The fake certificate problem and verifiable document infrastructure for institutions

Where does the problem start?

Certificates for accredited training are still issued mostly on paper or as PDFs. A PDF can be edited in minutes; names, dates and programme titles can be changed, and logos, signatures and stamps copied exactly. Someone looking at the document usually cannot tell the difference.

When YÖK brought the certificate programmes of continuing education centres under central evaluation from 1 October 2026, it explicitly listed fake documents and certificate inflation among the reasons (memurlar.net (opens in a new tab), Anadolu Agency (opens in a new tab)). There is no reliable public statistic on how widespread fake certificates are; this article deals with how to prevent them, not with the size of the problem.

Types of fake documents

• Fabricated document: A certificate that was never issued, imitating a real institution's design.
• Altered document: A genuine certificate with its name, date, duration or credit changed.
• Use of a revoked document: A distributed copy of a certificate the institution withdrew as erroneous or irregular.
• Fake verification page: A QR code or link on the document that leads to a page resembling the real institution.

Why are today's verification methods insufficient?

Employers and public bodies usually call the issuing unit or send an official letter. The limits are clear:

1. Replies can take days, and none arrive outside office hours.
2. Much of this correspondence is not recorded.
3. Each university verifies differently; some have a verification page, others do not.
4. Revocation never reaches distributed copies.
5. Printing the Turkish ID number on certificates spreads personal data wherever the document goes. The Turkish data protection authority's guide on ID numbers (opens in a new tab) asks for less intrusive methods.

Components of a verifiable document infrastructure

The reliable way to tell whether a document is fake is to turn it from an image into a signed data record. This takes five components:

A verification statement is a block on the printed or PDF certificate that cannot be removed: verification address, QR code, certificate number, issue date and the first characters of the document's digest (SHA-256). These values match those on the verification page, so someone looking at a PDF can compare it with the record (verification statement).

Checklist for institutions

1. Generate certificate numbers from one source. Do not let the same certificate circulate under different numbers.
2. Record the approval chain. The name and title printed on the certificate should come from the person who actually approved it, with every approval stored with user and time. Some directives require several signatures; the ITU SEM Directive (opens in a new tab), for example, requires three.
3. Publish revocation immediately. When an erroneous certificate is revoked, the information should reach every copy at its next verification.
4. Do not print ID numbers in clear. Carry identity as a hash; keep the number itself encrypted in the institution's record.
5. Announce the verification address. Show the same address on the institution's website and on certificates, and advise employers to type it themselves.
6. Use a standard. An open standard such as Open Badges 3.0, rather than a closed format, lets certificates be verified at other institutions and in other wallets.

What can verifiers and holders do?

Infrastructure only works if those checking documents change habits too. Hiring teams and public bodies can check a certificate at the verification address, compare the issuer and details, run an identity check where needed and record the result. The steps are in How to verify a certificate.

Holders contribute by sharing the verification link rather than a file. A document shared by link is easier for the recipient to check and always shows its current status (Digital wallet).

What technical verification does not solve

A signed document proves that it is genuine and unchanged. Whether the training actually took place, whether the content was adequate and whether assessment was sound is ensured by the institution's quality assurance processes. YÖK's common quality criteria for SEM programmes and article 11 of the Micro-credentials Procedures and Principles regulate that side (details). The two complement each other: quality assurance guarantees what the certificate represents, the signature guarantees that it really comes from that institution.

DijiUni provides these five components for universities in one infrastructure; the problem-to-solution mapping, with sources, is on Why DijiUni?. To check a document now, use the verification page.