How to verify that a diploma or certificate is real

Start from the document, not from what it says about itself

A genuine certificate names who issued it, who received it, what was achieved and when. Many also carry a reference number, a verification link or a QR code. Note all of them before you do anything else: they are what you will check.

Do not rely on contact details printed on the document or given by the candidate. A forger who prints a fake diploma can print a fake phone number and host a fake verification page just as easily. Find the institution's contact details independently, from its official website or a public directory, and use those.

Check that the institution exists and is recognised

A real-looking diploma from an institution that is not recognised is still worthless for most purposes. Diploma mills, which sell degrees for little or no study, rely on names that sound like well-known schools.

In the United States, the Department of Education's Database of Accredited Postsecondary Institutions and Programs (DAPIP) lists institutions and programs accredited by agencies recognised by the Secretary of Education. The Federal Trade Commission's guidance for employers lists red flags worth checking against the candidate's history:

• degrees earned out of sequence, or far faster than a normal programme would take;
• a school located far from where the applicant lived or worked at the time;
• a name that closely resembles a well-known institution;
• a school website that charges per degree or awards credit for "life experience".

For more on how fakes are produced and spotted, see our guide to certificate fraud.

Confirm with the issuer or the register that answers for it

The most reliable check is the one the issuing institution confirms. Many countries have a service that answers on the institution's behalf:

• United States: the National Student Clearinghouse offers DegreeVerify, which employers use to confirm degree and attendance records online. The Clearinghouse states that it covers 96% of degrees from US four-year institutions.
• United Kingdom: Higher Education Degree Datacheck (HEDD) describes itself as the UK's official degree verification service. It is operated by Prospects, part of Jisc.
• Spain: the Registro Nacional de Titulados Universitarios Oficiales, run by the Ministry of Science, Innovation and Universities, lets graduates authorise a third party to check their official university degrees. The authorisation comes as a PDF with a secure verification code (CSV) and a QR code. Only official degrees are recorded: a university's own non-official qualifications (títulos propios) are not.

Where no register exists, write to the registrar or examinations office of the institution, using the contact details you found yourself, and ask them to confirm the name, the qualification and the date.

Use the verification link, carefully

Digital certificates increasingly carry a link or a QR code to a verification page kept by the issuer or its provider. That page is the fastest check there is, provided it is the real one. Before trusting it, make sure the address belongs to the institution or to a verification service it names on its own website. When the certificate also shows a code, open the service's verification page yourself and type the code, rather than following a link from the document.

A good verification page tells you who issued the certificate, to whom, what for and when, and whether it still stands. If it was withdrawn, it should say so, and if it was corrected and reissued, it should point you to the certificate that replaced it.

Documents issued abroad

Under the Hague Apostille Convention of 5 October 1961, a public document issued in one contracting state can be certified for use in another by a single certificate, the Apostille, issued by a competent authority in the country the document comes from. The Hague Conference lists academic diplomas issued by public institutions among the public documents the Convention covers. Since 2006, the Hague Conference's e-Apostille Programme has helped authorities issue Apostilles electronically; the Conference says an e-Apostille is just as valid as a paper one.

An Apostille confirms the origin of the document: the signature, the capacity of the person who signed it and, where applicable, the seal. It does not confirm what the document says.

In the European Union, European Digital Credentials for Learning (EDC) are digital credentials sealed by the issuing organisation. According to Europass, if the file is altered the seal breaks and the verification checks fail.

A checklist for HR and admissions

1. Record the issuer, the recipient, the qualification, the date and any code or link.
2. Confirm the institution exists and is recognised by the relevant authority.
3. Compare the dates and places with the candidate's CV.
4. Confirm with the institution, or a register that answers for it, using contact details you found yourself.
5. For digital certificates, check the verification page is genuine, then check its status.
6. For foreign documents, ask whether an Apostille or an official recognition is needed.
7. Keep a record of what you checked, when and with whom.