Certificate fraud: how fake diplomas happen and how to stop them

The shapes fraud takes

Most fraudulent credentials fall into one of four groups:

• Diploma mills. Outfits that sell degrees or certificates for a fee while requiring little or no study. US federal law defines a diploma mill in exactly those terms: an entity that offers degrees, diplomas or certificates for a fee, requires little or no education or coursework to obtain them, and lacks accreditation by an agency recognised by the Secretary of Education or a federal agency.
• Forgeries. Documents made to look as if a real institution issued them, when it did not.
• Alterations. A genuine certificate with its name, grade, date or qualification changed. A PDF makes this trivially easy.
• Fake verification. A lookalike website or phone line that "confirms" a forged document when an employer calls it.

The first group sells a worthless credential to someone who may even believe it is real. The other three misuse the name of an institution that never issued the document.

Warning signs of a diploma mill

The US Federal Trade Commission warns consumers about degree scams. Its guidance lists signs that a programme is not what it claims to be:

• it does not require studying, exams or interaction with professors;
• it offers a degree based on "experience" alone;
• it promises a degree in a few days, weeks or months;
• it advertises through spam, pop-up ads and high-pressure calls.

The FTC advises checking whether a school is accredited by an agency the US Department of Education recognises, using the Department's College Navigator and DAPIP databases. Its separate guidance for employers adds red flags to look for in an application: degrees out of sequence, degrees earned far faster than normal, a school far from where the applicant lived or worked, and a school name that sounds like a well-known one. Our guide on how to verify a diploma turns those checks into a routine.

A case that reached the courts: Axact

In May 2015, The New York Times reported that Axact, a Pakistani software company, sold fake diplomas and degrees online through hundreds of fictitious schools. In July 2018 a district and sessions court in Islamabad convicted the company's chief executive and 22 others of fraud and forgery in the case, according to reports by Dawn and Geo News. In October 2018 the Islamabad High Court suspended the chief executive's sentence and granted him bail pending his appeal, Dawn reported. We have not found a reliable report of the appeal's final outcome, so this article does not describe the case as closed.

The case shows the scale a mill can reach: not one fake degree but an industry of invented schools, each with a website ready to vouch for its graduates.

What employers and admissions offices can do

• Verify with the institution, or with a register that answers for it, using contact details found independently, never the ones on the document.
• Check that the institution is recognised by the relevant authority in its own country.
• For foreign credentials, use a credential evaluator. The ENIC-NARIC network, the European network of recognition centres, lists guidance for evaluators on diploma mills and document fraud, including the FRAUDOC guidelines produced by an EU-funded project and Council of Europe Recommendation CM/Rec(2022)18 on countering education fraud.
• Treat a PDF or a photocopy as a claim, not as proof.

What issuing schools can do

An institution cannot stop someone from printing a forgery. It can make sure a forgery fails the first real check. That means:

1. Give every certificate a unique code that cannot be guessed from the previous one.
2. Publish a verification page on an address you control or name on your website, where anyone can check the code and see who issued the certificate, to whom and when.
3. Sign what you issue. A digital signature lets anyone confirm that the certificate's words are exactly the ones you issued.
4. Keep revocation honest. When a certificate is withdrawn, the verification page should say so, with the date and the reason.
5. Keep the register. A record of what you granted, to whom and when is what lets you answer a verification request years later.

Visual security features on paper, such as seals, holograms or special inks, help with a quick look, but a skilled forger can copy what a reader can see. A check against the issuer's own record cannot be copied.

Emitcert is built around that last point: every certificate gets an unguessable code and a public verification page, its words are signed with the issuer's key, and a withdrawal shows on the page the moment it is made.