The anatomy of a fake CoS: how fraudsters make them look real

Understanding how a fake Certificate of Sponsorship is constructed makes it far easier to spot one — and far easier to understand why so many victims are deceived. The forgeries are not crude. In many cases, they are technically impressive. Here is exactly how they are made, and exactly where they fail.

Step 1: Register a company on Companies House.

It costs £12 and takes twenty-four hours. Companies House is the UK's public register of incorporated businesses. Filing a new company requires only a name, a registered address, and a director's name — none of which are verified against real identity documents for standard incorporations. The resulting entry is entirely legitimate. The company has a real registration number. It appears in search results. It has a public filing history.

This is what fraudsters exploit. To a worker in Ghana or the Philippines, a company that appears on the official UK government business register looks real. Because, in a narrow legal sense, it is.

Step 2: Skip the UKVI sponsor licence entirely.

A UKVI sponsor licence is a completely separate process from Companies House registration. To obtain one, a company must demonstrate genuine trading activity, have a physical UK presence, appoint named responsible individuals, and pass an inspection by UK Visas and Immigration. The process takes weeks and requires substantial evidence.

Fraudsters do not apply. They simply register the company and proceed to the next step. The company will never appear on the Register of Licensed Sponsors — but the victim will not know to check that register.

Step 3: Forge the CoS document.

The Certificate of Sponsorship is a digital document, but it is typically shared as a PDF. Fraudsters use Canva, Adobe InDesign, or custom templates built from genuine CoS documents. They know the eleven-character reference format — one letter followed by ten digits is the approximate pattern, though the exact structure varies. They include a real SOC code for the role being offered, a salary figure that meets or exceeds the minimum threshold, and the company's real Companies House registration number.

To the untrained eye — or to a worker who has never seen a genuine CoS — these documents are convincing. The formatting is consistent. The data is internally coherent. The figures are plausible.

What they cannot fake.

Three things defeat the forgery, reliably, every time:

First, the UKVI Register of Licensed Sponsors is a live government database. A company that has never held a sponsor licence will simply not be listed. A company whose licence has been revoked will not be listed. There is no workaround.

Second, PDF metadata records the software used to create the document, the creation timestamp, and in some cases the editing history. Genuine UKVI CoS documents are generated by specific Home Office systems. A PDF created in Canva at 11pm on a Tuesday carries a different metadata signature.

Third, font consistency. Genuine UKVI documents use specific typefaces from the GDS (Government Design System) font stack. Forged documents frequently use substitutes — slightly different letterforms, different kerning, different weight profiles — that are detectable under visual forensic analysis.

SponsorShield checks all three of these automatically, in under sixty seconds, for free. The UKVI register check alone stops the vast majority of fraudulent CoS documents at the first stage.