Fake CoS documents have become technically sophisticated.. Here is exactly how they are built — and exactly where they always fail.
The anatomy of a fake CoS: how fraudsters make them look real
Understanding how a fake Certificate of Sponsorship is constructed makes it far easier to spot one — and far easier to understand why so many victims are deceived. The forgeries are not crude. In many cases, they are technically impressive. Here is exactly how they are made, and exactly where they fail.
Step 1: Register a company on Companies House.
It costs £12 and takes twenty-four hours. Companies House is the UK's public register of incorporated businesses. Filing a new company requires only a name, a registered address, and a director's name — none of which are verified against real identity documents for standard incorporations. The resulting entry is entirely legitimate. The company has a real registration number. It appears in search results. It has a public filing history.
This is what fraudsters exploit. To a worker in Ghana or the Philippines, a company that appears on the official UK government business register looks real. Because, in a narrow legal sense, it is.
Step 2: Skip the UKVI sponsor licence entirely.
A UKVI sponsor licence is a completely separate process from Companies House registration. To obtain one, a company must demonstrate genuine trading activity, have a physical UK presence, appoint named responsible individuals, and pass an inspection by UK Visas and Immigration. The process takes weeks and requires substantial evidence. Fraudsters do not apply. They simply register the company and proceed.
Step 3: Forge the CoS document.
The Certificate of Sponsorship is typically shared as a PDF. Fraudsters use Canva, Adobe InDesign, or custom templates built from genuine CoS documents. They know the eleven-character reference format. They include a real SOC code for the role being offered, a salary figure that meets or exceeds the minimum threshold, and the company's real Companies House registration number.
What they cannot fake.
Three things defeat the forgery, reliably, every time:
First, the UKVI Register of Licensed Sponsors is a live government database. A company that has never held a sponsor licence will simply not be listed. There is no workaround.
Second, PDF metadata records the software used to create the document, the creation timestamp, and in some cases the editing history. Genuine UKVI CoS documents are generated by specific Home Office systems. A PDF created in Canva at 11pm on a Tuesday carries a different metadata signature.
Third, font consistency. Genuine UKVI documents use specific typefaces from the Government Design System font stack. Forged documents frequently use substitutes — slightly different letterforms, different kerning, different weight profiles — that are detectable under forensic analysis.
| What fraudsters CAN fake | What they CANNOT fake |
|---|---|
| Companies House registration | UKVI sponsor register entry |
| CoS reference format (11 chars) | Actual UKVI database record |
| SOC code and salary figures | PDF metadata and creation software |
| NHS / care company branding | Government typeface consistency |
| Director names and addresses | Active licence status |
SponsorShield checks all three of these automatically, in under sixty seconds, for free. The UKVI register check alone stops the vast majority of fraudulent CoS documents at the first stage.
Some fake CoS documents pass basic surface checks — correct reference format, real-looking employer name. SponsorShield's CoreFlux™ Engine checks the signals that matter: UKVI register status, salary threshold compliance, and PDF metadata forensics that fraudsters cannot fake.
Not sure if your CoS is real?
25+ fraud signals checked automatically — free.
Run a free check now.
Upload your CoS and get a full fraud-risk report in under 60 seconds.