How to spot a fake certificate of insurance
A certificate of insurance (COI) is a one-page summary of someone's coverage — and because it's just a summary, it can be faked with nothing more than a PDF editor. The good news: you don't need to be a forensics expert to protect yourself. There are red flags you can spot on the document itself, and there's one check that settles the question for good — confirming the coverage with the agent, broker, or carrier that supposedly issued it.
This guide walks through why fake COIs show up in the first place, what to look for on the page, and how to verify the real thing without turning every sub's paperwork into an interrogation.
Why fake COIs happen at all
Most subs who hand over a questionable certificate aren't career criminals. The usual story is more mundane. A policy lapsed because a payment was missed. Coverage is between renewal and reinstatement. Premiums went up and the sub is stalling while they shop for something affordable. Meanwhile there's a job starting Monday, and the GC won't let anyone on site without a COI.
Under that kind of pressure, some people edit last year's certificate and hope nobody looks closely. Others buy a certificate from someone who promises 'cheap insurance' that turns out not to exist. None of this makes it okay — if that sub injures someone or damages property, there may be no policy behind the paper, and the problem can land on you. But understanding the why helps you check without treating every sub like a suspect. Verification is a routine step, not an accusation.
Red flags on the document itself
Think of these as signals, not proof. A real certificate can have a typo, and a careful forgery can look perfect. But when you see one of these, slow down and verify before you file it away.
- Dates that don't line up. A policy period that ended months ago, an effective date after the certificate's issue date, or a policy term that isn't a normal length (most run about a year) all deserve a second look.
- Sloppy edits. Mismatched fonts, text that sits slightly off its line, blurry patches where numbers were pasted over, or fields that look sharper than the rest of the page — classic signs a PDF was altered.
- A carrier you can't find. The insurance company named on the certificate should be a real, findable business. If a search turns up nothing, that's a big signal (more on checking this below).
- A missing or vague producer block. The producer is the agency or brokerage that issued the certificate. A legitimate COI names them with contact details. No agency, no phone number, or a generic email address is worth questioning.
- Policy numbers that look off. There's no universal format, but a number like '123456' or one that's identical across several different policy lines can suggest someone typed in filler.
- A certificate that appears instantly on demand. Agents usually turn certificates around quickly, but a sub who produces a 'fresh' COI within seconds of being asked — with no agent involved — may be editing an old one.
Why a clean-looking certificate still isn't proof
Here's the uncomfortable truth about COIs: even a completely genuine one is just a snapshot that someone typed. It summarizes the coverage the agent believed was in place on the day it was issued. It isn't the policy, it doesn't change the policy, and it doesn't promise the policy still exists today.
That means a certificate can be perfectly authentic and still mislead you — for example, if the policy was cancelled for non-payment a week after the certificate was printed. So document red flags are useful for catching lazy fakes, but a clean page tells you less than it feels like it does. That's why the next step matters most.
The gold standard: verify with the source
The only reliable way to confirm a COI is real is to go around the document — back to whoever supposedly issued it. Call or email the producer (the agency or brokerage listed on the certificate) and ask them to confirm they issued it and that the policy is active. Use contact details you look up yourself, not just the ones printed on the certificate — if the certificate is fake, the phone number on it might ring the forger's cousin.
Agencies handle these calls all the time. You're not asking them to reveal anything private — just to confirm that the certificate they supposedly issued is genuine and the coverage is in force. If the producer can't be reached or has never heard of the sub, you have your answer. For higher-stakes situations, you can also contact the insurance carrier directly; many have a verification line or process for exactly this.
If you track documents in CompliCloud, this step is built in: from any stored certificate you can send a verification request straight to the issuing broker or agent, so the confirmation lives alongside the document instead of in someone's inbox. It doesn't make the check magic — it just makes it easy enough that it actually happens.
Check that the carrier is real and licensed
A second, independent check: confirm the insurance company itself exists and is allowed to sell insurance where the work is happening. Insurance carriers are licensed at the state level, and most state insurance departments offer a free online lookup where you can search a company by name. The NAIC (the association of state insurance regulators) also offers company search tools.
How this works and what it's called varies by state, so start from your own state insurance department's website. If the carrier named on the COI doesn't show up anywhere, either the name is misspelled or the 'carrier' doesn't exist — and either way, you want to know before anyone sets foot on your site.
One nuance: some legitimate coverage is written by what's called a surplus lines carrier, which may not appear in the standard licensed-company lookup even though the coverage is real. If a lookup comes up empty but the sub insists the coverage is genuine, that's another good reason to call the producer — they can explain exactly who's behind the policy.
Make verification a habit, not a confrontation
The easiest way to handle all of this is to make source verification part of your standard onboarding for every sub, every time. When it's just how you do things, nobody feels singled out, and fakes get caught before they matter instead of after a claim gets denied.
A simple routine: collect the COI, scan it for the red flags above, confirm with the producer, and note the policy expiration date so you know when to ask for a fresh certificate. Requirements for what coverage subs must carry vary by state and by contract — your contract and your agent are the authorities there. But the verification habit is the same everywhere: trust the source, not the PDF.
Common questions
How do I verify a certificate of insurance is real?
Contact the producer — the agency or brokerage listed on the certificate — and ask them to confirm they issued it and that the policy is currently in force. Look up their contact details independently rather than trusting what's printed on the document. For extra assurance, you can also contact the insurance carrier directly.
If a COI is on an official ACORD form, does that mean it's genuine?
No. ACORD 25 is simply the standard industry form for liability certificates, and blank or editable versions are easy to come by. The form tells you what fields to expect; it says nothing about whether the information typed into them is true.
Can a real COI still be wrong or misleading?
Yes. A certificate is a snapshot of coverage on the day it was issued — it isn't the policy and doesn't guarantee the policy is still active. Coverage can be cancelled or changed after the certificate is printed. That's why confirming with the issuing agent or carrier beats re-reading the document.
Is submitting a fake COI illegal?
Knowingly forging or submitting a fake insurance document is commonly treated as a form of fraud, but the specifics and consequences vary by state. If you believe you've received a forged certificate, consider reporting it to your state insurance department, and talk to a lawyer about your options. This article isn't legal advice.
What should I do if a sub's COI fails verification?
Don't let them start work until real coverage is confirmed — an uninsured sub's accident can become your problem. Give them a chance to sort it out; sometimes the issue is an expired policy or an agent error rather than deliberate fraud. Ask for a fresh certificate issued directly by their agent, and verify that one too.
This guide is general information for US trades businesses, not legal or insurance advice. Requirements vary by state, locality and contract — confirm the specifics with your licensing body, your client’s contract, or your insurance agent.