The New Threat
AI-proof digital credentials
AI image tools can produce a certificate that looks genuine in minutes. Detection that relies on how a document looks cannot settle the question any more. Blockchain verification answers a different question, whether this exact file matches the record written when it was issued, and that answer does not soften as the generators improve.
TL;DR
An AI-proof credential is one whose authenticity is decided by cryptography rather than by appearance. TRUE hashes each document with SHA-256 at issue and writes that hash to four public blockchains, so verifying it means recomputing the hash and comparing it with the anchored record. A generated forgery can copy the layout, the seal and the signature and it still produces a different hash, so it fails the check. Because the check never inspects the artwork, better generative models do not weaken it. Most organisations are issuing this way within two to four weeks.
- The check is mathematical, so a visually perfect fake still fails.
- The record is public, so a verifier never has to contact your office.
- Four chains hold the anchor, so verification survives a problem on one network.
What has AI changed about certificate fraud?
It has removed the skill and the cost from producing a convincing document. Reproducing a layout, a seal and a signature used to take an experienced forger with editing software; generative tools now do it from a sample. The forgery does not have to be perfect, only good enough that whoever looks at it stops looking.
Template replication
Generative tools read a legitimate credential and reproduce the fonts, logo placement, layout and paper texture closely enough to pass a glance.
Seals and signatures
Signatures, stamps and embossed seals are image problems, and image generation solves them without the physical production that once made them expensive to fake.
Consistent invented detail
Names, dates, programme titles and registration numbers can be generated so that they agree with each other, which defeats the internal consistency checks a reviewer makes by eye.
Volume
One prompt produces many documents. Fraud that used to be worth the effort only for a high value role becomes cheap enough to attempt anywhere.
Is AI-assisted document fraud showing up in real data?
Yes, and it is being counted. Identity verification providers now report a measurable share of forged documents that were produced with generative tools, and the attacks that use them are getting more elaborate. Verification rates on the receiving side have not moved to match.
- AI-assisted forgery rose from 0% to 2% of document fraud during 2025, attributed to general purpose generative tools. Source: Sumsub Identity Fraud Report 2025 to 2026, published 25 November 2025, based on more than 4 million fraud attempts.
- Sophisticated multi-step attacks grew from 10% to 28% of all identity fraud attempts, a 180% rise year on year. Same Sumsub report.
- Only 52% of large employers verify every academic credential they are shown, falling to 37% at medium sized organisations and 29% at small ones, while 45% of large employers have already uncovered a false qualification claim. Source: Prospects Luminate, November 2025, from a YouGov survey of 526 HR decision makers.
Two percent is small today and it was zero the year before. The direction of that line is the reason to stop making authenticity a visual judgement.
Why do traditional security features stop working?
Because every one of them defends the same way: by making a document hard to reproduce by eye. Holograms, watermarks, security printing and handwritten signatures all raise the cost of imitation, and image generation lowers that cost faster than the features can be improved. A defence that depends on the forger's budget fails once the budget approaches zero.
Visual features are answering the wrong question
A hologram tells you the document was produced with certain equipment. It cannot tell you the name and the date on it were the ones the issuer wrote.
Database lookups depend on the issuer
Contacting the awarding body works, and it takes time, needs the body to still exist and to answer, and it is the step that gets skipped when a hiring decision is due.
Human review does not scale
Reviewing documents by eye is slow, and the reviewer has no reference copy to compare against. The judgement is made on plausibility, which is exactly what a generator optimises for.
How does blockchain verification make a credential AI-proof?
It replaces the question. Instead of asking whether a document looks genuine, it asks whether this exact file matches a fingerprint recorded at the moment of issue. That fingerprint is a SHA-256 hash, the record sits on public chains that nobody can rewrite, and a single changed character produces a different hash.
- Issue. TRUE computes a SHA-256 hash of the credential's contents, a fixed length fingerprint of that exact file.
- Anchor. The hash is written to public blockchains, on Ethereum, Polygon, AVAX and Fantom. The entry cannot be edited or deleted afterwards.
- Verify. The verifier's device recomputes the hash of the document in front of it and compares it with the anchored record. A match means the file is byte for byte what was issued. A mismatch means it is not.
Why generation does not help an attacker here
- Nothing is judged visually. A forgery that is indistinguishable to a human still hashes differently.
- SHA-256 fingerprints are 256 bits. Producing a second document that hashes to the same value is computationally infeasible with known methods.
- The record is decentralised. There is no issuer database to breach and rewrite.
- The record is append only. Once written, no party can alter the entry, including TRUE.
- The check outlives the issuer. A credential stays verifiable if the awarding body closes, merges or loses its records.
What changes when credential security is mathematical rather than visual?
The failure mode moves. A visually secured credential gets easier to fake every year, and a cryptographically secured one does not, because the two are defended by different things. The table sets the two side by side.
| Property | AI-vulnerable credential | AI-proof credential (TRUE) |
|---|---|---|
| Forgery method | Visual mimicry, generated as an image | Cryptographic forgery, computationally infeasible |
| Verification check | A person inspects layout, signature and seal | SHA-256 hash compared against the blockchain record |
| Tamper detection | Often invisible to the eye | Any change produces a different hash and the check fails |
| Effect of better AI | Forgeries become more convincing | None, because nothing is judged visually |
| Independence from issuer | The issuer has to be contacted to confirm | Verifiable against the public chain with no central API |
| Long-term security | Weakens as generation improves | Anchored on four chains and stable over time |
| Cost to issue securely | Hologram, watermark, paper, postage | Software only, close to zero per credential |
How long does it take to switch to AI-proof credentials?
Two to four weeks for most organisations, and issuing from the dashboard can begin immediately. The work is mapping which credentials matter, designing the document and the verification page, and connecting whichever system already knows who passed.
Week 1: assessment
Audit the credentials you issue, identify the ones most exposed to forgery, and define what has to connect to what.
Week 2: design
Build the template, map the issuing workflow and design what a verifier sees when they scan.
Week 3: integration
Connect the LMS, CRM or exam system through the API and test across devices.
Week 4: launch
Tell recipients what changed, watch the verification and share metrics, and adjust.
How much is TRUE already securing this way?
These are TRUE's own platform figures rather than third party research, and they describe the volume running through the architecture described above.
4blockchain networks
eIDAScompliant
500K+credentials secured
200+organisations issuing
What do TRUE customers say?
“For us, it’s only natural to collaborate with the player in secure document management that has the highest quality, and stands for world-class security.”
“SSF offer extensive training in Security to our customers, both physically and digitally. It has been particularly important for us to be able to ensure that our Proofs of Education are correct and secure.”
What do issuers ask about AI-proof credentials?
The five questions below come up in almost every conversation about moving off PDF certificates.
Why can AI not defeat blockchain verification?
AI is good at producing content that looks right. Blockchain verification does not look at the document at all. It recomputes the SHA-256 hash of the file and compares it with the hash written to a public chain when the credential was issued. A forgery that is visually perfect still produces a different hash, so it fails.
How quickly can we start issuing AI-proof credentials?
Most organisations go live in two to four weeks: week one to audit existing credentials, week two to design the template and the verification experience, week three to connect systems through the API, week four to launch. Issuing from the TRUE dashboard can start on day one.
Does blockchain verification stay reliable as AI gets better?
Better image generation makes forgeries look more convincing, which does not change a hash comparison. The security rests on SHA-256 and on the anchored record, not on how hard a document is to imitate visually. TRUE anchors to four chains so verification survives a problem on any single network.
What happens to credentials we already issued?
They stay valid as they are. You can start issuing blockchain secured credentials immediately for everything new, re-issue important historical credentials as secured versions, or migrate in stages.
Can a verifier check a credential without contacting us?
Yes. The check runs against the public blockchain record, so a verifier needs the document and nothing else. No login, no call to your office, and no dependency on your systems being online.
Where should you read next?
Verifiable credentials also change how hiring teams screen candidates. See how digital credentials support skills based hiring, or start with the mechanics of blockchain certificate verification.