How to Spot a Fake Diploma and Verify Education Credentials

To spot a fake diploma, do not rely on how it looks. A diploma, transcript or certificate is a document the candidate controls, so confirm the credential with the institution that issued it, through its registrar or an agent it authorizes, and confirm that the institution itself is real and recognized. Appearance gives you questions to ask. Independent confirmation settles them.

This guide is for HR, background-screening, admissions and licensing teams in the United States and Canada. It covers red flags, school recognition, education verification, foreign degrees, certificates and licenses, a worked example and fair-screening duties. It is not legal advice. Admissions offices checking transcripts, test reports and other application files can follow the transcript verification workflow for admissions.

How to spot a fake diploma: the checks that settle it

To spot a fake diploma, use checks that bypass the document and produce evidence from the issuer or a recognition authority:

Everything on the document is a clue. A degree title the school does not offer or a date that does not fit tells you what to ask; it does not prove the document is fake. A flawless document proves nothing either, because templates and editing software produce clean results. The flow below shows the order: check that the school is recognized, confirm the degree with the issuer, then act on the answer.

Red flags on a fake diploma, transcript or certificate

The red flags on a fake diploma are mismatches, and each is weak on its own: real records contain exceptions, and a careful forgery avoids the obvious ones.

The FTC's guide for employers lists a master's with no bachelor's, a degree earned very quickly or several in one year, and sound-alike school names as warning signs. FTC, researching academic credentials The Council for Higher Education Accreditation (CHEA) adds purchasable degrees and little required attendance, and says several features together are the signal. CHEA, diploma mills and accreditation mills

Check that the school is real and recognized

To check that a school is real and recognized, look it up in lists that governments and recognized accreditors maintain, and treat its website and claimed accreditor as claims to test; the FTC notes that a .edu address does not guarantee legitimacy. FTC, researching academic credentials

United States

• Department of Education. The Department's DAPIP database of accredited postsecondary institutions and programs is fed by reports from recognized accrediting agencies. Department of Education notice, March 2026
• CHEA. Its database lists institutions and programs accredited by recognized U.S. accrediting organizations; "recognized" means reviewed for quality by CHEA or the Department. CHEA, about accreditation
• Accreditation mills. Some diploma mills claim accreditation from a bogus agency, so confirm the accreditor itself is legitimate; CHEA's signs include accredited status that can be purchased and a false claim of recognition. CHEA fact sheet

A school missing from both lists is not listed as accredited by a recognized accreditor. That does not by itself make a diploma fake, but it moves the case to the registrar and to your policy on unaccredited degrees.

Canada and schools abroad

The Canadian Information Centre for International Credentials (CICIC) lists institutions currently recognized, authorized, registered or licensed by provincial and territorial authorities in its Directory of Educational Institutions in Canada. It states that there is no official list of recognized institutions outside Canada, so confirm a foreign school with the competent authority in its country, usually the education ministry or a quality-assurance body. CICIC, institutions outside Canada

Education verification: how to verify a degree

Education verification, also called diploma verification or degree verification, means asking the institution, or an agent it authorizes, to confirm that a named person was awarded a named credential on a stated date.

Registrar confirmation

Find the registrar's phone number or portal yourself, from the institution's website or an earlier known contact, and not from the diploma, the application or a message from the candidate. The FTC says most registrars confirm dates of attendance, graduation and degrees awarded, and warns that some "verification services" may send fake transcripts. FTC, researching academic credentials Ask for the credential title, major, conferral date and honors, and record where you sent the request.

United States: the National Student Clearinghouse

The National Student Clearinghouse verifies degrees for participating schools and describes DegreeVerify as nationwide coverage of U.S. degree and attendance records. Clearinghouse, business verifications Its help center says to obtain the individual's signed consent first, that a record may be unavailable because of timing, and that for a school not on its participating list you contact the registrar. Clearinghouse, verification FAQs No match is a reason to call the registrar, not a finding.

FERPA and consent

FERPA governs what a U.S. school may release. Directory information is information that would not generally be considered harmful if disclosed, and it includes degrees, honors and awards received and dates of attendance. 34 CFR 99.3 A school may disclose the items it has designated as directory information after giving current students public notice and a chance to opt out, and may disclose them about former students without new notice but must keep honoring an opt-out made while they were enrolled. It may not disclose or confirm directory information without written consent if a student's Social Security number or other non-directory information is used to identify the student. 34 CFR 99.37 Beyond directory information, release generally requires signed and dated consent specifying the records, purpose and recipient. 34 CFR 99.30 Opt-outs and school designations vary and requests that identify the candidate by Social Security number or other non-directory details need consent in any case, so collect a signed release routinely.

Canada: registrars and MyCreds

Contact the registrar and obtain the graduate's written consent. MyCreds (MesCertif in French) is a national digital wallet for academic and professional credentials led by the Association of Registrars of the Universities and Colleges of Canada, and the service states that a document received through it needs no further verification. MyCreds Institutions are still joining, so a credential that is not in MyCreds is not a finding.

Digital and verifiable credentials

The W3C Verifiable Credentials Data Model 2.0 became a W3C Recommendation on May 15, 2025, W3C and Open Badges 3.0 aligns with it. 1EdTech, Open Badges 3.0 Check such a credential with the issuer's own verifier or verification link, not by inspecting a PDF or screenshot of it. W3C states that verification does not evaluate whether the claims are true, so confirm that the issuer is the institution you identified independently.

Foreign degrees: credential evaluation and the limits of an apostille

To verify a foreign degree, use the same registrar-first verification as for any degree, and add a credential evaluation only where the role or a regulator needs a comparison with local qualifications: verification shows the degree was awarded, and the evaluation reports how it compares.

United States. One federal agency's hiring page makes foreign-education evidence the applicant's responsibility and links to the list of evaluation services published by the National Association of Credential Evaluation Services (NACES). USGS, foreign education The Association of International Credential Evaluators (AICE) says its endorsed members follow its published standards. AICE Ask whether a report confirms the credential with the issuer or covers only the documents supplied.

Canada. Immigration, Refugees and Citizenship Canada (IRCC) requires an Educational Credential Assessment (ECA) for some immigration programs, such as eligibility under the Federal Skilled Worker Program and points for foreign education in Express Entry, from one of five designated organizations or, for specific occupations, a designated professional body, and says an ECA verifies that a foreign credential is valid and equal to a Canadian one. IRCC, educational credential assessment

What an apostille does and does not prove

An apostille, which replaces legalization between countries that are party to the Apostille Convention, HCCH, Apostille Section certifies the authenticity of a signature, the capacity in which the signer acted and, where appropriate, the identity of the seal or stamp. Apostille Convention, article 5 The HCCH handbook states that it does not relate in any way to the content of the underlying public document, and gives the example of a birth certificate, where the apostille does not certify that the name and date of birth are true. HCCH, Apostille Handbook An apostille on a diploma therefore shows that a signature or seal was authenticated, not that the degree was earned.

Fake certificates and licenses

To check a fake certificate or license, go to the body that issues or regulates it and look the holder up there, never at the copy the holder provides.

• Professional licenses. In the United States, Nursys offers a free QuickConfirm lookup whose data come directly from participating boards of nursing; it covers only participating boards and only nursing licenses. Nursys In Canada, CICIC's Directory of Occupational Profiles identifies the organizations responsible for recognizing professional qualifications in each province and territory.
• Training cards. OSHA does not verify individual Outreach training cards and operates no national database for them; the QR code on a plastic card leads to the contact for the training organization that processed it. OSHA, Outreach FAQs
• Language test results. Organizations that accept IELTS can use its free IELTS Results Service to look up a result by Test Report Form number and verify the test taker's identity and score. IELTS, verifying results

What file analysis adds, and where it stops

When a transcript or certificate arrives as a PDF, Word or PowerPoint file, Fileverity document verification records the creating and saving software, dates, recoverable saved revisions and file structure and, for Word files, revisions, comments and hidden content. It assesses PDF digital signatures as valid, invalid or indeterminate against configured trust material, reads scanned pages with OCR, checks applicable amount and date relationships and sends eligible embedded photos to its FVIMG V2 image model. It flags passages that read as AI-written, using its FVDOC V3 model, with page or paragraph references. Each report carries a risk level from L0 to L5 and the file's SHA-256 hash and, when validation succeeds, an RFC 3161 trusted timestamp, and can be checked on the verify page. For a phone photo or scan of a diploma, image verification assesses whether the image appears AI-generated or locally edited, with localization, Content Credentials and machine-readable AI labels.

These are leads: a transcript last saved in a general-purpose PDF editor long after it was issued is worth a call to the registrar, but candidates also merge and re-save files, so editing software alone is not proof; the PDF edit-checking guide covers these fields, and the guide to document fraud detection helps match tools to tasks. Fileverity does not confirm that a degree was awarded, that an institution is accredited or anyone's identity, and it does not examine paper, seals, embossing or ink. A negative result never clears a credential. The matrix below compares what each check in this guide can and cannot establish.

Worked example: a transcript PDF and a phone photo of a diploma

Consider a hypothetical hire. Maple Row Analytics requires a bachelor's degree for an analyst role and verifies degrees with the issuer before every offer. A candidate lists a degree from Kestrel Valley University, a fictitious foreign university, with graduation in June 2019, and submits a PDF transcript and a phone photo of the diploma. All details are hypothetical.

The education ministry's own list, found independently, shows the university is recognized, which says nothing about the candidate. The team records the file findings as leads, ignores the contact details on the transcript, takes the registrar's contact from the university's website and sends the request with the candidate's signed consent. The reply decides the next step:

• The candidate explains. A final module was completed a year late, and the registrar confirms the different conferral date. The requirement is met on verified data; proceed and record the confirmation.
• No explanation. The degree is confirmed as 2020, so the requirement is met, but the transcript is unreliable. Follow the written policy as for every candidate: proceed on the registrar's confirmation or require an official transcript from the registrar, and record the discrepancy in neutral terms.
• No degree confirmed. Ask for other evidence by a stated date. If none arrives, decline because the degree could not be verified and send any required notice. The record does not accuse the candidate of forgery.

Fair and lawful education verification

Apply the same verification steps and standard to every candidate, and write them down before screening begins. The EEOC and FTC say employers using background information, which can include education, must not discriminate on the basis of national origin or other protected characteristics, and should apply the same standards to everyone. EEOC and FTC, background checks Verify every listed degree the same way, apply the same foreign-credential steps to every foreign credential, require an evaluation only where the role needs one, and never select candidates for extra scrutiny because of their name, accent or origin.

If a screening company verifies education for an employer, the Fair Credit Reporting Act applies to the report. The employer must give a standalone written disclosure, obtain written permission, send a pre-adverse action notice with a copy of the report and a summary of rights before acting, and send an adverse action notice afterward. FTC, employers State and local laws may add requirements.

In Canada, PIPEDA covers personal information collected, used or disclosed in the course of commercial activity and the employee information of federally regulated organizations, and its principles include consent and limiting collection; Alberta, British Columbia and Quebec have their own private-sector laws, and other provincial employers and public bodies should confirm which law governs them. Privacy Commissioner, PIPEDA in brief Collect only what the decision needs.

A reusable credential verification record

Keep observation, inference and confirmation separate, and store identifiers in the controlled record.

"Conferral date differs from the application" is an observation. "Registrar confirmed June 2020" is confirmation. "Declined because the degree could not be verified" is a decision. Collapsing them into "fake diploma" discards the facts a second reviewer needs. The SHA-256 and trusted timestamp guide explains how to bind the record to the exact file reviewed.

Common questions

How can I verify someone's degree?

Ask the issuing institution's registrar, or the verification service the school authorizes, to confirm the credential, using contact details you found yourself and the candidate's written consent. Then confirm the school is recognized.

How long does education verification take?

It depends on the route. The Clearinghouse describes DegreeVerify as instant but gives no fixed time for results it emails after a request, and a manual registrar process, a closed school, a foreign institution or an evaluation can take longer. Build the check in before the offer.

Is it illegal to use a fake diploma?

Often, yes, depending on the place and the use. In the United States there is no single rule: Texas makes it a Class B misdemeanor to use or claim a degree the person knows is fraudulent, substandard, fictitious, not granted to the person or revoked, with intent to obtain employment, a license, a promotion or admission to a Texas educational program, or in advertising a business, Texas Penal Code section 32.52, as added by H.B. 1173 and knowingly and willfully making or using a false writing or document containing a materially false statement in a matter within federal jurisdiction can fall under 18 U.S.C. § 1001, which generally carries up to 5 years. 18 U.S.C. § 1001 In Canada, making a false document knowing it to be false, with intent that it be used or acted on as genuine to the prejudice of anyone, or that someone be induced by the belief that it is genuine to act or refrain from acting, is forgery under section 366 of the Criminal Code, using, dealing with or acting on a document known or believed to be forged as if it were genuine is an offence under section 368 with up to 10 years on indictment, and defrauding a person of property, money or services by deceit, falsehood or other fraudulent means can be fraud under section 380. Ask counsel about a specific case.

What is a diploma mill?

CHEA describes diploma mills as dubious providers whose degrees and certificates are considered bogus, and says there is no single definition. Indicators include purchasable degrees, little required attendance, degrees for experience alone, a very short time to a degree and no address or faculty list; an accreditation mill does the same for accreditation. CHEA fact sheet

Can AI-generated certificates be detected?

Sometimes, but detection never proves a credential is real. Fileverity's image model assesses whether a photographed or scanned certificate appears AI-generated or locally edited, and its document analysis reports file records and signature status. A negative result never clears a credential, so the issuer's confirmation settles the case.

By Yang Zheng · Reviewed by Bill Liu