Verifying online training certificates: attendance tracking and fraud prevention

The way to make an online training certificate trustworthy is to tie the document to the system's own attendance and completion record and give every certificate a unique code that can be checked on the institution's own website. If attendance and completion rules are written down in advance, anyone can use a QR code or verification code to see within seconds whether a certificate is genuine, and revoked certificates show up as revoked on the same page.

What is a verifiable certificate?

A verifiable certificate is one whose details can be compared with the issuing institution's records. A plain PDF or printed certificate is only an image; if the name, date or course title is altered, that is hard to spot from the outside. A verifiable certificate carries a code or QR code that leads to the record in the institution's own system, so anyone can check that the document and the record match.

This approach protects both the holder and whoever is asked to accept the certificate. An employer, professional body or another training institution verifies it against a record rather than an image. The holder, in turn, can simply share the verification link if their certificate is ever questioned, without any back-and-forth correspondence.

For the institution, verifiability is also a question of reputation. A fake certificate circulating under its name undermines trust in every certificate it has issued. Building a verification process also protects the effort of those who earned their certificates honestly.

Verifiability is a matter of the data behind the certificate, not its design. That is why designing a certificate process should start not with the template but with the record the certificate will rest on.

How is attendance tracked in online training?

Attendance tracking needs different methods depending on the format. In live lessons the core data is the roll call; in recorded video courses it is whether lessons have been watched and completed. In blended programmes both kinds of data should come together in the same learner record.

In live lessons, recording attendance as a simple present or absent is often not enough. Separate states such as present, late, absent and excused let instructors record what really happened and apply the completion rule fairly. Creating the meeting from inside the system and showing the link only to enrolled participants also helps match attendance to the right person.

In video courses it matters that lesson completion is stored on the server. A completed flag produced in the learner's browser can easily be faked. Sequential unlocking, which stops learners moving on before a lesson is finished, also keeps the completion record meaningful.

Some institutions want participation measured by active involvement, not just by being connected. In that case short in-lesson questions, end-of-session surveys or assignment submissions can serve as data that complements the roll call. Every additional criterion, however, must be announced to learners in advance and tied to the same record in the system; otherwise tracking turns back into manual work.

How should the completion rule be defined?

Most disputes over certificates arise because the completion rule was never clearly written down. Learners should know at enrolment what they must do to receive a certificate. Stating these conditions on the course page and in the enrolment confirmation prevents most later arguments.

• A requirement to attend a given share of live sessions should be defined together with how excused absences count.
• Completion of video lessons should be judged by the system's own record.
• If there is a final exam, the pass mark and the number of retakes should be stated in advance.
• If an assignment or project is required, the grading criteria should be shared with learners.
• For paid courses, a completed payment can be set as a precondition for accessing the certificate.

Once the rule is set, it is better for certificates to be generated by the system when the conditions are met rather than by hand. Manual production creates extra work and carries the risk of issuing a certificate to someone who did not meet the rule.

A route for exceptions should also be defined in advance. A learner who misses a session because of illness or a technical failure can attend a make-up lesson or watch the recording, and this can be marked as a separate attendance state. Exceptions then rest not on personal discretion but on a recorded rule that works the same way for everyone.

A certificate is worth only as much as the record behind it.

How is a certificate verified with a QR code or verification code?

The most common method is to give each certificate a unique verification code and print it on the document both as text and as a QR code. Scanning the QR code with a phone camera opens the institution's verification page directly; the text code can be typed into that page by someone holding a printed copy.

It is important that the verification page runs on the institution's own domain. Someone forging a certificate could also set up a convincing fake verification page. Whoever checks the certificate should be able to see that the address really belongs to the institution, and institutions should publish their verification address clearly on their own site.

The information shown on the verification page should be chosen with care. The holder's name, the course title, the issue date and whether the certificate is valid are usually enough. Showing contact details, ID numbers or exam scores on a public page is unnecessary and may conflict with data protection principles. Check which information can be shared under KVKK against current official sources, and ask your legal adviser where needed.

A verification link also makes certificates easier to share online. When learners attach a certificate to an application or add it to a professional profile, they can use the verification link instead of the PDF. Anyone who sees it then reaches the same information, and the certificate's current status, without having to contact the institution.

How can certificate fraud be prevented?

No single method eliminates fraud entirely, but when several measures are combined, forging a certificate becomes both harder and pointless, because those who accept certificates get used to checking the record instead of the image.

• Verification codes should be long and random enough that they cannot be guessed, and never derived from a sequence number.
• Every certificate should also be tracked internally with its own certificate number.
• Certificates should be issued as system-generated PDFs rather than editable files.
• The verification page should be published only on the institution's own domain.
• Revoked certificates should not be deleted but shown as revoked on the verification page.
• Issuing, revoking and reissuing certificates should be logged together with who did it.

Revocation deserves particular attention. If a certificate issued by mistake, or later invalidated, is simply deleted, copies keep circulating and the verification page shows nothing at all. A record that clearly states the certificate has been revoked gives a definite answer to whoever is checking it.

One of the most effective defences against fraud is a habit of verification among those who accept certificates. Institutions should explain briefly on their certificates page how verification works and encourage partner organisations to check certificates through that address. Once unverified certificates stop being accepted, forging them no longer makes sense.

How does the certificate process differ for congresses and events?

Congresses and events involve several types of document rather than a single attendance certificate: attendance certificates, author or presenter certificates, workshop certificates and in some cases invitation or acceptance letters. Each has its own eligibility rule, and those rules need to be linked to registration, abstract and payment data.

When certificates run into the hundreds, bulk generation and payment-gated access become decisive. Making sure an attendee who has not paid cannot download a certificate, or that presenter certificates go only to authors of accepted abstracts, are rules that are highly error-prone when applied by hand.

At congresses, the accuracy of the details printed on each certificate is a separate concern. Names and titles must be entered correctly at registration, presentation titles must match the final accepted version, and the certificate language must suit the event. Letting attendees check their name and title before downloading noticeably reduces later requests for reissued certificates.

When certificates become available should also be announced in advance. Allowing attendance certificates to be downloaded before the event ends can mean issuing them before attendance is complete. Releasing them all at once after the event, once attendance is closed, both protects the rule and gives attendees a clear date.

Frequently asked questions

Is a QR code on a certificate mandatory?

It is not mandatory, but it makes verification easier. A text verification code and the verification address printed on the certificate do the same job; a QR code simply reduces that step to a single scan.

How should a revoked certificate appear on the verification page?

Rather than saying the certificate was not found, it is better to state clearly that it has been revoked and on what date. Whether the reason for revocation is shown publicly depends on the institution's policy and its assessment of personal data concerns.

Can older certificates be moved into a new verification system?

If the number, name, course and date of older certificates are held in a reliable record, they can be imported. Adding certificates with no underlying record by guesswork defeats the purpose of verification; it is better to define a separate review route for those.

What is the difference between an attendance certificate and a certificate of achievement?

An attendance certificate shows that someone took part in a course or event to the required extent. A certificate of achievement additionally documents a competence measured by an exam, assignment or project. Stating clearly on the document which type it is prevents misunderstandings.

Should certificates have an expiry date?

That depends on the type of certificate. An event attendance certificate usually has no expiry; for professional competence certificates that must be renewed periodically, showing the validity period both on the document and on the verification page prevents an expired certificate from being mistaken for a valid one.

Where should you start when setting up a certificate process?

The first step is to write down, for each course or event, what it takes to earn the certificate; the second is to decide which record will measure it. When the template, QR code and verification page are built on top of those two decisions, the certificate becomes a genuinely trustworthy document.

Keeping attendance records and certificates in the same system reduces both workload and the risk of disputes. At Bir Web Ajans we generate PDF certificates with public verification and revocation notices in Novademi, and congress attendance, author and workshop certificates tied to registration and payment data in Nova CongressPort.