Verify It at the Source: A Directory of Official Registries

There is a hierarchy of evidence that almost nobody writes down, and it explains most of the arguments we see between fraud teams and the people they slow down.

At the bottom sits the document itself. Above it sits forensic analysis of that document. Above that sits a second document that agrees with the first. And at the top, alone, sits the issuer confirming it — the registry, the licensing board, the university, the tax authority. Everything below the top of that ladder is inference. The top is fact.

The awkward truth for a company that sells document forensics is that we are not at the top of that ladder, and we will tell you so on a sales call. Forensics is what you use when the issuer cannot be reached, will not answer, does not exist, or would take three weeks — which is most of the time, at volume. But when you can go to the source, go to the source. This page is a directory of where that source lives.

Key takeaways

• Issuer confirmation outranks every form of analysis, including ours. Use it when it is available.
• Most official registries are free and answer in seconds; teams skip them out of habit, not cost.
• The registry that matters is usually the one that issued the document, not the one that is easiest to search.
• Verify the portal before you trust its answer — lookalike "verification" sites are a fraud category of their own.

Companies and business identity

United States — SEC EDGAR. Full-text search across everything a public company has filed. If a counterparty's financials are supposed to be audited and public, they are here, and any version they email you should match.

United States — Secretary of State registries. Company registration is state-level, so the authoritative record for an LLC lives with the state it was formed in. Each state runs its own free business search; there is no national equivalent for private companies.

United Kingdom — Companies House. Free, fast, complete, and includes the full filing history and the list of officers. Note what it does not do: Companies House registers what it is told and performs limited verification, so registration is proof of a filing, not of a real trading business.

Global — OpenCorporates aggregates company data from many jurisdictions in one search. Treat it as a finding aid that points you at the official registry, not as the official registry.

Legal entity identifiers — GLEIF. If a counterparty has an LEI, the GLEIF index tells you who they legally are and who owns them, in a form that is consistent across borders.

Sanctions and enforcement

OFAC Sanctions Search covers the US Specially Designated Nationals list. The EU Sanctions Map covers the European regimes. Both are free and both should be run against the counterparty and the beneficial owner, not just the trading name on the invoice.

Professional licences and credentials

Healthcare (US) — NPPES NPI Registry. Every US healthcare provider billing federally has an NPI, and this is the free public lookup for it.

Financial advisers (US) — FINRA BrokerCheck. Registration status, employment history and disciplinary record for brokers and firms. An adviser sending you a beautifully typeset "prospectus" who is not in BrokerCheck has already answered your question.

Motor carriers (US) — FMCSA SAFER. Operating authority, insurance status, safety record. The single most useful free lookup in freight, and the one that ends most double-brokering conversations early.

Lawyers, engineers, accountants, contractors. Almost always a state, provincial or national board with a free public register. There is no shortcut here: find the board that issues the licence in the jurisdiction named on the document.

Education

United States — National Student Clearinghouse handles degree verification for the large majority of US institutions. It is a paid service for employers, but it is the authoritative route, and it is cheaper than a bad hire.

United Kingdom — HEDD, the official degree verification service for UK higher education, which also maintains information on known bogus providers.

Everywhere else — the registrar. Universities verify their own awards, and the registrar's office is the address. Use the contact details on the institution's own website, never the ones printed on the certificate you are checking. We walked through the full process in how to verify a degree.

Identity and travel documents

ICAO Doc 9303 is the specification for machine-readable travel documents, published free by the International Civil Aviation Organization. It is the reference for how a passport's machine-readable zone is constructed, including the check-digit arithmetic that lets you catch a badly made forgery with a pen and paper. Our MRZ guide is the practical version.

For the identity behind the document, the authoritative source is the issuing government, and access is generally restricted to licensed identity-verification providers. This is one of the areas where buying a service is genuinely the right answer.

International documents

The HCCH Apostille Section lists the competent authority for every country in the 1961 Convention — the body that can confirm whether an apostille is genuine. Many now run electronic registers you can query directly. Apostilles and consular legalization are different processes with different verification routes, and the certificate itself will tell you which one you are holding.

Standards and reference material

The PDF Association publishes accessible material on the PDF specification and its subsets — worth knowing if you are trying to work out whether a structural oddity is suspicious or just how a particular producer behaves.

C2PA publishes the open specification for content provenance and authenticity, the emerging standard for signed content credentials on images and documents.

Before you trust the portal

One habit worth building, because it is the failure mode that turns this whole page against you.

Fake verification portals exist. The pattern is straightforward: the forged certificate carries a URL or a QR code pointing at a site the fraudster controls, which obligingly confirms that the certificate is genuine. It is a self-referential loop, and it is convincing precisely because checking felt like diligence.

So: navigate to the registry yourself. Search for the issuing body, go to its site, then find the verification tool there. Never follow a link, a QR code or a phone number printed on the document you are verifying. The same rule applies to a phone call — look the number up independently, exactly as you would for a bank account change request.

When the source cannot answer

Which is often, and this is where the rest of our work lives.

Small suppliers have no registry. Many documents — invoices, statements, receipts, letters, contracts — have no issuing authority that will confirm anything to a third party. Consumer-facing institutions will not discuss a customer's document with you, correctly. And at volume, "email the issuer" has a turnaround measured in days against a decision measured in minutes.

That is the space forensics is for: narrowing four hundred documents down to the forty that deserve a human, and giving that human something concrete to act on. It is inference rather than confirmation, and we would rather say so than pretend otherwise. Use the ladder. Climb as high as the situation lets you.

Frequently asked questions

What is the most reliable way to verify a document?

Confirmation from whoever issued it, obtained through contact details you found independently. Every other method — forensic analysis, cross-referencing, visual inspection — is inference about the document rather than confirmation of it.

Are official registry lookups free?

Most are. Company registries, sanctions lists, professional licence boards and carrier authority lookups are typically free public services. Degree verification is a notable exception and is usually charged per check.

How do I know a verification website is genuine?

Find it yourself. Search for the issuing body, go to its official site, and use the verification tool published there. Never use a link, QR code or phone number printed on the document being checked — fraudulent documents routinely point at verification sites the fraudster runs.

What if the issuer will not respond?

Then you are in the inference layer, and the right move is to build corroboration from several independent directions: registry data, the document's own internal consistency, structural forensics, and agreement with other documents from the same counterparty. Any one of those alone is weak. Three that agree is a reasonable basis for a decision.