Fake sick notes: lessons from the fight against ad fraud

A sick note is one of the most trusted documents in working life, and one of the least checked. An employer gets a PDF or a slip of paper, sees a clinic name and a signature, and files it. Usually nobody asks whether that clinic really issued it.

That gap has a price, and the people who exploit it are well organised. Digital advertising faced a very similar problem a decade ago: buyers paid for ad space without being able to tell whether the seller had any right to sell it. The fixes the ad industry built are a useful template for medical documents.

A market that never really closed

In April 2024 The Telegraph reported that fake UK sick notes were on sale online for as little as £25. One site offered free home delivery, and emailed copies within hours, while describing its products as being for educational or entertainment use only. An older seller that stopped trading fake notes in 2017 still had a website offering tips on filling one in.

The same report quoted the Medical Defence Union: forging a doctor's signature has become easier with online editing software, and a GP usually only learns about a fake note when an employer raises it. In other words, the issuer is rarely in the loop.

The cases that do reach court show how long a forgery can go unnoticed. In March 2026 a former communications officer at London's Metropolitan Police admitted fraud by misrepresentation after handing in forged sick notes between November 2022 and May 2024, covering around 200 days of absence and costing about £19,000.

Germany shows a different variant: a real certificate with nothing real behind it. In a ruling of 5 September 2025 (14 SLa 145/25), the Hamm Regional Labour Court upheld the dismissal without notice of an employee who had bought an online sick certificate based only on a questionnaire, with no contact with a doctor. The provider also sold a pricier version with a consultation. The court overturned the first-instance decision of the Dortmund Labour Court.

And in a case reported in October 2026, the Dubai Criminal Courtconvicted a clinic clerk and accomplices for using the clinic's own electronic health portal to create backdated sick-leave certificates and sell them for several hundred to more than 1,000 dirhams each. The documents carried the clinic's genuine digital stamp. What exposed the scheme was a company's HR team noticing an unusual pattern of sudden, repeated sick leave tied to that one clinic.

Why paper and PDF certificates are easy to fake

A traditional certificate proves almost nothing on its own. A letterhead, a stamp and a signature are all images, and images can be copied. A PDF adds convenience but not proof: unless it carries a signature the recipient can check, it is just a picture of a document.

The person checking it also has poor options. Calling the clinic is slow, often blocked by confidentiality, and impossible at scale. So most employers, schools and insurers accept certificates on trust, and fraudsters price their products with that in mind.

What ad tech learned about authorised sellers

Programmatic advertising had the same weakness. Buyers bid on impressions that claimed to come from premium news sites, but some of that inventory was counterfeit or resold by companies the publisher had never heard of. Fraudsters disguised cheap or fake traffic as a well-known domain, a trick known as domain spoofing.

The industry's answer was not a better way to look at an ad. It was a public record kept by the source. In June 2017 the IAB Tech Lab released ads.txt, short for Authorized Digital Sellers: a file in which publishers declare which companies may sell their inventory. In July 2019 the Tech Lab finalised sellers.json and the SupplyChain object, which let buyers see who the sellers behind an ID are and every party that handled a given bid request.

For a readable overview of how these checks fit together with bot detection and campaign data, AffHouse, a trade publication on affiliate and performance marketing, has a practical guide to ad fraud. It separates pre-bid checks, such as ads.txt and sellers.json, from post-bid analysis of repeat visits, timing and conversion quality, and it treats detection software as one source of evidence rather than a guarantee. That layered view carries over well to medical documents.

Three lessons that transfer to medical certificates

• Verify at the source. Ads.txt works because the publisher, not the reseller, states who is authorised. For certificates, the equivalent is a public way to confirm that a clinic or doctor is a real, registered issuer, and that a specific certificate came from them.
• Sign the data, not the paper. A cryptographic signature binds a certificate to its issuer and shows whether anything was changed after issue. A copied stamp cannot do that; a signature check can.
• Keep watching after the check. Ad buyers still review traffic patterns after the bid, and the Dubai case was caught the same way: by spotting an odd pattern. A valid signature proves who issued a certificate, not that the issuer behaved honestly, so issuers also need access controls and audit trails.

There is now a mature open standard for the first two points. The W3C Verifiable Credentials Data Model 2.0 became a W3C Recommendation on 15 May 2025. It describes three roles, issuer, holder and verifier, and notes that digital signatures can make credentials more tamper-evident and trustworthy than their physical counterparts. A clinic issues the credential, the patient holds it, and the employer verifies it without phoning anyone.

Check the answer, not the diagnosis

Medical documents add one constraint that ad tech never had: the content is sensitive health data. An employer usually needs to know only whether a certificate is genuine and which dates it covers. It does not need the diagnosis.

The W3C standard builds this in. Its privacy section encourages issuers to favour abstract claims, using the example of an "age over" property instead of a full birth date, and it describes data minimisation, noting that rules such as HIPAA in the United States and the GDPR in the European Union require it. For a sick note, that means a verifier gets a yes or no on authenticity and validity, while the clinical details stay between patient and clinician.

The same thinking sits behind MediCert: doctors and institutions are verified before they can issue certificates, each certificate is anchored on a blockchain, and only essential data such as a metadata hash is stored. Our security and compliance page has the details.

Where to start

Clinics do not need to rebuild their systems overnight. A sensible first step is to make every certificate checkable: give it a unique identifier, sign it, and offer a simple verification route that confirms only validity. Lock down who inside the clinic can issue certificates, and log every issue.

HR and compliance teams can ask suppliers and occupational health partners whether their certificates can be verified at the source, and treat unverifiable PDFs as a risk to review rather than proof. The ad industry learned that trust only scales when it can be checked. Medical certificates are overdue for the same upgrade.