How to verify a certificate of insurance

If someone has handed you a certificate of insurance — a subcontractor before they start work, a tenant before they move in, a vendor before you let them onto your site — you are being asked to accept a piece of paper as evidence that they are insured. The paper is usually an ACORD 25, and it is genuinely useful. It is also routinely misunderstood, and it is trivially easy to forge.

This is a practical walkthrough of what a certificate actually proves, how to check one, and what to do when the answer matters enough that a PDF is not good enough.

What a certificate of insurance actually is

A certificate of insurance is a summary of a policy, issued by the insured’s agent or broker, describing coverage that existed on the date it was issued. That is the whole of it. The ACORD 25 form says so on its face, in the disclaimer most people never read: the certificate confers no rights, amends nothing, and does not constitute a contract between the issuer and the certificate holder.

Three consequences follow, and all three surprise people:

• •It is not the policy. It summarises one. Exclusions, endorsements and conditions that materially change what is covered do not appear on it.
• •It is not a promise about tomorrow. A policy can be cancelled the day after a certificate is issued, and the certificate in your filing cabinet will look exactly the same as it did before.
• •Being listed as certificate holder is not coverage. It means you were sent the document. Being an additional insured is a different thing entirely, and it requires an endorsement on the actual policy.

Reading the document

Before you verify anything, check that the certificate says what you need it to say. Most problems are found here, not in forgery.

Question one: is the document genuine?

A certificate of insurance is, for the most part, a PDF. Anyone with a PDF editor and twenty minutes can change a limit, extend an expiry date, or produce one from nothing. This is not a theoretical risk; it is common enough that most large general contractors have a process for it.

Signs worth a second look

• •Fonts, spacing or alignment that change partway down the form — especially inside the limits or the dates.
• •A producer whose phone number, address or agency name does not resolve to a real, licensed agency.
• •Carrier names that are subtly wrong, or a NAIC number that does not match the carrier named beside it.
• •A certificate sent from the insured’s own email rather than from the agency — not proof of anything on its own, but it removes the one party with no incentive to alter it.
• •Round, convenient limits that exactly match your contract’s minimum and nothing else.

The reliable check

Call the producer listed on the certificate, using a number you looked up independently rather than the one printed on the document. Ask them to confirm they issued it. This works, and it is what most risk managers actually do.

It is also slow, it does not scale past a handful of certificates, and it fails outside business hours. An organisation tracking hundreds of subcontractors cannot phone an agency for each one, which is why so many certificates are filed without ever being checked at all.

Question two: is the coverage still in force?

This is the question you actually care about, and a genuine certificate does not answer it. A certificate proves a policy existed when the document was created. Whether it exists now is separate.

Older ACORD forms carried language about the insurer endeavouring to give notice of cancellation. Current forms do not promise you notice — the cancellation clause defers to the policy provisions, and most policies owe notice to the named insured, not to everyone holding a certificate. In practice, if a subcontractor stops paying their premium, nobody is obliged to tell you.

The options for answering it are, honestly, limited:

1. •Ask again, periodically. Re-request certificates at intervals. Cheap, and always out of date by exactly the length of the interval.
2. •Require notice contractually. Put an obligation to notify you of cancellation in the contract with the insured. Useful, but it is a promise from the party with the least incentive to keep it.
3. •Confirm with the agency at the moment it matters. Before work starts, before a payment releases, after an incident. Accurate, and it costs a phone call each time.

What a better certificate looks like

The reason certificate fraud works is that the document cannot prove anything about itself. It is a picture of a fact, and pictures can be edited.

A certificate can be issued with a cryptographic signature over its contents — the named insured, the limits, the dates — using a key whose public half is published. Anyone holding the certificate and that key can check the signature themselves, without contacting the agency that issued it, without an account, and without trusting the vendor who built the system. If a single character of the document has been altered, the signature stops matching.

That closes question one properly. It deliberately does not answer question two, which stays a live lookup, because the two facts genuinely have different lifetimes and merging them would hide exactly the failure you are trying to catch.

The short version

1. •Read it first. Named insured, dates, limits, and whether the description of operations actually grants what your contract requires.
2. •Confirm the producer is a real agency, using contact details you looked up yourself.
3. •Ask the producer to confirm they issued it — or check a cryptographic signature, if the certificate carries one.
4. •Treat the coverage question as separate and ongoing. Re-check it when the answer would actually change what you do.

The document in your hand is evidence of something that was true once. Knowing exactly how much it proves — and how much it does not — is most of the job.