TL;DR: A fake certificate of incorporation is a formation filing generated from scratch, edited after a real export, or reused across unrelated applicants so KYB treats a company as formed when the registrar does not. Visual review of seals and letterhead fails against competent files. FinCEN's August 2026 final rule permanently exempted U.S. companies from beneficial ownership reporting, so the onboarding desk — not a federal registry — is where a forged COI has to fail.
What a Fake Certificate of Incorporation Actually Is
A certificate of incorporation is the registrar's proof that an entity was formed: legal name, formation date, file or company number, registered office, and the issuing office. In the United Kingdom that office is Companies House. In the United States it is a state secretary of state or division of corporations, not a federal agency. KYB teams collect the PDF because it claims the business exists as a legal person. A fake COI makes that claim without matching the live registry, or matches a real entity the applicant does not control.
The file arrives in two production families. Edited-after-creation starts with a genuine export — a Companies House certified copy, a Delaware certificate — then changes one field: officer, registered agent, share count, or date. Generated-from-scratch builds the layout, seal, and serial in a design tool or a generative model. Both pass a reviewer who asks whether the document looks official. Neither should pass a reviewer who asks whether the registrar issued this exact record.
Serial reuse sits beside those two. The same PDF, certificate ID, or seal-and-layout package appears on applications that do not share an owner. The first submission may be a real company; later ones borrow its paper. That is a KYB problem, not an identity-document problem. A passport check binds a face to a card. A certificate of incorporation has no face. The file has to be bound to a registrar and to this applicant. Articles of incorporation are the founding filing; a certificate or certified copy is the registrar's attestation; good standing only confirms current fees and reports. Mixing those labels is a content error generators still make. Know Your Business is the workflow that should catch it. The COI check is one gate inside that workflow, not a substitute for UBO mapping or sanctions screening.
Tells That Still Work, and the Ones That Don't
Pixelation and crooked borders still catch crude forgeries. They do not catch a file generated against a public specimen or edited after a real download. FinCEN's November 2024 alert on deepfake media warned that generative tools are used to circumvent due diligence. Formation PDFs sit in that same upload class: no live capture, no biometric bind.
Registrar mismatch is the highest-yield tell. A UK company number must resolve on Companies House company information to the same name, date, and registered office. A U.S. file number must resolve on the named state's entity search, such as Delaware's Division of Corporations entity search, not a neighboring portal or a vendor screenshot. A Delaware LLC citing Companies House, or a Delaware number that belongs to a different legal name, is a failed issuer match.
Edited seals still matter. A genuine registrar seal belongs to a certified copy, digital certificate, or state validation ID. An edited seal is often a raster pasted onto a vector page, or a stamp whose issuer does not match the letterhead. A generated COI can carry a clean seal and still have no certificate ID in the state's validation tool. Mixed fonts, wrong-office letterhead, JPEG uploads, and a "2014" seal whose file was written last week catch incompetence. Treating those as the whole playbook is how a generated file clears.
The gap in the second and third rows is why shell company red flags still matter after the PDF clears. A certificate can be authentic and the applicant can still be a nominee sitting on a mail-drop address. Document authenticity and entity legitimacy are separate questions. Confusing them is how a real COI for the wrong business opens an account.
How Detection Actually Works
Detection on a formation PDF is the file's story, not a guess about the seal. Production method asks how the bytes were made: registry export, office suite, design tool, or generative pipeline. A Companies House certified copy and a design-tool "Delaware certificate" do not share a production path even when both look like government paper.
Timestamp trail asks whether history matches claimed issuance. Registries reissue certified copies, so a 2018 date on a file written last Tuesday is not automatically fake — but author, software, and edit sequence should look like a registrar or a corporate-service printer, not an unnamed editor session. Edited-after-creation often leaves that trail with the visible seal untouched.
Issuer matching is the registrar bind. Name, number, jurisdiction, status, and registered office have to agree with the live record at the office named on the document. Stopping at "a company with this name exists somewhere" is not issuer matching. U.S. formation is state-specific; UK formation is Companies House-specific.
Consistency is internal and package-level. Entity type cannot flip from LLC to PLC mid-page. Directors should match the application and the registry officers list. Perfect agreement across a COI, a bank statement, and invoices is not proof of authenticity. Generators produce internally consistent packages by construction. Inconsistency is a fail. Consistency is only a pass if the registrar agrees.
Model artifacts are the residue of generated pages: compression patterns that do not come from a registry printer, synthesized seal textures, layout regularity real government PDFs rarely achieve. Visual review lost that argument. Document fraud in banking already made the point for statements and IDs. Formation certificates are the KYB instance, not a new identity-document category. Recycled patterns close serial reuse: shared templates, repeated certificate IDs, reused seal crops, near-duplicate layouts across unrelated names. One clean file can look like a first-time applicant. Cousins in the queue are the tell.
Those six checks describe classes of evidence, not a recipe for a better fake. Human judgment still sits on top when the registry is down, the jurisdiction has no public search, or a recent officer change might be a sale. Those cases escalate. They do not auto-approve because the PDF looked expensive.
What to Do with a Suspect File
Stop treating the upload as source of truth. Pull the entity from the named registrar and compare every material field, not only the number. If the number does not resolve, reject the file and require a certified copy from that office, or pull the filing yourself. If the number resolves to a different name, treat it as a mismatch until the registry also shows the conversion or name change.
When the registry matches and the file still looks edited, break-test native PDF versus screenshot, metadata versus claimed issue date, seal as a separate object versus printed ink. A screenshot of a certified copy is a picture of a claim. Request the original export. Inability to produce it is a decision, not a documentation delay. Serial reuse is an investigations event: the same certificate ID or layout on two unrelated onboardings is enough to freeze both files and write the narrative. Do not clear the second application because the first one already "verified the template."
For a scored second look, check a document in the Watchdoc playground. The x-ray is production method, timestamps, issuer match, consistency, model artifacts, and recycled patterns — evidence for the case file. Speeding up business verification depends on failing bad paper fast so good paper is not waiting behind it.
Where Sphinx Fits
Sphinx scores the formation file the same way it scores other onboarding documents: Watchdoc runs the six checks, shows the x-ray, and returns a verdict a reviewer can defend. That stack has a 94.3% correct verdict, catches 2.8x more forgeries than visual-and-template review, and clears clean files in under 28 seconds, at $0.45 per document with no seats or platform fee. The Watchdoc playground is free for the first file, no email required, on a 50-document free tier. The longer product story is Sphinx Doc Fraud AI forgery detection. The COI job is narrower: bind this PDF to a registrar before KYB treats the company as real. For the rest of the onboarding packet, see KYB document fraud detection.
Frequently Asked Questions
How can you tell if a certificate of incorporation is fake?
Resolve the company or file number at the issuing registrar and compare name, date, jurisdiction, and registered office field by field. Visual defects still catch crude forgeries. Competent fakes fail on registrar mismatch, edited fields on a real export, generated production artifacts, or the same file reused across unrelated applicants.
What is the difference between a certificate of incorporation and a certificate of good standing?
A certificate of incorporation (or certified copy of the articles) attests that the entity was formed and records the founding particulars. A certificate of good standing only confirms current compliance with state reporting and fees. A clean good-standing PDF does not prove the formation document in the file is authentic, and a real formation filing does not prove the company is in good standing today.
Does the U.S. have a national registry to check a certificate of incorporation?
No. U.S. entities are formed under state law. Verification means the secretary of state or division of corporations named on the document, such as Delaware's entity search or another state's business search. After FinCEN's August 2026 final rule, domestic companies are not in a federal beneficial ownership database, so state registrar matching is the primary public check.
Can an AI-generated certificate of incorporation pass a KYB visual review?
Yes. Generative tools reproduce letterhead, seals, and serial formats well enough that layout review is not a reliable control. FinCEN has flagged generative-AI media used to defeat due diligence. The control that still holds is issuer matching plus file forensics, not a judgment that the PDF looks official.
Should a KYB team reject a COI that matches the registry?
Not on authenticity grounds alone. A genuine certificate can still belong to a shell, a hijacked filing, or a company the applicant does not control. Match the PDF to the registrar, then still test ownership, address, and control. Authenticity of the paper and legitimacy of the customer are two different decisions.
.png)
