A new starter hands you a first aid certificate. It has a logo, a name, a date and a signature. It looks fine.
Whether it is fine is a different question, and one you may have a legal interest in answering. If you are relying on that certificate to satisfy your first aid needs assessment, or to let someone onto a site, or to evidence competence to an inspector, then "it looked right" is not a position you want to be defending afterwards.
This is how to check, in rough order of speed.
Start with the certificate itself
Before contacting anyone, look at what you have been given.
Is there an expiry or refresher date? A certificate with an issue date but no expiry is not necessarily fake, but it is less useful. You will need to work out the interval yourself, and different courses run to different clocks.
Is there a unique certificate or reference number? Legitimate providers number their certificates so they can look them up. No number usually means no lookup, and often means no underlying record either.
Does the awarding organisation match the qualification? A Level 3 Award in First Aid at Work is a regulated qualification, so it should name a recognised awarding organisation such as Qualsafe Awards, FAA, Highfield or similar. If it names only the training company, it may still be genuine, but it is not a regulated qualification and you should not treat it as one.
Is it a PDF, and does it look edited? Mismatched fonts, inconsistent alignment, a name that sits slightly off the baseline compared to the other fields, or a date in a different typeface. Altered certificates are usually altered clumsily, because the person doing it is editing someone else's PDF rather than producing a new one.
Does the qualification actually exist? For regulated qualifications, search the Ofqual Register of Regulated Qualifications. If the title on the certificate does not appear there and it claims to be regulated, that is a real flag.
Scan the code, if there is one
An increasing number of providers put a QR code on the certificate that resolves to a verification page on their own domain. Scan it. It should take you to a page showing the learner's name, the course, the dates and the status.
Two things to check when you do:
Does the domain match the provider named on the certificate? A verification link pointing at a domain with no relationship to the issuing company is worth pausing over.
Does the page show live data, or just a static image? A real verification page reflects the provider's record. If it just displays the same certificate you already have, it proves nothing.
This is the fastest check available and takes about ten seconds. It is also why providers who offer it tend to get fewer phone calls.
Contact the training provider
If there is no code, ring or email the provider named on the certificate. Do not use contact details printed on the certificate itself if you have any real doubt; find the provider independently and use the details on their own website.
Ask them to confirm three things:
- That they delivered a course on that date
- That the named person attended and passed
- That the certificate number matches their record
A provider with decent records will answer in minutes. One who cannot answer at all is a finding in itself, whether or not the certificate is genuine, because it means nothing they have issued can be verified.
Check the awarding organisation
For regulated qualifications, the awarding organisation is the backstop. Most operate a verification service for employers, though turnaround varies and some charge.
This is the slowest route but the most authoritative, and it is the right one when the stakes are high: safety-critical roles, anything where you would struggle to justify your checks after an incident.
What the common problems actually look like
In practice, outright forgery is rarer than these three:
The altered date. A real certificate that has expired, with the year edited. This is the most common, because it requires no forgery skill and the underlying certificate is genuine.
The wrong course. Someone holds Emergency First Aid at Work, a one-day course, and it is being accepted as First Aid at Work, a three-day course. Often not deliberate; the names are similar and buyers conflate them constantly. But they are not interchangeable, and your needs assessment may specify one.
The unregulated certificate presented as regulated. A certificate of attendance from a course with no awarding organisation behind it, being treated as a qualification. Attendance is not assessment.
None of these require a criminal. Two of the three are usually confusion rather than fraud, which is a good reason to ask before accusing.
If something does not add up
Go back to the person first. Most discrepancies are innocent: they have handed over the wrong certificate, or an old one, or they genuinely do not know the difference between EFAW and FAW.
If it does not resolve, do not let the person work in the role that depends on the qualification until it does. That sounds heavy-handed, but the alternative is carrying a known gap in your own compliance, and the consequences of that land on you rather than on them.
Keep a record of what you checked and when. If your own records are audited, evidence that you verified is nearly as important as the certificate itself.
For training providers reading this
Every verification request that reaches you by phone is a small tax on your day, and there will be more of them as buyers get more careful.
Making your certificates verifiable without contact removes that work, and it protects you: if an altered version of one of your certificates is circulating, a verification page that resolves to your actual record exposes it immediately. The certificate stops being the proof; your record becomes the proof.
Train Aid Solutions puts a QR code on every certificate you issue, resolving to a public verification page on your own branding. Anyone can check in seconds, and you keep a full log of what was issued to whom. From £40 per month.
Related reading: How long do UK training certificates last? and What training records you must keep, and for how long.