How would a fake certificate normally get through?

The usual failures are cover expiring the week after it's sent, the insured party being a different legal entity to the one signing the contract or a PDF that's been visually edited to bump up cover levels. The twelve checks above catch all three.

Do I need to run every check for every supplier?

For low-risk suppliers, the first six are usually enough. For high-risk work (site-based, safety-critical, handling personal data) run the full twelve and verify with the issuer directly.

How do I verify with the issuer?

Most large insurers and certification bodies have an online policy or certificate lookup. If not, a short email to their broker or admin team quoting the certificate number will confirm it in a day.

What's a UKAS-accredited certification body?

UKAS is the UK's national accreditation body. An ISO 9001 or ISO 27001 certificate issued by a UKAS-accredited body is properly recognised. A certificate from a non-accredited body means the audit process itself is unverified.

Can this be automated?

Yes. Credbase reads the issuer, insured name, policy number, dates and cover levels from an uploaded certificate, matches them against Companies House and your minimum requirement and flags any check that fails - so you don't have to run the twelve manually.

Free tool

Certificate authenticity checklist

Twelve quick checks to confirm a supplier's insurance or ISO certificate is real, current and issued to the entity you're contracting with.

Who this is for

Ops and compliance leads accepting supplier certificates on trust today
Procurement teams onboarding contractors into safety-critical work
Anyone burned once by a certificate that turned out to be wrong

Problem it solves

A quick glance at a PDF is not verification. Twelve checks in a row - issuer, insured entity, dates, cover level, scope, signature - catches the failure modes that actually happen: lapsed cover, wrong legal entity and edited PDFs.

How it works

Step 1
Open the certificate
Have the PDF or scanned copy in front of you before you start.
Step 2
Tick each check
Work top to bottom. Anything you can't tick is worth querying with the supplier or issuer.
Step 3
Save the result
Copy or download the completed checklist as your record that this certificate was verified.

Questions and answers

Where this tool stops

A checklist verifies one certificate. You get one a week.

Running twelve manual checks on every certificate that lands in your inbox is fine for one supplier - it does not scale to hundreds and it is easy to skip a step when you are busy.

Credbase runs the same checks automatically on every uploaded certificate, extracts the key fields and flags anything that looks off.

Verify certificates in Credbase Back to all tools

This tool is a plain-English guide for teams handling third-party paperwork. It is not legal, insurance or compliance advice. Confirm specifics with the counterparty or your own adviser before you rely on any output.

Certificate authenticity checklist

Who this is for and what it solves