Fake DBS Check Detection AI: Spotting Forged Certificates

A DBS certificate is one of the few background-check documents that lets an employer make a legal, high-stakes decision — hire, reject, place someone in regulated activity with children or vulnerable adults — based on a single piece of paper the employer usually cannot independently query. There is no live national database a business can search by name or date of birth; the certificate itself, or a status check against the DBS Update Service, is the only route to confirming what it says. That gap is precisely what forged and altered certificates exploit, and generative AI has made producing a convincing fake faster than at any point since the current disclosure system was introduced.

This article is provided for informational purposes only and does not constitute legal or regulatory advice.

What a Fake or Forged DBS Check Actually Looks Like

A fake DBS check falls into three categories: a certificate fabricated from nothing, a genuine certificate with one or more fields altered, or a certificate that was real at issue but is now expired, revoked, or superseded by new information and is being passed off as current. Fabrication from scratch means copying the DBS certificate layout, crown seal watermark, and purple print colour without ever having applied for a real disclosure. Alteration starts from a genuine certificate — often the applicant's own, from an earlier job — and changes the result field from "convictions recorded" to "no information," swaps the disclosure level from Basic to Enhanced, or edits the issue date to make an old certificate look recent.

The newest variant does not touch a physical certificate at all: a generative-AI tool produces a convincing image of a DBS certificate, correctly formatted text and all, submitted as a PDF or photo upload to a recruitment portal or applicant-tracking system rather than handed over as a hard copy. An original DBS certificate is printed on both sides on paper larger than A4 (209mm by 404mm), uses purple ink for personal information, and carries a repeating crown seal watermark down the right-hand edge, according to guidance summarised by Personnel Checks. None of those physical features survive a digital upload — the file only has to look right on screen, which is exactly the gap an AI-generated image is built to fill.

Why DBS Checks Are a Specific Fraud Target

DBS checks get forged because they sit at a legal chokepoint: certain roles cannot lawfully begin without one, and the applicant, not an independent registry, is usually the one presenting the result. Only individuals engaged in activity listed under the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 are eligible for a Standard or Enhanced check that discloses spent convictions — most private-sector roles can only lawfully request a Basic check, which shows only unspent convictions. That distinction matters because a candidate who knows their spent conviction would only surface on an Enhanced check has a direct incentive to alter a genuine Basic certificate to look like a clean Enhanced one, betting that a hiring manager will not know the difference.

The absence of automatic renewal compounds the problem. A DBS certificate is a snapshot at the date of issue; unless the holder is subscribed to the DBS Update Service, nothing about it updates automatically, and an employer has no way to query whether new information has since been added. Care providers, schools, and recruitment agencies processing dozens of certificates a week are the segments most exposed, precisely because volume makes an appearance-only check the practical default. Separately, jobseekers themselves are targeted by scams that charge them for a fake DBS check as a condition of a fake job offer — gov.uk's guidance for jobseekers documents this as a distinct fraud pattern running in the opposite direction from employer-side forgery.

Signs of a Forged or Altered DBS Certificate

A forged certificate rarely fails on one obvious point; the tell is usually a combination of a missing security feature and a detail that does not match the surrounding paperwork.

Copies or digital photographs are not acceptable and must be rejected, because reproductions do not properly show the certificate's security features and cannot be inspected for authenticity, per guidance compiled by Devon County Council's safer recruitment service. A candidate who only ever sends a PDF or photo, and produces reasons to avoid bringing in the original, is presenting exactly the submission type that defeats every physical check in the table above.

Why "the certificate looks clear" is not the same as "the certificate is current"

A certificate can show no convictions and still be unreliable if new information has been added since issue, since the printed certificate never updates itself. If an employer is shown a clear certificate but a DBS Update Service check on the same reference returns "no further information on certificate" rather than confirming it remains current, or the Update Service shows the certificate as no longer current, that mismatch is itself a signal worth escalating directly to DBS — not a technicality to wave through because the paper in hand looks fine.

Verifying a Certificate the DBS Way, Not Just by Appearance

The only mechanism that checks a certificate's status against DBS records, rather than its printed appearance, is the DBS Update Service, and it works only if the applicant subscribed and gave consent. To run a status check, an employer needs the certificate holder's consent, the original certificate to confirm the certificate number and personal details, and access to the Update Service portal, where entering the surname, date of birth, and certificate number returns one of a small set of results — current with no further information, current with new information added, or no longer current — instantly and at no cost to the employer, per gov.uk's DBS Update Service guidance. Not every certificate is eligible: subscription is optional, paid for by the applicant, and only applies to Standard and Enhanced checks, so a Basic-check candidate, or one who never subscribed, cannot be checked this way at all — the certificate itself, inspected physically, becomes the only evidence available.

Making a false instrument — which includes fabricating or altering a certificate with the intention that it be accepted as genuine — is an offence under section 1 of the Forgery and Counterfeiting Act 1981, and using that forged certificate to obtain employment separately engages fraud by false representation under the Fraud Act 2006. Both statutes apply regardless of whether the underlying conviction the certificate concealed was itself serious, because the offence is in the act of fabrication and use, not solely in what was hidden.

Regulated Activity, Spent Convictions, and What the Certificate Cannot Show by Itself

Whether a role can lawfully see spent convictions at all depends on whether it counts as regulated activity, and getting that wrong is itself a compliance failure independent of any forgery. The Safeguarding Vulnerable Groups Act 2006 defines regulated activity with children and vulnerable adults, and the Police Act 1997 Part V sets out the disclosure framework DBS operates under. An employer that accepts an Enhanced certificate result for a role that only qualifies for a Basic check has a legal problem even if the certificate itself turns out to be genuine, since requesting a level of disclosure the role is not entitled to is itself outside the Exceptions Order framework.

It is worth separating England and Wales practice from the rest of the UK: Scotland runs its own system through Disclosure Scotland and the PVG scheme, and Northern Ireland's equivalent is AccessNI. A certificate formatted as a DBS disclosure for a role based in Scotland, or vice versa, is itself a mismatch worth querying before any forgery analysis even begins.

Manual Review vs Automated Verification

Only 37% of occupational fraud is detected through active controls such as document review, with an average detection delay of 87 days, according to the ACFE 2024 Report to the Nations. That figure covers occupational fraud broadly rather than DBS checks specifically, but it describes exactly the exposure a busy HR team creates by treating a certificate as verified once it has been glanced at, rather than checked systematically at intake. Separately, 64% of UK businesses reported experiencing fraud, corruption, or other economic crime in the previous 24 months, up from 56% in 2020, according to PwC's Global Economic Crime Survey 2024: UK findings — a trend line that includes but is not limited to recruitment and background-check fraud.

On HR and recruitment forums, a recurring question is whether a photocopy or scanned PDF of a DBS certificate is ever acceptable if the candidate says the original was lost or is still in the post — the consistent guidance from safer-recruitment sources is that it is not, because a reproduction cannot show the watermark or print colour needed for a physical check. A second recurring thread concerns candidates who present a certificate from a previous employer rather than applying fresh, on the assumption that "a DBS check" is a portable status rather than a role-specific, dated snapshot — it is not, and each new role generally requires its own application unless the existing certificate is on the Update Service and eligible for reuse at the same disclosure level.

How CheckFile Complements DBS-Based Checks

A DBS Update Service check, where available, confirms current status against DBS records; it does not confirm that the physical or digital certificate a recruiter is looking at is unaltered, correctly formatted, or free of AI-generation artefacts, which is the layer document verification adds ahead of that step. That methodology combines OCR extraction, metadata analysis, and cross-document business rules that validate multiple fields per document against each other, rather than relying on a single visual check. For agencies and HR teams processing DBS certificates alongside right-to-work documents, references, and qualification records, this catches mismatched issue dates, disclosure levels inconsistent with the role, and formatting inconsistent with a genuine certificate before an Update Service query goes out, or in the many cases — Basic checks, non-subscribed certificates — where no Update Service query is even possible.

AI-generation signals are available as an additional layer on top of those structural checks, depending on a client's configuration, and are designed to complement existing controls rather than replace them. That framing matters for a document like a DBS certificate, where the authoritative source of truth remains DBS itself: automated verification narrows down which certificates warrant a direct query to DBS or the issuing body, it does not substitute for that query. For background-check documentation more broadly, our guide to background check documents employers need to verify covers right-to-work and qualification checks that typically accompany a DBS certificate in the same recruitment file, and our checklist of signs a document was AI-generated sets out the metadata and visual cues that apply across document types, not only certificates.

The CheckFile security page has details on infrastructure and audit logging, and volume-based plans for agencies processing certificates at scale are listed on the pricing page. For a structured view of how AI-generated document detection fits alongside DBS verification and an existing recruitment workflow, see CheckFile's AI and deepfake detection page — the platform surfaces AI-generation signals as a complement to the checks an HR or compliance team already runs, not a replacement for a direct DBS or Update Service query. For a broader view of document verification requirements across sectors, see the industry verification guide, or get in touch to discuss a recruitment or background-check volume specifically.

Frequently Asked Questions

How can I tell if a DBS certificate is fake

Check the physical format first: a genuine certificate is larger than A4, printed on both sides, uses purple ink for personal details, and carries a repeating crown seal watermark down the right edge. Reject any photocopy, scan, or photo submitted in place of the original, since reproductions cannot show these features, and where the certificate is Standard or Enhanced and the holder is subscribed, confirm status through the DBS Update Service.

Can employers check a DBS certificate against a central database directly

Not independently. The DBS Update Service lets an employer check the status of a Standard or Enhanced certificate, but only with the holder's consent and only if the holder subscribed when the certificate was issued — there is no general lookup by name or certificate number available to employers outside that service. Basic checks and non-subscribed certificates cannot be status-checked this way at all, which is why HR teams sometimes assume a check is possible when it is not.

Is using a fake or altered DBS certificate a criminal offence

Yes, on two separate legal bases. Fabricating or altering the certificate is an offence under section 1 of the Forgery and Counterfeiting Act 1981, and using it to obtain a job separately constitutes fraud by false representation under the Fraud Act 2006. Both can apply even where the underlying conviction the certificate concealed was relatively minor.

Can a Basic DBS check be legally upgraded to Enhanced without reapplying

No. Eligibility for a Standard or Enhanced check, which discloses spent convictions, depends on the specific role falling within the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 — a role only eligible for a Basic check cannot lawfully be issued a Standard or Enhanced result, and a certificate showing a higher disclosure level than the role qualifies for should be treated as a red flag rather than a bonus.

What should an employer do if a DBS certificate looks genuine but the Update Service flags it

Contact DBS directly rather than accepting the certificate on the strength of its appearance. A mismatch between a certificate that looks clear and an Update Service result showing new information, or showing the certificate as no longer current, is a specific signal that DBS itself treats as worth investigating, and safer-recruitment guidance recommends withdrawing any conditional offer until the discrepancy is resolved.