Fake Professional Certifications and Licences: How UK Employers Detect Them

Fake professional certifications and licence numbers are increasingly used to pass vendor onboarding, recruitment and healthcare credentialing checks, because a screenshot of a register entry or a laminated card is easy to alter and rarely checked against the issuing body's live database. Detecting them means verifying every licence or registration number directly against the FCA, GMC, NMC, HCPC, Gas Safe Register or CSCS system that issued it, not the document a candidate or supplier hands over, and layering document forensics on top to catch the growing share that are altered or generated with AI tools.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of the publication date. Consult a qualified professional for guidance specific to your situation.

Why Licence Fraud Is a Different Problem From Fake Diplomas or Training Certificates

A professional licence or registration number is checkable against a live public register in under a minute, yet in practice almost nobody checks it before signing a contract or issuing an offer letter. That gap, not the sophistication of the forgery, is what makes licence fraud so persistent across regulated hiring and vendor onboarding.

This article is deliberately narrow. It does not cover degree or CV fabrication, which we address in our guide to detecting AI-generated CVs and forged diplomas, or forged training-course paperwork, which sits in its own category entirely. This piece covers the credentials that let someone legally practise a regulated profession or qualify as a vendor: FCA authorisation for financial and insurance intermediaries, GMC, NMC and HCPC registration for healthcare practitioners, and Gas Safe, NICEIC and CSCS registration for tradespeople.

A licence-holder practising without genuine authorisation commits a criminal offence independent of any deception used to obtain the role, which is a materially different legal exposure than exaggerating a job title on a CV (legislation.gov.uk, Financial Services and Markets Act 2000). For a sector-by-sector breakdown of which documents matter most across regulated industries, see our industry verification guide.

How Fraudsters Fabricate and Alter Licence Numbers With AI

Most licence fraud does not involve a forged card design at all; it involves a genuine-looking number attached to the wrong person or the wrong firm. Fraudsters increasingly favour this route because inventing or cloning a reference number is far cheaper than replicating a physical security feature, and it defeats a visual check completely.

Clone firm fraud, where a scammer copies a genuine FCA-authorised firm's name, Firm Reference Number and registered address but supplies different contact details, has become common enough that the FCA runs a dedicated warning page rather than treating it as an edge case (FCA, Fake FCA communications). Generative AI tools accelerate the same pattern elsewhere: an inpainting model can lift a genuine GMC registration certificate found online, swap the name and photograph, and preserve the letterhead and layout well enough to pass a quick visual review. A scanned Gas Safe ID card or CSCS card can be edited the same way, with the underlying plastic card format reproduced convincingly enough that the forgery is only caught when the number is actually checked against the register rather than read off the card.

Verifying Financial Intermediaries on the FCA Register

Every authorised financial adviser, mortgage broker, insurance intermediary and payments firm must appear on the FCA's public Financial Services Register, searchable by firm name, individual name or Firm Reference Number at register.fca.org.uk. A firm that does not appear at all, or whose register entry shows a warning, should not be onboarded regardless of what documentation it presents.

Carrying on a regulated financial activity in the UK without FCA authorisation is a criminal offence under section 23 of the Financial Services and Markets Act 2000, triable either way and carrying a maximum sentence of two years' imprisonment on indictment (legislation.gov.uk, FSMA 2000). The practical complication is that many fraudulent intermediaries do not need a fake FRN at all: they clone a genuine one. The register entry will look correct because it is correct — it belongs to a real firm — but the trading name, phone number or website presented to the onboarding team does not match what the FCA has on file for that FRN.

Verifying Healthcare Practitioners: GMC, NMC and HCPC Registers

A registration number alone proves nothing unless it is checked against the regulator's own search tool, because a genuine number can be quoted by someone other than the person it belongs to. The GMC's List of Registered Medical Practitioners, the NMC's online register and the HCPC's register each let an employer confirm, in real time, whether a named individual holds current, unrestricted registration for the specific protected title they are claiming.

Zholia Alemi practised as a psychiatrist across multiple NHS trusts for 22 years on the strength of a forged medical degree before being struck off in 2018, prompting the GMC to review the qualifications of thousands of doctors registered on overseas degrees obtained before 2003 (NHS Counter Fraud Authority). Section 49 of the Medical Act 1983 makes false claims to registration a standalone offence, and the Nursing and Midwifery Order 2001 and Health and Social Work Professions Order 2001 give equivalent protection to titles such as "nurse," "midwife," "physiotherapist" and "paramedic" — using one without a matching, current register entry is an offence on its own.

For staffing agencies placing locums and interim healthcare workers, the register check needs to happen before each placement, not once at initial agency registration — a registration can lapse or gain conditions after a worker first joins the agency's books. Our interim staffing solutions and healthcare verification tools are built around this repeat-check requirement.

Verifying Tradespeople: Gas Safe Register, NICEIC and CSCS Cards

Anyone carrying out gas work in a UK home or business must be registered for that specific class of work, and anyone presenting themselves as qualified to do so without registration is committing a criminal offence, not a contractual breach. Gas Safe Register replaced CORGI as the UK's official gas registration body on 1 April 2009.

Regulation 3 of the Gas Safety (Installation and Use) Regulations 1998 makes it a criminal offence for anyone to carry out gas installation, maintenance or repair work while not registered for the applicable class of gas work (legislation.gov.uk, Gas Safety Regulations 1998). Verification takes seconds: the Gas Safe Register's public search confirms whether an engineer's licence card number is current and what classes of work it covers, and Gas Safe will also verify an ID card by phone. Electrical work under Part P of the Building Regulations follows a similar logic through competent-person schemes such as NICEIC, where a lapsed scheme membership means the contractor can no longer self-certify domestic electrical work, whatever their certificate says.

On construction sites, CSCS cards serve a similar function without being a legal licence: the industry's standard proof of health, safety and skills training, covering roughly 2.3 million cards across 38 card schemes. The CSCS Smart Check app and API let a site manager scan a card's NFC chip or QR code for an immediate answer on whether it is genuine, current or cancelled for fraud — a check visual inspection cannot replicate. Our construction and trades verification tools are built around this pattern of frequent, high-volume register checks rather than a one-off onboarding check.

Cross-Checking Every Licence Type in One Table

The verification channel differs by profession, but the principle is identical throughout: check the number against the issuing body, not the document presenting it.

Questions Compliance and Recruitment Teams Keep Asking

On forums frequented by compliance officers and staffing agencies, the same handful of questions recur, usually phrased less formally than regulatory guidance.

Is a clone firm the same thing as a fake FRN? Not quite. In a clone-firm scam the FRN itself is genuine and belongs to a real, authorised firm, but the scammer has attached a different trading name, phone number or website to it, banking on the compliance check stopping at "the number is on the register" instead of continuing to "and do these contact details match what the FCA has on file."

Does the registration date on a candidate's certificate have to match the register exactly? Not always for innocent reasons — maiden names, historic register entries, and specialist-register additions that postdate initial registration are common — so a mismatch should trigger a direct call to the regulator rather than an automatic rejection.

Is a CSCS card that scans as valid on Smart Check enough on its own? No. Smart Check confirms the card itself has not been reported lost, cancelled or fraudulent, but it does not retroactively verify that the underlying test was ever genuinely sat. A scheme trading as Construction Card Scheme Online UK sold CSCS, Gas Safe and site-supervisor cards for between £200 and £800 without delivering any of the underlying tests, and no genuine cards were ever issued to buyers (The Construction Index, Card scam warning), which is exactly the kind of fraud a card-only check misses.

Legal Consequences of Fake Licences and Registrations

A false licence is rarely prosecuted alone; sector offences under the Medical Act 1983, FSMA 2000 or the Gas Safety Regulations 1998 usually sit alongside general fraud law. Knowingly submitting a false registration number to secure work engages section 2 of the Fraud Act 2006 (false representation), and fabricating the physical certificate or ID card separately engages the Forgery and Counterfeiting Act 1981 — both carrying a maximum of ten years' imprisonment (legislation.gov.uk, Fraud Act 2006).

For organisations, the Economic Crime and Corporate Transparency Act 2023 Failure to Prevent Fraud offence, in force since 1 September 2025, adds a further layer: a large organisation that onboards a vendor or hires a practitioner on a licence it never checked can struggle to show it had reasonable fraud-prevention procedures, a defence discussed further in our guide to forged vendor compliance certificates. Report suspected licence fraud to Action Fraud and to the relevant regulator directly.

Building Licence Verification Into Onboarding and Hiring

A documented, repeatable verification step at onboarding or offer stage is what separates a workable ECCTA "reasonable procedures" defence from a token one: capture the licence number at application or tender stage, check it against the issuing body's own register before contract or start date, and repeat the check periodically, since registrations lapse and licences get revoked mid-engagement.

CheckFile applies multi-layer analysis, structural, metadata and cross-document checks, to the certificates, ID cards and licence documents submitted during onboarding, giving compliance teams broad detection coverage without replacing the register check itself. Contextual analysis distinguishes ordinary variation, such as a maiden name or a renewed card design, from genuine fraud signals, keeping false positives manageable. Depending on client configuration, an additional AI-generation signal layer flags certificates and ID documents showing signs of generative editing, complementing rather than replacing the primary-source register check. The platform supports 3,200+ document types across 24 OCR languages and 32 jurisdictions.

Detect Forged Certificates Without Replacing Your Register Checks

No detection platform, including CheckFile, replaces the register check that only the FCA, GMC, NMC, HCPC, Gas Safe Register, NICEIC or CSCS can perform — the single source of truth for whether a licence is genuine is the issuing body's own database, not the document presented. What automated analysis adds is a forensic pass on the certificate or ID card itself, catching alterations and AI-generated edits that a five-second visual check misses, as a complement to existing register checks, not a substitute for them.

Explore CheckFile's approach to AI-generated and forged document detection to see how this signal layer fits alongside the primary-source verification your compliance process already requires.

Frequently Asked Questions

Is it illegal to work using a fake or altered professional licence in the UK?

Yes. Practising a regulated profession without genuine authorisation is a criminal offence in its own right under the relevant sector legislation (the Medical Act 1983, the Financial Services and Markets Act 2000, or the Gas Safety Regulations 1998, depending on the profession), and knowingly presenting a false registration number to secure work separately engages section 2 of the Fraud Act 2006. These offences apply regardless of whether the individual was ultimately competent to do the work.

How do I check if an FCA firm reference number is genuine and not cloned?

Search the FRN or firm name on the FCA's Financial Services Register at register.fca.org.uk, then compare the contact details, trading name and address shown on the register against what the firm has actually given you. If the FRN is genuine but the phone number, email domain or trading name does not match the register entry, you are likely dealing with a clone firm rather than the authorised business itself.

How can I verify a doctor's or nurse's registration before a locum shift starts?

Use the GMC's List of Registered Medical Practitioners for doctors, or the NMC's online register for nurses and midwives, searching by the individual's name or registration number. Confirm the registration is current and unrestricted, not just present, since a suspended or conditions-attached registration will still return a search result.

Does a CSCS card that passes Smart Check guarantee the underlying qualification is real?

No. Smart Check confirms the card itself is current and has not been reported lost, cancelled or fraudulent, but it cannot retroactively verify that the holder genuinely sat the test behind an older card, particularly where cards were sold without training as part of a scam. Treat a valid Smart Check result as one input alongside broader onboarding checks, not a complete answer.

What should a business do if it discovers it accepted a fake licence during onboarding?

Stop any work or payment connected to that individual or firm immediately, and verify directly with the issuing regulator using your own search tool rather than contact details supplied by the person in question. Preserve the original document and any correspondence, report the matter to Action Fraud and to the relevant regulator, and review whether the same verification gap could have let other fraudulent credentials through your onboarding process.