Fake National Police Check Detection AI: Spotting Forged Certificates

Australian background screening runs on two separate documents that many hiring managers treat as one: a National Police Check (also called a National Police Certificate), obtained through an ACIC-accredited body with access to the National Police Checking Service, and a Working with Children Check (WWCC), issued not federally but by whichever state or territory the role is based in. Neither document has a free, name-searchable public register an employer can query directly — a National Police Check can only be confirmed by going back to the accredited body that issued it, and a WWCC only through that state's own employer portal. That two-document, two-system gap is exactly what forged and altered certificates exploit, and generative AI has made producing a convincing fake faster than at any point since these screening regimes were established.

This article is provided for informational purposes only and does not constitute legal or regulatory advice.

What a Fake or Forged National Police Check or Working with Children Check Actually Looks Like

A fake falls into three categories: a certificate fabricated from nothing, a genuine certificate with one or more fields altered, or a certificate that was accurate at issue but has since been superseded by new information and is being passed off as current. Fabrication from scratch means recreating the layout an accredited body or state screening unit uses, without ever having lodged a real application. Alteration starts from a genuine document — often the applicant's own, from an earlier role — and changes the result field from disclosable court outcomes to "no disclosable outcomes," swaps in a different, more favourable WWCC jurisdiction than the one that actually issued it, or edits the issue date to make an old check look recent.

Australia's own quirk makes this easier than it should be: there is no single, nationally uniform certificate design. ACIC-accredited bodies have the option to place their own branding on check results, including a header, watermark, or verification code, according to ACIC's guidance on how the service works, which means dozens of legitimately different-looking National Police Check certificates are all genuine at once. A hiring manager who has only seen certificates from one or two providers has no stable visual baseline for a new one — precisely the gap an AI-generated image is built to fill. WWCC documents carry the same problem across state lines: a NSW card, a Queensland Blue Card, and a Victorian card look nothing alike, so a forgery only has to be convincing for the jurisdiction it claims, not a single national standard.

Why These Checks Are a Specific Fraud Target in Australia

These documents get forged because they sit at a legal chokepoint that is more fragmented than most other Western screening systems. A National Police Check is a private-sector product accessed through an ACIC-accredited body under section 46A(5) of the Australian Crime Commission Act 2002 (Cth) — there is no single government office issuing it. A WWCC is a completely separate, state-issued clearance governed by that state's own legislation: the Child Protection (Working with Children) Act 2012 in New South Wales, the Worker Screening Act 2020 in Victoria, and the Working with Children (Risk Management and Screening) Act 2000 in Queensland, among others. A WWCC issued in one state generally does not authorise child-related work in another — moving interstate means a fresh application under a different Act, agency, and card design.

That fragmentation creates two distinct fraud surfaces rather than one. An applicant who knows their record would surface in one state but not another has an incentive to present a WWCC from the "wrong" jurisdiction, hoping nobody checks which state the role is actually based in. Separately, both documents are point-in-time snapshots that do not update themselves once issued. Reform is underway — jurisdictions endorsed a national agreement on 14 November 2025 covering mutual recognition of WWCC negative notices and a National Continuous Checking Capability delivered by ACIC, rolling out from late 2025 — but as of mid-2026 this is a staged rollout, not a completed national system. Childcare centres, schools, disability and aged-care providers, and recruitment agencies are the segments most exposed, since a forged or simply expired WWCC is a specific, recurring risk in education and childcare recruitment that a generic "police check" mindset misses.

Signs of a Forged or Altered Certificate

A forged certificate rarely fails on one obvious point; the tell is usually a mismatch between what the document claims and what the issuing body or state screening unit would actually produce.

A National Police Check is considered a "point in time" check only, meaning the result reflects the applicant's police record on and up to the date and time it was released, per ACIC's own guidance, and if suspicion arises, the correct step is contacting the issuing accredited body rather than accepting the certificate on its face. A candidate who only sends a photo or PDF, and cannot produce a verification code or the issuing body's name, is presenting exactly the submission type that defeats a purely visual check.

Why "no disclosable outcomes" is not the same as "current"

A certificate can show a clean result and still be unreliable if the applicant's record has changed since issue, since a printed or PDF certificate never updates itself. WWCC status can also change after issue — through an interim bar, suspension, or cancellation — which is why several states run an ongoing employer verification obligation rather than a one-off check at hiring. If an employer relies solely on a saved copy from months earlier instead of re-verifying through the relevant state portal, that gap is a genuine exposure, not a technicality.

Verifying a Check the Australian Way, Not Just by Appearance

For a National Police Check, there is no general public lookup by name or certificate number — the only authoritative route is contacting the accredited body that submitted the check, since ACIC directs anyone who wants to verify a check result, or who suspects a fraudulent result, to contact the accredited body as the submitting organisation, rather than ACIC itself. For a WWCC, most states require the employer to hold their own account: in New South Wales, organisations register with the Office of the Children's Guardian's employer portal and must verify each worker's WWCC number before they start, not merely sight the card; Victoria runs an equivalent check through Service Victoria. Neither process is optional — employing someone in child-related work without verifying a current WWCC is itself a compliance failure independent of whether the document turns out to be genuine.

Making a false document with the intention that it be accepted as genuine — which includes fabricating or altering a police check or WWCC — is an offence under Division 144 of the Criminal Code Act 1995 (Cth), carrying a maximum penalty of 10 years' imprisonment, and using such a document engages a separate offence under Division 145. State law runs in parallel: forgery under section 253 of the Crimes Act 1900 (NSW) carries an equivalent maximum penalty, and comparable provisions exist in every other state's Crimes Act. Both apply regardless of whether the underlying record concealed was itself serious, because the offence lies in the act of fabrication and use.

Two Systems, Two Laws: WWCC Fragmentation and the Privacy Act

Because there are eight separate WWCC schemes rather than one, an employer's compliance obligation is itself jurisdiction-specific, and getting that wrong is a problem independent of any forgery. A worker who moved from Queensland to New South Wales and presents their Blue Card for a NSW role has not met the legal requirement, even though the Blue Card is genuine — the role needs a NSW WWCC administered by the Office of the Children's Guardian, not a Queensland document under a different Act entirely. The reform agreement jurisdictions endorsed in November 2025 is intended to close part of this gap over time, but full portability of a positive WWCC clearance between states is not yet in place.

Handling this correctly also means handling the underlying data correctly. Information about an individual's criminal record is sensitive information under Australian Privacy Principle 3, which restricts collection to what is reasonably necessary and, outside specific exceptions, requires consent, per the OAIC's APP guidelines. Employers handling this data sit under the Privacy Act 1988, with the employee-records exemption covering existing staff but not applicants who are never hired.

Manual Review vs Automated Verification

Occupational fraud broadly is detected through active controls such as document review in only a minority of cases, with detection delays measured in months rather than days — which describes exactly the exposure a busy HR team creates by treating a certificate as verified once glanced at, rather than checked systematically at intake.

On recruitment forums, a recurring question is whether a photo or scanned PDF of a WWCC card is acceptable if the physical card is still in the post — state guidance is consistent that the employer verification portal, not the card itself, is the authoritative source, so a photo is a starting point for identifying the WWCC number, not proof of current status. A second recurring thread concerns candidates assuming "a police check" from a previous job is portable to a new employer or state; it is not, since both documents are role- and, for WWCC, jurisdiction-specific.

How CheckFile Complements National Police Check and WWCC Verification

Contacting the accredited body or the relevant state portal, where available, confirms current status against the issuing record; it does not confirm that the document a recruiter is looking at is unaltered, correctly formatted, or free of AI-generation artefacts, which is the layer document verification adds ahead of that step. That methodology combines OCR extraction, metadata analysis, and cross-document business rules that validate multiple fields per document against each other, rather than relying on a single visual check. For agencies and HR teams processing National Police Checks and WWCCs alongside right-to-work documents, references, and qualification records, this catches mismatched issue dates, jurisdictions inconsistent with the role's location, and formatting inconsistent with a genuine accredited body's output before a verification request goes out.

AI-generation signals are available as an additional layer on top of those structural checks, depending on a client's configuration, and are designed to complement existing controls rather than replace them. That framing matters here, since the authoritative source of truth remains the accredited body or state screening unit: automated verification narrows down which checks warrant a direct query, it does not substitute for that query. Our guide to background check documents employers need to verify covers right-to-work and qualification checks that typically accompany these documents in the same recruitment file, and our checklist of signs a document was AI-generated sets out cues that apply across document types.

The CheckFile security page has details on infrastructure and audit logging, and volume-based plans for agencies processing checks at scale are listed on the pricing page. For a structured view of how AI-generated document detection fits alongside this verification workflow, see CheckFile's AI and deepfake detection page — the platform surfaces AI-generation signals as a complement to the checks an HR or compliance team already runs, not a replacement for a direct query to the accredited body or state screening unit. For a broader view across sectors, see the industry verification guide, or get in touch to discuss a recruitment or background-check volume specifically.

Frequently Asked Questions

How can I tell if a National Police Check is fake

Check that the provider named on the certificate appears on ACIC's accredited bodies register, and look for that body's own branding, watermark, or verification code, since accredited bodies each format results differently rather than to one national template. If anything looks inconsistent, contact the accredited body directly — ACIC directs verification requests to the submitting organisation, not to ACIC itself.

Can employers check a Working with Children Check against a central database directly

Only through the relevant state's own system, and only if registered to do so. In New South Wales, employers register with the Office of the Children's Guardian's employer portal and verify each worker's WWCC number; Victoria and other states run equivalent but separate systems. There is no single national database, because each state and territory administers its own WWCC under its own legislation, and a check verified in one state does not confirm status in another.

Is using a fake or altered National Police Check or WWCC a criminal offence

Yes, on federal and state bases that can both apply. Making a false document is an offence under Division 144 of the Criminal Code Act 1995 (Cth), carrying up to 10 years' imprisonment, and using it is a separate offence under Division 145. State provisions, such as section 253 of the Crimes Act 1900 (NSW), carry comparable penalties and can apply in parallel.

Does a Working with Children Check from one state cover work in another state

No. Each state and territory runs its own WWCC scheme, and a check issued in one jurisdiction generally does not authorise child-related work in another — relocating interstate needs a fresh application. Reforms endorsed by jurisdictions in November 2025 introduce mutual recognition of negative notices and a national continuous-checking capability delivered by ACIC, but full portability of a positive WWCC clearance is not yet in place as of mid-2026.

What should an employer do if a certificate looks genuine but cannot be verified

Do not proceed on appearance alone. For a National Police Check, contact the accredited body named on the certificate; for a WWCC, use the relevant state's employer verification portal rather than relying on a photo or PDF. A certificate that cannot be matched to a real accredited body, or a WWCC number that does not resolve on the correct state's portal, is a signal worth escalating before any offer is confirmed.