How to Spot a Fake Certificate of Insurance
A fake certificate of insurance rarely looks fake. It is usually a real ACORD 25 with one date changed, a limit edited, or a policy that was cancelled after the certificate was printed. This guide covers the ten red flags worth a second look, how to verify a certificate with the agent in about five minutes, and the gap a perfect certificate still leaves: whether the contractor is licensed at all.
To spot a fake certificate of insurance, check where it came from (the agent, not the contractor), whether the agency and insurer exist and match, whether the limits and dates are internally consistent, and whether the named insured matches your contract. Then verify it: call the producing agent on a number you found yourself and confirm each policy number, the dates and that the policy is in force today. A real certificate only proves coverage on the day it was issued, and says nothing about the contractor's license.
In this guide
How a fake COI ends up in your file
The ACORD 25 is a public form, and a certificate is a one-page PDF. Anyone with a PDF editor can change it, and most hiring parties file what they are sent without calling anyone. In practice, a certificate that doesn't reflect real coverage arrives in one of four ways:
Altered
A real certificate with the expiration date pushed out a year, a limit raised, or a coverage line added. The most common kind, because everything else on it checks out.
Borrowed
A genuine certificate for a different business — a related company, a former employer, a sub's sub — with the named insured changed or simply left as it was.
Forged
A certificate built from a blank form, with an agency, an insurer or policy numbers that don't exist.
Out of date
A real certificate for a policy that has since been cancelled or not renewed. Not forged, but just as empty: the certificate never updates itself.
The fourth is the one most likely to be sitting in your file today. It is also the one no amount of staring at the PDF will catch, which is why the real fix is verification at the source and COI tracking against each policy's own dates afterwards. If you're new to the form itself, start with what a certificate of insurance is.
10 red flags on the certificate
None of these proves a certificate is fake. Each one is a reason to verify it before you approve it.
It came from the sub, not the agent
Certificates are issued by the producer — the agency named in the top-left box. A certificate forwarded by the contractor has passed through the one pair of hands with a reason to change it. Ask for certificates to come straight from the agent.
You can't find the agency on your own
Search for the agency named as producer. No website, no state license, an address that doesn't exist, or a phone number that only appears on this certificate are all worth a call — to a number you looked up, not the one printed on the form.
The insurer and its NAIC number don't match
Each insurer on the certificate carries a five-digit NAIC company code. Look the insurer up with your state insurance department or the NAIC's company search: the code should belong to that company, and the company should be licensed to write insurance in your state.
The aggregate is lower than the per-occurrence limit
A general aggregate is the most a policy pays in a policy period, so it can never be less than the each-occurrence limit. A $2,000,000 occurrence over a $1,000,000 aggregate is a typo at best and an edit at worst.
The policy period is unusual
Most commercial policies run twelve months. A policy that runs two or three years, one that ends a day before it starts, or a certificate dated after the policy expired deserves a question.
Policy numbers look copied
The same policy number on rows written by different insurers, numbers that don't follow the same carrier's pattern, or a row with no policy number at all. Carriers have their own formats; inconsistency within one certificate is the tell.
The named insured doesn't match the business you hired
Compare the named insured to your subcontract, the contractor's W-9 and the name on their state license. A DBA, a parent company or a slightly different spelling may be legitimate — or may be someone else's policy.
The PDF shows signs of editing
Mismatched fonts or sizes in one field, text that sits off its line, a crisp date on an otherwise blurry scan, or a signature box that is blank or pasted in. Edited fields often look slightly different from the rest of the form.
Coverage you required is claimed only in the description box
"Additional insured" typed into Description of Operations, with no endorsement behind it, gives you nothing. The certificate says itself that it confers no rights; the endorsement form is the coverage. See certificate holder vs. additional insured.
The edition date is years old
ACORD revises its forms, and the edition date is printed in the bottom corner. A certificate dated this month on an edition from many years ago can mean an old template being reused instead of an agency's current system.
Checking a certificate field by field for coverage gaps rather than fraud is a different job: the COI audit checklist walks through the eight things to confirm before you approve any certificate.
How to verify a certificate in five minutes
You can't authenticate a certificate by looking at it. You can confirm it with the people who issued it:
Find the agency yourself
Look up the producer's phone number or email from the agency's own website or your state's agent license lookup. A forged certificate can carry a working phone number that goes to the forger.
Confirm the policies, not the PDF
Read the agent each policy number and ask them to confirm the named insured, the policy dates, the limits, and that every policy is in force today — not just when the certificate was printed.
Ask for the endorsement pages
If you require additional insured, waiver of subrogation or primary and noncontributory status, ask for the endorsement forms themselves. A real agency can send them; a forged certificate has nothing behind it.
Check the insurer
Confirm the insurer is licensed in your state and that its NAIC code matches, through your state insurance department or the NAIC's company search.
Have the next one sent to you
Ask the agent to send renewals and any notice of cancellation directly to you as certificate holder. Certificates that arrive from the agency are the cheapest fraud control there is.
Five minutes per certificate is fine for a new sub on a large job. Across a roster that renews all year it adds up, so most teams verify every new contractor at the source, then re-verify when a certificate trips one of the red flags above. Reading the endorsement forms themselves, not the boxes ticked on the certificate, is what insurance endorsement verification does. If you need a certificate from a contractor in the first place, see how to get a certificate of insurance.
A real certificate doesn't mean a licensed contractor
Suppose the certificate checks out: the agent confirms every policy, the limits meet your minimums, the endorsements are attached. You still know nothing about whether the contractor holds the license the work requires. Insurance and licensing are separate systems. A sub can carry a perfectly real general liability policy while their state license is expired, suspended or was never issued for that trade. Unlicensed work is its own exposure: in some states, California among them, an unlicensed contractor can't even sue to be paid, and the permit, the inspection and the owner relationship all run through you.
So verification has two halves. Confirm the certificate with the agent, and confirm the license with the state board: the name on the license should match the named insured on the certificate. Contractor license verification software checks the license against the state database and keeps the board's current status next to the certificate on the same record. To do it by hand, see how to verify a contractor license and what each license status means.
We verify the contractor, not just the document. A clean certificate and a suspended license can sit in the same file for months. Checking both is the only way to know the sub you hired can legally do the work.
What to do when a certificate is fake
Treat it as no certificate at all, and document everything:
- Stop work under it. Your subcontract or vendor agreement almost certainly makes current insurance a condition of being on site. Follow its notice terms.
- Notify the sub in writing and ask for a current certificate sent by their agent directly. Sometimes the answer is an honest mistake — an old certificate forwarded by an office manager.
- Tell your own agent. If the sub had no real coverage while they worked, your insurer may charge for them at the next premium audit. See general liability premium audits and subcontractors and the workers' comp audit guide.
- Keep the certificate and your notes — who sent it, when, and what the agent or insurer told you.
- Report it if it was forged. State insurance departments run fraud units that take reports of forged insurance documents.
Not legal advice. Terminating a subcontract, withholding payment or reporting fraud each have consequences. Talk to your attorney before you act on a certificate you believe is forged.
How TrackMyVendor automates this
- Every certificate arrives through a one-time link the sub opens from their phone, and the audit trail records what was uploaded, by whom and when.
- AI reads each coverage row — insured, carrier, policy number, dates and limits — so the details you confirm with the agent are already on the record, and each policy is tracked on its own expiration.
- Limits are checked against your minimums on every certificate, so a sub below your requirements is flagged without anyone reading the PDF.
- The license is checked against the state database and shown on the same record, next to the certificate and the W-9.
- Endorsement forms are read — form number, edition, the policy each one amends — instead of the boxes ticked on the certificate. Pro
We don't authenticate a certificate or contact the agent. Calling the producer to confirm a certificate is still yours.
Start free — first 25 vendors includedThe certificate and the license, checked on one record
Subs and vendors upload their certificate, W-9 and license through one link — no account, no portal. Every policy is read and tracked on its own dates, and the license is checked against the state database. Your first 25 contractors are free.