expiry. That fixed cycle doubles as a consistency check, because the initial certification date and the expiry date are printed on the same certificate, and a gap that is not three years is a contradiction the document cannot resolve. ## Related document types - SOC 2 Report: https://tampercheck.ai/documents-support/soc2_report - Compliance Certificate: https://tampercheck.ai/documents-support/compliance_certificate - Penetration Test Report: https://tampercheck.ai/documents-support/pentest_report --- Try TamperCheck now: https://tampercheck.ai/dashboard · Docs: https://tampercheck.ai/docs · Pricing: https://tampercheck.ai/pricing