Fake Degrees in India: Tamper-Evident Certificates

Fake degrees in India come from three places: self-styled universities, forgers who copy real ones, and insiders who misuse a genuine institution's name. A university cannot stop all three, but it can make its own certificates tamper-evident, so that any change to an issued certificate makes its QR check fail. This guide explains what that takes, in plain terms, for registrars, controllers of examinations and vice-chancellors.

How big is the fake degree problem?

The most visible part is the regulator's own list. In February 2026 the University Grants Commission named 32 fake universities, 12 of them in Delhi, up from 20 two years earlier. UGC says degrees from these institutions are not valid. In a written reply in the Rajya Sabha in August 2026, the Minister of State for Education said the Centre had asked states and union territories to register FIRs and close them. Closures are slow: the government told the Lok Sabha in December 2025 that 12 fake universities had been closed since 2014.

Fake universities are only one source. Forgers also copy genuine institutions, and that is where a registrar's office is directly exposed:

In May 2026, Kanpur police said a racket had forged the seal of a deputy registrar of CSJM University to issue bogus migration certificates. Police seized nearly 80 of them, along with counterfeit university seals.
In Surat in December 2024, police arrested 13 people, including 10 bogus doctors. They said two of the accused had sold BEMS degrees for Rs 70,000 each to nearly 1,500 people.
In Mohali in 2021, police said a gang used to create false domain names of universities and make fake certificates to match.

The hardest case is fraud from inside a real institution. In the Manav Bharti University case, Himachal Pradesh's police chief said that of about 41,000 degree records found on 14 of 55 seized hard disks, about 36,000 were fake, issued to people in 17 states. A seal and a signature proved nothing there. Only a record of what was issued, when and by whom could separate genuine degrees from the rest.

The Ministry of Education's own factsheet on the National Academic Depository puts the root problem simply: physical documents are vulnerable to loss, damage and forgery, and manual verification creates delays for everyone involved.

What manual verification costs a university

Verification lands on the institution that awarded the degree. In 2021 the UGC Secretary wrote to vice-chancellors that UGC does not verify degrees itself, that the university concerned must verify them, and that requests should get timely replies.

Most universities still answer by hand. Published procedures show what that involves:

Institution	Fee	How it works
University of Allahabad	Rs 500 per candidate in India	Bank draft only; reports are sent by post
M S Ramaiah University of Applied Sciences	Rs 1,000 per student record, plus GST	Email or a demand draft by post; reply in 5 to 7 working days
University of Calicut	Rs 2,025 per document, plus a search fee and Rs 60 postage	Search fee rises from Rs 285 to Rs 1,020 with the years since passing
IIT Guwahati	Rs 1,000 per student	Scanned transcript and degree by email or post; fee by cash, draft or transfer

Behind every fee is staff time. Someone finds the tabulation register, compares it with the photocopy, drafts a letter, gets it signed and posts it. Calicut's search fee rises with the age of the record, which tells you older records take longer to find.

The same exam branch also has to issue certificates on time. UGC has said students are entitled to their degree within 180 days of results, and has warned of action against institutions that miss it. Missing it is common when convocations slip. In August 2024, over 3 lakh students at five Tamil Nadu state universities were waiting for degree certificates, largely because vice-chancellor posts were vacant. Even a digital process needs people if it is run by hand: in 2020, Delhi University put 12 staff on digital degrees and cleared 450 to 500 a day, against more than 32,000 applications.

What "tamper-evident" means in plain terms

No certificate is impossible to copy. A tamper-evident certificate is one where any copy or edit is easy to catch, because the check runs against the record the university issued, not against the paper or PDF in front of the verifier. Five parts make this work.

1. A QR check against the issued record

Every certificate carries a QR code. Scanning it fetches the record the university issued and compares it with the certificate in hand. A match returns who issued it and what it certifies. A forged seal or a copied layout does not help a forger, because the check never looks at the seal.

One caution from the Mohali case: a QR is only as good as the address it opens. Tell employers to check that a scan opens your verification page on a domain they recognise, not a lookalike.

2. A cryptographic hash

At issue, each certificate is hashed. A hash is a short fingerprint calculated from the full contents of the document. The US standards body NIST describes hash digests as a way to detect whether messages have been changed since the digest was made. Change one digit of a CGPA and the fingerprint no longer matches, so the QR check fails.

3. Ledger anchoring

The hash needs a home that the issuer, the vendor or an insider cannot quietly rewrite. On Dygital.degree, each certificate is anchored on Hyperledger. In a Hyperledger Fabric ledger, each block's header includes a hash of the prior block's header, so changing an old entry breaks every entry after it. This helps with the Manav Bharti kind of problem: every genuine certificate has an anchored issue record, so a paper that was never issued through the process has nothing to match.

4. Revocation that shows as revoked

Paper cannot be recalled. If a degree is issued in error, or withdrawn after an inquiry, the registrar's office revokes it with a reason, at row, batch or programme level. Anyone who checks it afterwards sees it as revoked, so the copy sitting in someone's file stops passing. Every issue, signature and revocation is logged with who, what, when and from where.

5. Signatures uploaded once, stored securely and hashed

The Registrar, Controller of Examinations and Vice-Chancellor each upload their signature image once. It is stored securely, hashed, and printed only on the certificates they approve in the portal. No DSC or eSign token is needed. A stolen scan of a signature is worth little, because a certificate with no issued record behind it fails the check. Our security page sets out the wider controls, including encryption in transit and at rest.

Issuing in the NAD standard format

The National Academic Depository is the Ministry of Education's framework for digital storage, verification, authentication and issuance of academic awards, with UGC as its nodal agency. For an exam branch, the practical point is format. Dygital.degree takes your NAD or CSV result file as input and issues degrees, provisional certificates and marksheets in the NAD standard format, from your own templates, seals and signatories. Your result data stays in the structure your office already prepares.

From result file to issued batch in three to four hours

Speed depends on preparation, not software. Once the data is clean and the signatories are ready, a whole batch is issued in three to four hours. The steps are:

Upload the result file as CSV, Excel or a NAD file, or connect your exam system.
Map columns to the certificate fields.
Validate the rows, and fix names, roll numbers and grades that fail.
Design from a master template, with overrides for the year's seal or a new Vice-Chancellor.
Sign: the Registrar, Controller of Examinations and Vice-Chancellor approve the batch.
Issue: each certificate is hashed, anchored on Hyperledger and given its QR.

Each student is then notified by email and in ADi Wallet, and fetches the signed certificate for a fee shown before they pay. The certificate stays verifiable for as long as the university keeps it active. Most delays come from the first two conditions: duplicate roll numbers, name spellings that differ from admission records, or a signatory who is travelling. Fix those before convocation season, not during it.

Verification gets lighter too. Employer and agency requests, QR scans and bulk checks arrive in one portal. Digital certificates are checked directly against the record you issued. Old paper records still go to your verification cell, which confirms and signs online. You set your own verification fee. The page for universities and colleges shows the full flow.

What to look for when choosing a platform

Whichever platform you consider, ask these questions before the first upload:

Who issues? Your institution should upload, process and issue every certificate. A vendor should never issue on your behalf.
Is there a data processing agreement? Under Section 8(2) of the Digital Personal Data Protection Act, 2023, a data fiduciary may involve a data processor only under a valid contract, and Section 8(1) keeps the fiduciary responsible for processing done on its behalf. Ask for a signed agreement that sets out how your data is processed.
Do your signatories stay in control? Each signatory should approve their own batches, and signature images should be stored securely and hashed.
Is it tamper-evident, and can you show it? Ask the vendor to edit one field of an issued test certificate in front of you. The QR check should fail.
Can you revoke, and does revocation show? Check that a revoked certificate reads as revoked to the next verifier, and that the reason is logged.
Is the format standard? Certificates should be issued in the NAD standard format, so your records are not locked into one vendor's layout.
Are the timelines honest? "Hours" should come with conditions: clean data and ready signatories.

Dygital.degree was built around these questions for universities and colleges. Joining is free, with no maintenance cost. To see a batch issued and then tampered with, explore Dygital.degree or book a demo with your own sample data.

Fake degrees in India: how universities can issue tamper-evident certificates