Supported document type
Detect tampered and deepfake Medical Certificate
Fake medical certificates are found by examining the document rather than the illness: the period of leave, the practitioner's registration number, the clinic stamp, and whether all three were printed in a single pass. The forgery here is casual and high-volume, usually a real note with the dates stretched by a week, or a template filled in at home. Because the fraud is documentary, so is the evidence, and TamperCheck names the field that carries it.
API slug: medical_certificate
Last updated:
What a genuine medical certificate contains
A medical certificate is a short statement by a registered practitioner that a patient was seen and is unfit for work over a defined period. It carries the practice letterhead with address and contact details, the patient's name and date of birth, the date of consultation, the first and last day of the incapacity, and a fitness statement: unfit for work, fit with adjustments, or expected back on a given date. Below that sit the practitioner's printed name, signature, council registration number, and the clinic stamp.
Those fields hold each other in place. A consultation cannot be dated after the first day of the leave it certifies, and a registration number belongs to one named practitioner in a format the medical council fixes. A single note also has a customary ceiling on the absence it can cover before a review or referral is expected. Stretch the end date and the note certifies more leave than one consultation supports. Replace the practitioner and the number under the signature stops matching the name above it.
How medical certificate forgeries are made
Leave period extension
The last day of the certified absence is pushed out, turning three days of leave into ten on an otherwise genuine note. It is the single most common edit on this document class, and the changed digits almost never carry the same compression history as the date they sit beside.
Diagnosis or fitness wording substitution
The condition line or the fitness statement is retyped, often to convert a note recommending adjusted duties into one certifying full incapacity. Replacement text is set in a font the original printer never used, and the line spacing above and below it rarely survives the edit intact.
Borrowed practitioner registration number
A real, currently registered doctor's name and council number are attached to a note they never wrote, so the number itself survives a lookup. What fails is the pairing: the registration number resolves to one practitioner, one qualification, and often one practice address that the letterhead contradicts.
Clinic stamp cloning
A rubber stamp impression is lifted from a genuine note, cleaned up, and dropped onto another. A real impression varies in ink density across its own edge and bleeds slightly into the paper fibre. A copied one is uniform, sharply bounded, and sits on top of the page rather than in it.
Fill-in-the-blank template kits
Blank certificate templates carrying a plausible practice letterhead are sold ready to complete. Nothing on them is edited, so per-field comparison finds no inconsistency, and they are identified instead by letterhead that matches no issuing practice and by print characteristics uniform across every field.
Model-generated notes
A certificate is produced whole by an image or document model, rather than altered from a real one. These are internally coherent by construction, so they are caught through generation signatures and through the way synthetic imagery differs from paper that was genuinely printed and then scanned.
What TamperCheck checks on a medical certificate
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Stamp authenticity and placement
Stamps are assessed for whether the ink was impressed onto the page or printed as part of it, and for whether the impression was placed digitally after the fact.
Signature forgery analysis
Signature regions are assessed for ink consistency and for how the stroke sits on the page, which distinguishes a genuine pen stroke from a pasted image of one.
Letterhead, logo, and issuer plausibility
Issuer branding is checked for resolution and compression consistency against the body text it sits on. A logo lifted from a website carries the signature of its source, not of the document.
And many more checks
The three above are the layers that carry the most weight on a medical certificate. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a medical certificate, and why
HR teams and insurers validating absence and fitness-to-work claims. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a medical certificate in 4 steps
Check the fields against each other
Read leave dates, diagnosis, and practitioner registration number together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a medical certificate and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do employers detect fake sick notes?
Employers start by checking the note against itself: consultation date against the first day of leave, practitioner name against the registration number printed below it, and letterhead against the practice the doctor actually works from. Where the volume is high, the scan or photo is run through forensic analysis, which compares each field against its neighbours and flags the dates or stamp that were added later.
Can a doctor's note be faked?
Yes, and it is one of the most frequently forged documents there is, because the effort required is low and the review it receives is usually a glance. Most fakes are not fabrications but small edits to a genuine note, typically the leave dates. The edit is invisible on paper and clearly visible in the file, where the changed region has a different print and compression profile.
What should HR check on a medical certificate?
Check five things: that the consultation date is on or before the first day of the absence, that the practitioner's registration number matches the named doctor on the council register, that the practice letterhead and the stamp refer to the same clinic, that the fitness wording matches the length of leave claimed, and that the dates were printed in the same pass as the text around them.
How much does it cost to check a medical certificate?
TamperCheck charges $0.50 per document, with no subscription and no minimum volume, which is what makes it workable for a document class that arrives in hundreds. Each certificate returns a risk score from 0 to 100 and findings tied to specific regions of the page, within seconds, through a single REST endpoint.
TamperCheck analyses medical certificate uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.