How to Spot a Fake Certificate of Insurance (2026 Verification Guide)

A certificate of insurance is the document you rely on to prove a vendor is covered. It is also, unhelpfully, one of the easiest business documents in the world to fake. The ACORD 25 form is publicly available, and anyone with a PDF editor can change a name, a limit, or an expiration date in a couple of minutes.

The motive is obvious. Commercial general liability and workers' compensation are expensive, and a contractor who cannot afford coverage — or who let it lapse last month — still wants the job. Handing over a doctored PDF is the path of least resistance, and most of the time nobody checks.

The consequence lands on you, not on them. If an uninsured vendor causes injury or property damage on your site, the claim looks for the nearest solvent party. That is usually the business that hired them, which is the same exposure covered in our guide to the real cost of a lapsed vendor policy.

One honest note before the tactics: you will see confident-sounding statistics about what share of certificates are forged. We have not found a credible source for that number, so we are not going to invent one. What is well documented is the scale of insurance fraud overall — the Coalition Against Insurance Fraud puts the total cost at roughly $308 billion a year in the United States, and the FBI estimates non-health insurance fraud alone exceeds $40 billion annually. Certificate fraud is a small, poorly-measured slice of that, but it is a slice that lands directly on the business that accepted the document.

Most articles on this topic only address forgery. In practice, the second failure mode is far more common and costs businesses more money, because it passes every visual inspection.

A forged certificate is a document that was altered or fabricated. A real-but-useless certificate is entirely genuine — issued by a licensed producer, accurate on the day it was written — and still fails to protect you. It expired six weeks ago. It names a different legal entity. It lists your company as certificate holder but never added you as an additional insured, so you have proof that someone else is covered.

Both leave you uninsured. Only one of them involves anybody lying. If you build a verification process that only hunts for fraud, you will catch the rare forgery and wave through the common failure — so check for both, every time.

Start with the certificate in front of you. None of these is proof of fraud on its own, but each is a reason to verify before accepting.

The single most telling signal is who sent it. A certificate of insurance is issued by a licensed producer — an agent or broker — on behalf of the carrier. A vendor cannot legally issue their own. If the PDF arrived attached to the vendor's email with no producer involved anywhere, that alone justifies a call to the agency named on the form.

Reading the document tells you whether it looks right. Only these steps tell you whether the coverage exists. Work through them in order; each one is cheap, and you can stop as soon as something fails.

If someone is going to alter a certificate, the endorsement boxes are the easiest place to do it and the hardest place for you to catch it. Ticking a box takes one keystroke; the underlying endorsement either exists on the policy or it does not.

This is also where honest certificates fail. A producer may accurately record that no additional insured endorsement was requested, and the certificate is completely truthful — it just doesn't give you the protection you assumed you had.

The distinction between being a certificate holder and being an additional insured is the one that catches most people out, and it is worth understanding properly. We cover it in detail in additional insured vs. certificate holder.

Separate the two cases before you act, because the right response is very different.

If the certificate is simply out of date or missing an endorsement, this is an administrative problem. Tell the vendor precisely what is missing, ask their broker to issue a corrected certificate, and hold the work until it arrives. Most vendors fix it the same day.

If you believe the document was deliberately altered, treat it as a contractual and legal matter. Stop the vendor working immediately — every hour they remain on site is uninsured exposure sitting on your balance sheet. Preserve the original file and the email it arrived in. Notify your own broker or risk manager, and check what your contract permits regarding suspension or termination.

Forging a certificate of insurance is a criminal offense in most US states, frequently charged as felony forgery or insurance fraud, though the specific classification varies by state. You do not need to decide the legal question yourself. Document what you have, escalate it, and take advice.

Everything above is straightforward for one certificate. The difficulty is that a mid-sized property manager or general contractor is holding dozens or hundreds of them, each expiring on its own date, each needing the same checks again at renewal.

This is where manual processes quietly fail. Not because anyone is careless, but because the work is unbounded and invisible until something goes wrong. A spreadsheet records what you typed into it; it cannot tell you that a policy was cancelled in March, and it will not chase anybody. We look at where that breaks down in COI tracking in spreadsheets.

What scales is separating the two halves of the job. Extraction and expiry monitoring are mechanical and should be automated. Authenticity judgment — the producer call, the endorsement request, the decision to stop a vendor working — is human work that benefits from being surfaced early rather than discovered late.

Software should tell you which certificates need a human look and chase the routine renewals on its own. That is deliberately how CoverSynx is built: it reads each certificate, checks it against your requirements, flags what is missing, and emails the vendor before a policy lapses. It assists verification; it does not certify coverage, and it is not a substitute for the producer call on anything that looks wrong.

These are the errors that show up again and again in real compliance files.

You do not need a risk department to close most of this gap. Three rules do the bulk of the work, and they cost nothing to implement.

First, certificates come from brokers, never from vendors. Put it in the contract and in the onboarding email. Second, no certificate, no site access — and no exceptions for people you have worked with for years, because familiarity is exactly how lapses persist unnoticed. Third, every certificate gets a diarized expiry date and is re-verified at renewal, not merely re-filed.

If you want the full adequacy check to run alongside the authenticity check, our vendor COI requirements checklist covers what to confirm on every certificate, and how to track certificates of insurance covers the collection and renewal process end to end.