How to verify that a diploma or certificate is authentic

Begin with the document, not with its own claims

An authentic certificate states who issued it, to whom, for what achievement and on what date. Many also carry a reference number, a verification link or a QR code. Record each of these details before taking any further step: they are the elements to be checked.

Do not rely on contact details printed on the document or supplied by the candidate. A forged diploma can be accompanied by a forged telephone number or a counterfeit verification page. Obtain the institution's contact details independently, from its official website or a public directory, and use those.

Confirm that the institution exists and is recognised

A convincing diploma from an unrecognised institution carries no value for most purposes. Diploma mills, which sell degrees for little or no study, frequently adopt names that resemble those of established universities.

In the United States, the Department of Education's Database of Accredited Postsecondary Institutions and Programs (DAPIP) lists institutions and programs accredited by agencies recognised by the Secretary of Education. The Federal Trade Commission's guidance for employers identifies warning signs to compare against the candidate's history:

• degrees earned out of sequence, or considerably faster than a standard programme would allow;
• a school located far from where the applicant lived or worked at the time;
• a name that closely resembles that of a well-known institution;
• a school website that charges per degree or awards credit for "life experience".

Our guide to certificate fraud describes in more detail how forgeries are produced and detected.

Confirm with the issuer or the register that answers for it

The most reliable check is confirmation from the issuing institution itself. In several countries a service responds on the institution's behalf:

• United States: the National Student Clearinghouse offers DegreeVerify, which employers use to confirm degree and attendance records online. The Clearinghouse states that it covers 96% of degrees from US four-year institutions.
• United Kingdom: Higher Education Degree Datacheck (HEDD) describes itself as the UK's official degree verification service. It is operated by Prospects, part of Jisc.
• Spain: the Registro Nacional de Titulados Universitarios Oficiales, maintained by the Ministry of Science, Innovation and Universities, allows graduates to authorise a third party to consult their official university degrees. The authorisation is issued as a PDF bearing a secure verification code (CSV) and a QR code. Only official degrees are recorded: a university's own non-official qualifications (títulos propios) are not.

Where no register exists, write to the institution's registrar or examinations office, using contact details obtained independently, and request confirmation of the name, the qualification and the date of award.

Assess the verification link before relying on it

Digital certificates increasingly carry a link or a QR code leading to a verification page maintained by the issuer or its provider. It is the most direct check available, provided the page is genuine. Before relying on it, confirm that the address belongs to the institution or to a verification service the institution names on its own website. Where the certificate also displays a code, open the service's verification page independently and enter the code, rather than following a link from the document.

A well-designed verification page states who issued the certificate, to whom, for what and when, and whether it remains valid. If the certificate has been withdrawn, the page should say so; if it was corrected and reissued, the page should direct the reader to the certificate that replaced it.

Documents issued abroad

Under the Hague Apostille Convention of 5 October 1961, a public document issued in one contracting state can be certified for use in another by a single certificate, the Apostille, issued by a competent authority in the document's country of origin. The Hague Conference lists academic diplomas issued by public institutions among the public documents the Convention covers. Since 2006, the Hague Conference's e-Apostille Programme has supported authorities in issuing Apostilles electronically; according to the Conference, an e-Apostille and a paper Apostille are equally valid.

An Apostille certifies the origin of the document: the signature, the capacity of the signatory and, where applicable, the seal. It does not certify the content of the document.

In the European Union, European Digital Credentials for Learning (EDC) are digital credentials sealed by the issuing organisation. According to Europass, any alteration of the file breaks the seal and causes the verification checks to fail.

A checklist for HR and admissions

1. Record the issuer, the recipient, the qualification, the date and any code or link.
2. Confirm that the institution exists and is recognised by the competent authority.
3. Compare dates and locations with the candidate's CV.
4. Confirm with the institution, or a register that answers for it, using independently obtained contact details.
5. For digital certificates, confirm that the verification page is genuine, then review the certificate's status.
6. For foreign documents, establish whether an Apostille or an official recognition is required.
7. Keep a record of what was checked, when and with whom.