September

Somewhere, somebody has finished a degree and posted a photograph of the certificate on LinkedIn. The gown, the grin, the paper held up to the camera. Every summer, LinkedIn fills with the same photograph.

That photograph is also a security document, taken in good light, and published where anyone can find it.

A case we handled at Verifile began with a photograph like that one.

A candidate had applied for a job at a multinational bank, and the bank asked us to verify his degree.

We'll call him Adam*.

The lesser award

Adam declared a Bachelor of Science in Finance from the University of Reading, awarded about eighteen months earlier. Last October our client asked us to verify the degree.

What Adam achieved through the University of Reading was not a bachelor's degree. It was a Certificate of Higher Education in Business, or in the university's own words, "a lesser award".

The Department for Education puts a Certificate of Higher Education at the same level as the first year of a bachelor's degree. A bachelor's degree with honours is two levels higher and takes three years. Adam had about one year of study, and he had claimed three.

There was even more in the university's record. Adam had begun a pharmacy degree at Reading a few years earlier and left it without finishing, then started again with the finance course in mind.

He had been a student at Reading. He had claimed a bachelor's degree he did not have.

The certificate

Most checks would stop there. We had the answer our client had asked for, and the discrepancy was plain.

Nevertheless, we went further because a discrepancy that size can also be somebody's mistake, and a mistake left uncorrected would cost Adam his career. We asked Adam for a copy of his bachelor's degree certificate, so the document itself could go in front of the university.

He sent the certificate the next day.

Almost nobody really looks closely at a degree certificate. You look at it, the crest is in the right place, the name matches the CV, and you move on to the next thing in the pile. This certificate would have passed that look. It gave Adam a 2:1, and nothing about it invited a second glance.

We sent the certificate to the University of Reading and asked whether the certificate was theirs. The answer came back within the week.

"I can verify that the information we have already given is correct... The University cannot verify the attached document as official.

The University considers that the document may be forged and is therefore undertaking further investigations. The student number on the certificate does not match this student's name.

We will then undertake further investigations and submit these to the Head of Governance and the University Secretary for a review."

One line in there did the work. The student number on the certificate does not match this student's name. The student in question was Adam.

This certificate carried Adam's name above somebody else's student number. And Adam had a student number of his own, because he really had studied at Reading.

The number that belonged to somebody else

Curiosity got the better of our team. One of them went looking through other Reading certificates, to see where that student number might have come from. Hundreds of images came back, which is what happens when you search for a document that thousands of people are proud of. Among them was a LinkedIn post from a real graduate, holding up their certificate, exactly the photograph anybody would take.

The student number on that graduate's certificate was also the student number on Adam's.

What our team felt was shock, and then a kind of amusement at the lengths Adam had gone to.

Now the typography made sense. The course name and the date both sit in the wrong typeface, and those are two of the three things Adam had to change. The third was the name. The student number did not have to be changed at all, so Adam left the student number where it was, and the student number was the one thing on the page that led back to a real person.

We do not know how many employers had taken this certificate at face value before us. Or background screening providers.

What we could not finish

The University of Reading's last word referred the matter to its Head of Governance and University Secretary, and the university never told us what they decided. Nobody put the graduate's LinkedIn post to Adam, and we never learned what our client did next.

What settled this case was not a close reading of the document. It was asking the University of Reading, because the university was the only party that could confirm the award. And it was going back a second time when the first answer did not add up, because accuracy has to work in both directions. The same second look that caught Adam is what would have cleared him, had the university been the one who got it wrong.

The certificate that made all of this possible had been sitting in public the whole time, in good light, at a resolution somebody else could work from.

Names and certain details have been changed for confidentiality.

If you have a degree, your certificate is likely to be in a drawer at home, or in a folder of old paperwork. You looked at it properly on the day it arrived and probably not since.

That sheet of paper stands for three years of work, and your family came to watch you collect it. Your name is printed in the middle.

Take the name off and the page would fit anybody.

One of our cases at Verifile was about the name on a certificate. A property firm had offered a candidate a job as a client onboarding analyst, and asked us to verify the law degree on her application.

We'll call her Rachel Marian Doyle*.

A routine verification

Rachel had declared a Bachelor of Laws (LLB) from Southampton Solent University, awarded more than fifteen years earlier. The verification began the way most of them do. The university needed her signed consent, we asked her for it, and she returned it promptly.

Before the university would confirm anything, it wanted to see the certificate itself. That request is routine and does not mean anyone is suspicious. A degree awarded that long ago may not be in a university's electronic records, and somebody has to go and check the paper records.

Rachel sent her certificate over and we passed it on.

The university did not confirm the degree. Instead, it asked us a question. The certificate said Marion Doyle, but our request was for Rachel Marian Doyle. Had Rachel been awarded the degree under the name Marion Doyle?

A careful reader would have found nothing wrong with that certificate, because there was nothing wrong with it. The crest, the wording, the signatures and the year were all exactly what they should be. Only the name did not fit, and the name was the one thing Rachel had an explanation for.

The most ordinary explanation in the world

Rachel told us she had been known as Marion Doyle while she was studying.

Taken on its own, a different name at university is not a red flag and it should not be treated as one. Plenty of people go by a middle name rather than a first one. Spellings drift, families use one form while the paperwork uses another, and the name somebody used at nineteen is often not the name on their passport at forty. We see this constantly, and almost every time there is nothing behind it.

What is harder to explain is being formally enrolled under that name. A university registers a student under the name on their documents, not the name their friends use. And the name on the certificate was not simply her middle name. It was her middle name spelt with one different letter.

Rachel's passport does not carry the middle name at all. Her driving licence carries it as Marian.

Then Rachel did something candidates in her position rarely do. She sent a second document to support the first, a university student card in the name on the certificate, with Rachel's photograph on it.

The card has a thin red box printed on it for the photograph. The photograph does not sit inside the box. It crosses the printed line on two sides.

We noted where the photograph sat and carried on, because a photograph in the wrong place is something you can see and not something you can prove. But the second document did keep the case open. A document sent to prove another document proves nothing until the university that holds the record confirms it.

The date of birth

A university verification is usually finished in days. This one had been running for almost a week and had produced a new question at every step, and by this point it had stopped feeling routine.

The university replied once more. Before it would say anything about the degree, it wanted the date of birth of the person who had earned it.

We took the date from Rachel's passport and her driving licence, which both show the same date, and sent it that afternoon.

The answer arrived the same day.

“Hello - unfortunately, we do not have a candidate on our records with the name '[Marion Doyle]' with the date of birth [removed].”

Whose certificate was it

A forged certificate would have carried Rachel's own name. Carrying the right name is the entire point of forging a certificate, and a forger who prints the wrong name has created a problem where none existed.

Our team could see only one explanation. The certificate is real, it records a real degree, and the woman who earned it is not Rachel.

The student card needs explaining too. Rachel did not only hold that woman's degree certificate. She also held that woman's student card, from the same university and the same year as the certificate. A student card does not get passed around. It stays with the person it was issued to, or it is thrown away.

Nobody holds a stranger's student card. People who share a house hold each other's.

They also share a surname.

We have seen family names used this way before, near-identical names inside one family, and a relative's certificate is the explanation that fits the facts. Nobody established it, and nobody asked the university to.

One question is still open. Somewhere there is a woman who earned that law degree, and either she handed over her certificate and her student card, or she has no idea that any of this happened.

The part that stays with you

Look again at what Rachel did after the university's first question.

She was asked to explain the name, and she explained it. She was asked to prove the explanation, and she found a document and sent it in. She was asked for a date of birth, and she gave the real one, from her real passport, for the university to check.

The university pushed back twice, with a sharper question each time, and Rachel kept going.

In the end, the answer was in documents we already had. Rachel's passport and driving licence, which we verified at the start, carried her date of birth, and the university had no Marion Doyle with that date on its records.

Names and certain details have been changed for confidentiality.

The candidate answered in a day.

In screening, that usually means somebody organised, somebody who wants the job and keeps their paperwork where they can find it. A quick reply is the one you hope for.

Here, it was the first thing that gave him away.

A client had asked us to check his criminal record in Dubai, where he had lived and worked for years.

We'll call him Martin*.

The check that has to go through the candidate

We can usually ask the organisation that holds the record. A university confirms a degree. An employer confirms a job. The answer comes back from the organisation holding the record, and the candidate never touches it on the way.

Criminal records are different. In some countries the law lets us ask for a candidate's record ourselves. In others, the law does not, and the record can only be released to the person it belongs to. The UAE, and specifically the Dubai Police Clearance Certificate, is one of those. For Dubai, we ask the candidate to get their own Police Clearance Certificate, which is what a criminal record check in Dubai produces, and to send it to us. Then we check what arrives. A request a person has to make for their own records has a name, and the name is a subject access request.

The certificate therefore reaches us from Martin, and not from the Dubai Police.

Altering any document is fraud, whatever the document is. The ones we most often see altered are employment dates and degree grades. This was a criminal record certificate, and a criminal record check is arguably the most important check anybody runs. Many of our clients ask for one in every country a candidate has lived in during the period being verified, not only the one they live in now. Martin had spent years in the UAE and Dubai, so it was on the list.

We sent Martin the instructions. The certificate came back the next day, as a PDF.

Two things that could not both be true

A Dubai Police certificate takes twenty-four hours to two days if you apply from inside the UAE. From outside, it takes three to five days. Martin was applying from outside the UAE.

Then we looked at the date on the certificate itself.

It had been issued five days before we sent him the instructions.

Martin had not been quick. The certificate had existed before we asked for it.

The service that checks itself

We could not ask the Dubai Police for Martin's record. We could ask them about the certificate he had sent us, because the Dubai Police run an online verification service. Enter the reference number and the security code printed on a certificate, and the service confirms whether the certificate matches a real record.

We entered Martin's reference number and security code.

The service returned two words. Document Expired.

The message shows for a few seconds and then disappears. Our verifier had to read it and screenshot it before it vanished.

Printed on the certificate itself, inside a red box near the foot of the page, is the line that makes the result impossible.

"This certificate is valid for three month."

A certificate really issued five days earlier could not have expired.

The Dubai Police database holds the date the certificate was really issued. Martin's certificate showed a different date, printed on the document itself. The database was right, and the certificate had run out long before Martin sent it to us.

We told the client what the database had returned. We also sent them our own comparison of Martin's certificate against a genuine one, so they could see the difference for themselves.

The parts nobody thinks about

We had the answer our client had asked for. We went further, and put Martin's certificate side by side with a Dubai police certificate belonging to another case, one we had already checked against the database and knew to be genuine.

A Dubai police certificate carries two crests along the top of the page. One belongs to the Government of Dubai and one belongs to the Dubai Police.

On the genuine certificate, the Government of Dubai crest is the one the emirate adopted in 2024. On Martin's certificate, it is the crest the emirate used before then.

The Dubai Police crest, printed beside it, is the same on both documents. Of the two crests on Martin's page, one is right and one is years out of date.

To the right of the two crests, both certificates name the department that issued them, the General Department of Criminal Investigation. On the genuine certificate those words sit in one typeface. On Martin's they sit in another, at a different size, and they do not line up the same way.

And along the bottom of Martin's certificate, on a document supposed to be weeks old, is the logo for Expo 2020. What the team felt when they found it was amusement, at an oversight nobody had thought to look for.

What Martin probably did

Nobody had asked us to look at Martin's CV. It had been uploaded with the rest of his file, so we read it, and it showed exactly when he had been working in Dubai.

Anybody employed there at that time would have needed a Police Clearance Certificate, and would have gone through the proper process to get one. Our team's reading is that Martin already had one, and that he changed the date on it instead of applying for a new one.

Why he did that, when a new certificate would have taken a week, is the one thing in the file nobody can answer.

What to do when a document comes from the candidate

Where the law puts the candidate in the middle, they stay in the middle. What an employer can change is what happens after the document lands.

Ask the body that issued it whether they will confirm it. Many now run an online service where you type in the certificate's own reference number and get an answer back in seconds, and that answer is worth more than an hour spent looking at the page.

Get hold of a genuine certificate of the same kind and put the two side by side. If you have not got one, search for images of the document online. Plenty of people publish redacted copies, and even a rough idea of what the real thing looks like will tell you whether the crest, the colours and the fonts are right.

Then look at the document as an object rather than as information. Are the lines clean? Is everything aligned? Does any part of it look unprofessional, or simply odd?

Check the date it was issued against your own records. A certificate dated before you asked the candidate for it needs explaining, and so does one that came back faster than the issuing body could have produced it.

And read the top and the bottom of the page. On Martin's certificate, those two strips carried the old emblem and the Expo 2020 logo, and both had survived every other change he made.

What settled it

A document that reaches you through the person it describes tells you what that person wanted you to know. It becomes a verification at the moment somebody asks the source. In this case, the source was a database, and Martin's own certificate carried the number that let us ask it.

Names and certain details have been changed for confidentiality.