ISO Certification Scams to Avoid in 2026

How a genuine certification works

Knowing the normal process makes the abnormal one easy to spot. A genuine route has these features.

• You apply to a certification body, which reviews your scope and quotes audit time.
• A Stage 1 audit reviews your system and readiness, and a Stage 2 audit tests how it operates in practice.
• Auditors examine records, interview your people and raise findings you must correct.
• Once the audit outcome is approved, a certificate follows for three years, with annual surveillance audits in between.

Surveillance matters as much as the first audit. A certificate that is never followed by a surveillance visit, or whose supplier never mentions one, does not match the three-year cycle that accredited certification follows.

Any offer that removes the audit, or replaces it with a form and a payment, is not certification.

Seven common scam patterns

1. The guaranteed certificate

No consultant controls the audit result. A promise of certification regardless of the outcome means either that the supplier does not understand the process or that no real audit will take place.

2. Certification in days, with no on-site or remote audit

A certificate that arrives after a questionnaire and a payment has not been earned. Real audits take planned time and produce an audit report and a record of findings.

3. A certification body that cannot be traced

Some certificates carry the name of a body that has no accreditation, or that borrows the look of an accreditation mark. If the accreditation cannot be confirmed with the accreditation body itself, treat the certificate as unreliable.

4. Certificate and consultancy sold as one bundle

Accredited certification relies on independent judgement. A supplier that offers to write your system and also to issue the certificate has a conflict of interest, and you should ask how that conflict is managed. We take no position on any individual company here; the principle is what matters.

5. Lookalike names and websites

Fraudulent sites sometimes use names or logos that resemble real organisations. Check spellings, the web address and the contact details, and find the organisation through an independent source rather than through the link you were sent.

6. Unusual payment requests

Be wary of requests to pay in full in advance to a personal account, to use only cash or cryptocurrency, or to pay for an urgent release of a certificate. A genuine supplier issues an invoice in its legal name and accepts normal business payment methods.

7. Pressure and countdown offers

Phrases such as "only today" or "limited slots" are designed to stop you checking. Certification dates depend on audit schedules, not on a sales deadline.

A quick comparison of a genuine route and a scam:

No single row proves a scam, but two or three warning signs together justify stopping to verify. Print the table and tick it against any offer you receive.

How to verify a certificate and a certification body

• 1. Read the certificate. It should show your organisation's legal name, the standard and edition, the scope, the certification body's name and the validity dates.
• 2. Identify the accreditation. Ask which accreditation body accredits the certification body, and for which scope. Reputable bodies state this openly.
• 3. Check with the accreditation body. Most national accreditation bodies publish a list of the bodies they accredit. Confirm the certification body, the standard and your sector appear there.
• 4. Check with the certification body. Contact it using details you found independently, and ask it to confirm the certificate number.
• 5. Look for a public database. Some accreditation bodies and international schemes provide an online database of certified organisations. Use it where available, but do not treat a missing entry alone as proof of fraud, because some certified organisations opt out.

If you are verifying a supplier's certificate rather than your own, the same steps apply. Ask for a copy, then verify it independently.

Who is most at risk, and the cost of a shortcut

Scams tend to target organisations under time pressure: a supplier with a tender deadline, a business whose customer has just made certification a condition of the next order, or a new company with no experience of the process. They also target people who are unsure whom to ask. If that describes you, slow down by one day and run the verification steps. Checking for one day is cheap compared with the cost of a rejected certificate. It also helps to give one person in the organisation responsibility for supplier checks, so that an urgent request does not skip the process.

Checks to make before you pay anyone

• Request a written proposal that states scope, deliverables, exclusions and who issues the certificate.
• Ask for the legal entity name, registration details and a business address, then check them against public records in that country.
• Speak to at least one existing client of comparable size.
• Pay against milestones, not the full amount in advance.
• Keep every email, invoice and receipt in one folder.

What to do if you suspect you have been misled

Stop further payments and keep your evidence. Write to the supplier, asking for the identity of the certification body and the audit reports in writing. Contact the accreditation body concerned, which may be able to confirm whether a body is accredited and may have a complaints process. Depending on the country, you can also report suspected fraud to the police, a consumer authority or your bank. Because laws differ, take local advice before you decide what to claim.

Tell your customers early if a certificate you have relied on turns out not to be valid. It is uncomfortable, but it is far better than having them discover it during their own supplier audit.

A certificate that cannot be verified is worse than none. It can cause a tender to be rejected, a customer contract to be terminated and a supplier relationship to be damaged. The money spent on the false certificate is only part of the loss; the time lost before you start the real project is often greater. Doing it properly the first time, through gap assessment, system building, internal audit and a real certification audit, is usually quicker than recovering from a shortcut.

How Sterling works

Sterling follows the genuine route, drawing on 20+ years in the field and 8,100+ client engagements across 60+ countries. We assess your gaps, help build a working system, train your people and check readiness. The audit and the certificate then come from an accredited certification body of your choice. Each engagement carries a five-user Effivity subscription, and the awareness e-learning in Sterling Academy is complimentary.

Read the guide for your country

Scams take local forms, and the verification bodies and complaint routes differ by country. These guides cover the local detail.

• India: ISO certification scams
• Philippines: ISO certification scams
• UAE: ISO certification scams

Frequently asked questions

Next step

Book a free gap assessment

Talk to a Sterling consultant