Certificate fraud: how fraudulent credentials arise and how to prevent them

The forms fraud takes

Most fraudulent credentials fall into one of four categories:

• Diploma mills. Organisations that sell degrees or certificates for a fee while requiring little or no study. US federal law defines a diploma mill in precisely those terms: an entity that offers degrees, diplomas or certificates for a fee, requires little or no education or coursework to obtain them, and lacks accreditation by an agency recognised by the Secretary of Education or a federal agency.
• Forgeries. Documents made to appear as though a real institution issued them, when it did not.
• Alterations. A genuine certificate whose name, grade, date or qualification has been changed. A PDF offers no protection against such edits.
• Counterfeit verification. An imitation website or telephone line that "confirms" a forged document when an employer makes contact.

The first category sells a worthless credential to a buyer who may believe it to be genuine. The other three misuse the name of an institution that never issued the document.

Warning signs of a diploma mill

The US Federal Trade Commission warns consumers about degree scams. Its guidance identifies the following signs that a programme is not what it claims to be:

• it does not require study, examinations or interaction with professors;
• it offers a degree on the basis of "experience" alone;
• it promises a degree within a few days, weeks or months;
• it advertises through spam, pop-up advertisements and high-pressure calls.

The FTC advises checking whether a school is accredited by an agency recognised by the US Department of Education, using the Department's College Navigator and DAPIP databases. Its separate guidance for employers adds warning signs to look for in an application: degrees out of sequence, degrees earned far faster than normal, a school distant from where the applicant lived or worked, and a school name resembling that of a well-known institution. Our guide on how to verify a diploma sets these checks out as a procedure.

A case before the courts: Axact

In May 2015, The New York Times reported that Axact, a Pakistani software company, sold fake diplomas and degrees online through hundreds of fictitious schools. In July 2018 a district and sessions court in Islamabad convicted the company's chief executive and 22 others of fraud and forgery in the case, according to reports by Dawn and Geo News. In October 2018 the Islamabad High Court suspended the chief executive's sentence and granted him bail pending his appeal, Dawn reported. We have found no reliable report of the appeal's final outcome, and this article therefore does not describe the case as closed.

The case illustrates the scale a diploma mill can reach: not a single fraudulent degree, but an industry of fictitious schools, each with a website prepared to vouch for its graduates.

Measures for employers and admissions offices

• Verify with the institution, or with a register that answers for it, using independently obtained contact details, never those printed on the document.
• Confirm that the institution is recognised by the competent authority in its own country.
• For foreign credentials, use a credential evaluator. The ENIC-NARIC network, the European network of recognition centres, lists guidance for evaluators on diploma mills and document fraud, including the FRAUDOC guidelines produced by an EU-funded project and Council of Europe Recommendation CM/Rec(2022)18 on countering education fraud.
• Treat a PDF or a photocopy as a claim, not as proof.

Measures for issuing institutions

An institution cannot prevent a forgery from being printed. It can ensure that a forgery fails the first genuine check. This requires the institution to:

1. Assign each certificate a unique code that cannot be inferred from the previous one.
2. Publish a verification page at an address the institution controls or names on its website, where a relying party can check the code and see who issued the certificate, to whom and when.
3. Sign what it issues. A digital signature allows a relying party to confirm that the certificate's wording is exactly as issued.
4. Handle revocation transparently. When a certificate is withdrawn, the verification page should state it, with the date and the reason.
5. Maintain the register. A record of what was granted, to whom and when is what allows the institution to answer a verification request years later.

Physical security features, such as seals, holograms or special inks, assist a first inspection, but a skilled forger can reproduce what a reader can see. A check against the issuer's own record cannot be reproduced.

Emitcert is designed around this principle: each certificate receives an unguessable code and a public verification page, its wording is signed with the issuer's key, and a withdrawal appears on the page as soon as it is recorded.