Forged Certificates of Insurance: How Canadian Firms Detect Fraud

A certificate of insurance is one page, produced by a broker in minutes, and it is the single document most Canadian procurement and construction teams treat as sufficient proof that a vendor is covered. That trust is exactly what makes it a soft target: nobody outside the insurer or broker can check a certificate's contents against a public register in real time, and in Canada that check depends on which provincial regulator licenses the insurer. This article covers the certificate itself — how the insurer name, policy number, coverage limits, expiry date and broker letterhead get fabricated or altered, and how a risk team catches it — not vendor tax and licensing paperwork, which our guide to forged compliance certificates in supplier onboarding already covers, or the wider obligations in our construction subcontractor compliance guide.

What a Genuine Certificate of Insurance Actually Proves

A certificate of insurance confirms that a policy existed, with stated limits, at the moment the broker issued it — nothing more. The International Risk Management Institute defines it as evidence that certain coverages and limits have been purchased, explicitly not a contract in itself and no guarantee that the underlying policy remains in force when a claim arises (IRMI, Certificate of Insurance). That distinction matters just as much in a Canadian context: a certificate can be genuine on the day it is issued and still misrepresent a contractor's position three months later if the policy lapses, is cancelled for non-payment, or is amended without a new certificate being sent. Forgery is a different problem — a document that misrepresents the insurer, policy, or limits from the outset, produced to pass a bid-qualification check rather than to summarize a real placement.

Six Ways Fraudsters Forge a Certificate of Insurance

Forged certificates fall into a small number of recurring patterns because the goal is passing a document review, not producing a legally binding record. A fabricated insurer name is the crudest version — an invented company, or a genuine insurer's name misspelled just enough to survive a quick read but fail a search of the licensing registry in the province where the work is performed. A fake or reused policy number follows the same logic: plausible in format, but it returns no match, or matches a different policyholder, once the broker or insurer is asked directly.

Altered coverage limits and expiry dates are the most common edits, requiring only a few characters changed in an otherwise real-looking layout — a $2 million commercial general liability limit typed over as $5 million, or an expiry date pushed back six months on a policy that actually lapsed at renewal. Cloned broker letterhead and spoofed sender domains extend the same tactic to provenance: a logo copied from a genuine Canadian brokerage, sent from a domain one character removed from the real one. The last category is the doctored PDF itself — text layers edited directly, which is why mismatched fonts, inconsistent kerning, or scan artifacts are often the first visible tell.

Manual document review across all fraud types catches only around 37% of cases, with a median detection delay of 87 days, according to the ACFE's 2024 Report to the Nations (ACFE, 2024 Report to the Nations) — long enough for a forged certificate to sit unchallenged well into an active contract before anyone checks it against the insurer.

Red Flags in a Suspect Certificate of Insurance

The strongest indicators sit in fields a fraudster edits under time pressure, not in the document's overall visual polish — a competent forger can make a certificate look professional while still leaving inconsistencies in the details that matter.

How to Verify a Certificate Rather Than Trust It

Verification means confirming the certificate's contents with a party who has no reason to lie about them, not re-reading the document more carefully. Three channels are commonly available, differing sharply in speed, reliability, and how well they scale across a large supplier base.

Before calling any number, confirm the broker or insurer's licence with the regulator governing the province where the work is performed — FSRA, the Financial Services Regulatory Authority of Ontario, publishes a public registry of licensed insurance companies for exactly this reason (FSRA, Licensed Insurance Companies in Ontario). A phone number printed on the certificate proves nothing, since a fraudster who fabricates the document can just as easily staff the number on it.

Why Insurance Regulation in Canada Is Provincial, Not a Single National Regulator

Unlike the United Kingdom, where the FCA authorizes and lists every insurer in one national register, Canada splits insurance oversight across the provinces, so the right registry depends on where the contractor is licensed. Insurance licensing in Canada is regulated provincially — FSRA (Ontario), the AMF (Québec), and BCFSA (British Columbia) each license and supervise insurers, agents and brokers in their own province (FSRA, AMF, Register of Insurers, BCFSA, Insurance). A certificate naming an insurer licensed only in one province is not automatically valid evidence of coverage for work performed in another.

The Office of the Superintendent of Financial Institutions (OSFI) separately supervises the solvency of federally incorporated insurers — the capital adequacy behind whether an insurer can actually pay a claim, distinct from whether it is licensed to sell in a given province (OSFI, Who Does OSFI Regulate). A forged certificate can fail either check independently.

Legal Exposure for Accepting a Forged Certificate

Accepting a forged certificate does not just leave a business uninsured on paper — it exposes the forger, and sometimes the party that relied on the document, to consequences under federal criminal law and provincial workers' compensation rules. Unlike insurance licensing, criminal law in Canada is federal and uniform across every province.

Under section 366 of the Criminal Code of Canada, making a false document — including altering a genuine certificate's limits or expiry date — with intent that it be relied on as genuine is forgery, punishable by up to ten years' imprisonment on indictment (Justice Laws Website, Criminal Code, Section 366). Submitting that forged certificate to obtain a contract or payment can additionally be charged as fraud under section 380, carrying up to fourteen years where the value obtained exceeds $5,000, with a mandatory minimum of two years above $1 million (Justice Laws Website, Criminal Code, Section 380).

A general contractor's exposure is not limited to the insurance certificate either. In Ontario, a principal retaining a contractor must obtain a WSIB clearance certificate — valid up to 90 days, renewable — confirming good standing with the Workplace Safety and Insurance Board; under section 141 of the Workplace Safety and Insurance Act, a principal who skips this can be held liable for the subcontractor's unpaid premiums, and starting work without a clearance is itself an offence (WSIB, Clearance Certificate in Construction). Other provinces run equivalent regimes under different names — WorkSafeBC, the CNESST, the WCB in Alberta — but the same logic: a certificate of insurance and a workers' compensation clearance are separate documents, and neither substitutes for the other.

Where Certificate Checks Fit Into Wider Vendor Pre-Qualification

Certificate verification rarely happens in isolation on well-run construction contracts in Canada — it sits inside a broader pre-qualification standard a supplier must pass before being invited to tender. The Certificate of Recognition (COR) program, run through the Canadian Federation of Construction Safety Associations and its provincial member associations, audits a contractor's health and safety management system and is a common bid-qualification requirement on Canadian projects (CFCSA, Certificate of Recognition). Relying on COR alone is not enough: it audits safety management, not insurance, and a certificate submitted months later still needs its own check against the insurer.

What to Do When a Certificate Looks Wrong

Pause onboarding or payment for that supplier before raising the concern with them, since an early confrontation can prompt evidence destruction or a hastily produced second forgery that is harder to disprove. Procurement teams on trade forums often ask whether calling the number printed on a certificate counts as verification — it does not, since that number is exactly what a fraudster controls; the reliable route is a broker or insurer contact sourced independently. A related question: what if a certificate was genuine when submitted but the policy lapsed mid-contract unnoticed? Periodic re-verification, not a one-off check, catches that gap — the same logic behind Ontario's renewable 90-day WSIB clearance window.

Preserve the original file and its metadata rather than a screenshot, since edit history is often the clearest evidence a PDF's text layer was altered after issue. Report confirmed forgery to the Canadian Anti-Fraud Centre and notify the broker or insurer whose identity was cloned (Canadian Anti-Fraud Centre, Report Fraud).

Building Systematic Verification Into Onboarding

Manual checking does not scale once a business is managing renewals across dozens or hundreds of subcontractors spread across several provinces, since every expiry date and every new supplier is another certificate needing an independent call rather than a five-second read. Platforms such as CheckFile apply structural, metadata and cross-document analysis to submitted certificates, flagging inconsistent fonts, edited PDF layers, and mismatches against previously seen broker templates. CheckFile's methodology combines structural, metadata and cross-document analysis, described as high detection coverage rather than a fixed percentage, and contextual scoring keeps false-positive handling low, distinguishing a broker's legitimate template changes from genuine signs of tampering.

An additional AI-generation signal layer is deployed as a complement to those structural checks, depending on client configuration, not a replacement for verifying the policy directly with the insurer or its provincial regulator — a forged policy number still has to be confirmed against the insurer's records. For document sets where AI-generated fraud is a specific concern, see CheckFile's AI-generated document detection, used alongside the checks above rather than instead of them.

For the construction sector specifically, see CheckFile's solutions for construction and BTP. Teams evaluating a platform can review CheckFile's security architecture or get in touch, and the document compliance guide sets out the wider framework this fits into.

Frequently Asked Questions

How can I tell if a certificate of insurance is forged without contacting the insurer?

Visual checks alone are unreliable: mismatched fonts, inconsistent formatting, or a certificate that looks like a rescanned copy are useful clues but not proof. The only conclusive check is confirming the insurer, policy number and limits directly with the broker, contacted through a number sourced independently rather than one printed on the document.

Does a certificate of insurance guarantee the coverage is still active?

No. A certificate reflects the policy's status at the moment it was issued and carries no guarantee it remains in force, per IRMI's definition. A policy can lapse, be cancelled for non-payment, or be amended after the certificate was sent, which is why periodic re-verification matters as much as the initial check.

Which regulator do I check to confirm an insurer is licensed in Canada?

It depends on where the work is performed, because insurance licensing in Canada is provincial: FSRA in Ontario, the AMF in Québec, BCFSA in British Columbia. OSFI separately supervises insurer solvency rather than issuing provincial sales licences.

Is calling the phone number on the certificate a valid way to verify it?

No. A fraudster who fabricates a certificate can just as easily list a phone number they control, so calling it only confirms whoever answers agrees with the document. Verification requires sourcing the broker or insurer's contact details independently, for example through the relevant provincial regulator's public registry.

---

This article is for informational purposes only and does not constitute legal, insurance, or regulatory advice. Consult a lawyer or insurance broker licensed in the relevant province for guidance specific to your organization. Legislation and guidance referenced are current as of 30 July 2026.