TL;DR: A fake certificate of good standing is a status PDF generated from scratch, edited after a real secretary-of-state download, or a portal screenshot offered as the certificate, so KYB treats an entity as authorized on a date the register does not support. The FBI's 2025 Internet Crime Report recorded 22,364 complaints that referenced artificial intelligence, with adjusted losses of $893,346,472. A clean seal fails as a control: Delaware states that a paid online status check does not generate an official certificate of good standing.
What a Fake Certificate of Good Standing Actually Is
A certificate of good standing is a state office's statement that an entity is in compliance as of a date: legal name, file or entity number, jurisdiction, and the standing that office will attest. Delaware calls the official document a certificate of good standing. California issues a Certificate of Status. A fake makes that claim without the live register behind it, or recycles a real certificate the applicant does not control.
The file arrives in two production families, plus a pattern that only looks like a certificate. Edited-after-creation starts with a genuine state download, then changes the entity name, the standing, or the date while the seal stays. Generated-from-scratch builds the caption, the seal, and the file number with no registrar export in the file's history. The third pattern is a browser print of an entity-search or online-status screen, saved as a PDF and uploaded as the certificate.
Delaware's online status page shows why that third pattern survives review. The division offers a $10 status or a $20 status with tax and history, and it states that requesting an online status will not generate an official certificate of good standing. The "Status as of" date is when the entity entered its current status. The official certificate is a separate request. A certificate of incorporation records that the entity was created. Good standing records whether it still meets that office's reports and fees.
The date matters outside the bank too. Before an out-of-state corporation, limited liability company, or limited partnership qualifies in California, the California Secretary of State requires a valid certificate of good standing from an authorized public official of the home jurisdiction. A certificate authentic on the day it was ordered can be stale by the time a bank sees a copy of that packet. Test the date on the copy against the home register.
Tells That Still Work, and the Ones That Don't
Pixelation, a crooked seal, and a font that fights the rest of the page still catch crude forgeries. They miss a real download with one field changed, and a generated page built from a public specimen. FinCEN's November 2024 alert described an increase in suspicious activity reports about deepfake media, particularly fraudulent identity documents used to get past verification. A status certificate has no portrait and no liveness check. The control that remains is the register, read against the file's history.
Issuer mismatch is the highest-yield tell. The file number on the PDF has to resolve at the office named on the page to the same legal name. A Delaware number on California certificate language, or a number that belongs to a different entity, fails that bind. A file that borrows one state's seal language and another state's file number has already failed. The office on the letterhead is the office that can confirm the standing.
The date is the tell visual review skips when the seal looks expensive. Good standing speaks as of issuance, and an unpaid franchise tax, a missed report, or a suspension can move the entity after the PDF was printed. Delaware's "Status as of" date marks when the entity entered its current status, so a printout of that screen is not a certificate issued today. IC3's 22,364 complaints and $893,346,472 in adjusted losses count reports that mentioned artificial intelligence. They are not a census of forged certificates.
The row that matches the register and still fails is why shell company red flags still apply after the PDF looks clean. A genuine certificate can sit on a nominee, a mail drop, or a company the applicant does not control.
How Detection Actually Works
Detection reads the file's story. Production method asks how the bytes were made: a state certificate portal, an office suite, a design tool, or a generative pipeline. A Delaware certificate request and a recreated letterhead do not share a production path. Timestamp trail asks whether the file's history fits the date on the page. Offices reissue certificates, so a file written this week can be a legitimate new order. The suspicious trail is an edit sequence after a genuine download, with the visible seal left intact.
Issuer matching is the register bind. Name, file number, jurisdiction, and status have to agree with the office named on the document, on the day of review. A number that resolves to a dissolved or suspended entity fails even when the PDF still says good standing. The register can be newer than the PDF.
Consistency runs inside the page and across the packet. Entity type stays stable from the caption to the file number. The application, the formation document, and this certificate cannot describe three different legal names and still be one customer. Agreement among the PDFs passes only when the register agrees too. Document fraud in banking made that point for statements and identity documents.
Model artifacts are the residue of a generated page: compression that does not come from a state portal, a synthesized seal texture, layout regularity that government PDFs rarely hold. Recycled patterns close the serial case: one certificate number, one seal crop, or a near-duplicate layout on unrelated applications. Those six checks are classes of evidence, not a recipe for a cleaner fake. Escalate when the portal is down, the jurisdiction publishes no status, or a name change on the register might be a real amendment.
What to Do with a Suspect File
Stop treating the upload as the register. Open the entity search for the office named on the PDF and compare legal name, file number, jurisdiction, and current status. If the number does not resolve, reject the file and require a certificate ordered from that office. If the number resolves to a different name, hold the file until the register shows the name change or conversion.
When the upload is a browser print or a screenshot of a status page, ask for the official certificate. A screenshot of Delaware's $10 screen also fails California's request for a valid home-jurisdiction certificate. When the register matches and the file still shows edits after a real download, leave the file uncleared. File history still has to show this PDF is the office's record. The same certificate number, or the same file, on two unrelated onboardings is enough to freeze both and write the narrative.
For a scored second look, check a document in the Watchdoc playground. The x-ray is the same six checks: production method, timestamps, issuer match, consistency, model artifacts, and recycled patterns. The rest of the onboarding packet, formation documents included, sits in KYB document fraud detection. Good standing is one gate inside that packet.
Where Sphinx Fits
Sphinx scores the status PDF the way it scores other onboarding files. Watchdoc runs the six checks, shows the x-ray, and returns a verdict. That stack has a 94.3% correct verdict, catches 2.8x more forgeries than visual-and-template review, and clears clean files in under 28 seconds, at $0.45 per document with no seats and no platform fee. The Watchdoc playground is free for the first file, with no email required, on a 50-document free tier. The job on this document is narrow: bind the PDF to the issuing office and to the date before KYB treats the entity as authorized.
Frequently Asked Questions
How can you tell if a certificate of good standing is fake?
Resolve the entity name and file number at the secretary of state or division of corporations named on the document, then compare status and the certificate date to the live register. Visual defects still catch crude forgeries. Competent fakes fail when the file was edited after a real download, generated without a registrar export, or reused across unrelated applicants.
What is the difference between a certificate of good standing and a certificate of incorporation?
A certificate of incorporation attests that the entity was formed and records the founding particulars. A certificate of good standing, also called a certificate of status or a certificate of existence in some states, attests to standing with that office as of a date. A clean status PDF leaves the formation document untested, and a real formation filing leaves today's standing untested.
Is a secretary of state website printout a certificate of good standing?
Delaware's Division of Corporations states that a paid online status check, $10 for status or $20 for status with tax and history, does not generate an official certificate of good standing. The "Status as of" date on that screen is the date the entity entered its current status. A browser print of that screen is a picture of a webpage, and California issues its Certificate of Status as a separate order.
Does a certificate of good standing expire?
A certificate of good standing speaks as of the date the office issued it. Standing can change after that date if a report or fee goes unpaid or the state suspends the entity. Review means comparing that issuance date with the live register on the day of the decision, because the PDF does not update itself.
Should KYB reject a good-standing certificate that matches the state register?
A register match means the office's record and the compared fields agree. It leaves control of the entity, and any edit after download, still open. Clear the paper when issuer match and file forensics agree, then continue with ownership and shell-company checks.
.png)
