How to verify a candidate's certifications: AWS, Microsoft, CompTIA, PMP, ISC2 and more

Verify a candidate's certification through the body that issued it, not from a PDF or a profile entry. As of October 2026, that means an AWS validation number checked at AWS's verification page, a Microsoft Learn transcript share link, a CompTIA verification code, a search of PMI's Certification Registry, ISC2's member verification by last name and member number, Salesforce's Trailhead verification search, and Credly badge links for issuers that use Credly. Ask the candidate for the code or link, confirm the name, status and expiry date, and then test the skills in the interview, because a valid credential does not prove who is on the call.

State-issued licenses, such as nursing or CPA licenses, are checked with licensing boards instead; that process is in professional license verification for recruiters. Degrees are covered in how to verify education credentials. This page is about vendor and professional-body certifications, which are checked through the issuers' own registries and badge platforms.

Why isn't the certificate PDF or profile badge enough?

• PDFs and screenshots can be edited. The issuer's verification page is the record; the PDF is a copy that points to it.
• Profile entries are typed by the candidate. A certification listed on a networking profile is a claim until the issuer confirms it.
• Badges are only as good as their link. Credly's help center says badges imported from outside Credly that do not follow the Open Badge standard cannot be validated and are marked "Unverified."
• Some badges stopped updating. Credly's Microsoft article says Microsoft certifications claimed on Credly before June 30, 2023 are no longer kept current there (Certiport-issued ones are the exception), so an old badge may not show a renewal or an expiry.
• Training is not certification. Course completions, learning badges and transcript modules are real achievements but not proof of a passed certification exam. Read the credential name on the issuer's page carefully.

How do you verify each certification?

The routes below are each issuer's own, as described on its site as of October 2026.

AWS

AWS lists two verification methods: the digital badge, and a 16-character alphanumeric validation number printed on the AWS Certified PDF certificate, which the holder finds under Achieved Certifications in their AWS Certification Account. Anyone the holder shares the number with can authenticate it at the public verification URL. On validity, AWS's recertification page says a renewal adds three years and a maintenance activity adds one year, and that a certification must be active to renew or maintain. Check the expiry date on the verification result, not only the name of the credential.

Microsoft

Microsoft's instructions point candidates to their Learn profile: the Transcript page shows completed certifications and modules, and "Share link" generates an online link the candidate can send to an employer. The Print option makes a PDF, which is weaker evidence than the live link. Microsoft's renewal page explains that Fundamentals certifications do not expire, while associate, expert and specialty certifications are extended one year at a time by passing a free online renewal assessment. A transcript that shows a role-based certification as expired is common and not suspicious in itself; it just means the credential is not current. Certifications earned through Certiport may still be managed in the candidate's Certiport account, which Microsoft says is fully acknowledged as official.

CompTIA

CompTIA's help center treats a PDF copy of an active certification as an official way to verify status. The PDF carries a verification code and a link to CompTIA's verification page; entering the code there shows the certification status and achievement date. A transcript or digital badge also works. CompTIA notes it can take up to five business days after an exam for the certification to appear in the candidate's account, which matters if someone tells you they passed last week.

PMI

PMI's registry finds both active and retired credential holders. The country or region field is required, and you can add first name, last name and a certification filter. PMI states that certification holders can opt out of the registry, so if the candidate is not listed, ask them for their certificate and certification number and contact PMI if you still need confirmation. PMP holders must earn 60 professional development units in each three-year cycle, according to PMI's maintenance page, so the registry status tells you whether the credential is current.

ISC2

ISC2 says employers and the public can confirm the membership status of any member or associate with the person's last name and ISC2 ID number. ISC2 also issues Credly badges, which it describes as one-click verification without looking up a member number. Note the difference between a certified member and an associate: ISC2's Associate of ISC2 page describes the designation as being for people who passed an ISC2 exam but lack the work experience required for the certification. An associate who passed the CISSP exam is not yet a CISSP.

Salesforce and Google Cloud

Salesforce's verification page asks for the full name as first name followed by last name and warns that any other variation will not return accurate results. Google Cloud certifications are issued as Credly badges; Google's Skills Directory, which shows the same data as the certificate including expiry date, only lists holders who have opted in, so ask for the badge link rather than searching.

What should you ask for, and when?

1. At the screen, ask which certifications the candidate holds, the name on each certification account, and the date earned. Note any that are "scheduled" or "in progress" as not held.
2. Before you submit or advance them, ask for the verification route from the table: code, member number, transcript link or badge link.
3. Check on the issuer's site yourself. Do not rely on a link that lands on a look-alike page; type the issuer's address or use the link on the issuer's own site.
4. Record the result: credential, status, expiry, how and when you checked, and who checked.

Hi [name], before I send your profile to [client], I verify
certifications with the issuers. Could you send:
- AWS: the validation number on your certificate PDF
- [Other cert]: your [verification code / transcript share link]
I'll only use them to confirm the credential and its expiry date.

If you hire a background screening company to do this, its report is a consumer report: the FCRA's disclosure, written authorization and adverse action steps apply. See the FCRA background check process for recruiters.

Which red flags deserve a second look?

• No verification route offered after a reasonable request, only a PDF or screenshot.
• A name mismatch without an explanation. Marriage, transliteration and middle names are common reasons; ask before concluding anything.
• A verification link on an unfamiliar domain, or a badge page that does not belong to the issuer's platform.
• Training listed as certification, such as course badges or learning modules presented as passed exams.
• Expiry dates that don't fit the story, such as an expired credential described as current.

A missing PMI registry entry, an expired Microsoft role-based certification or a recent exam that has not yet posted is not, on its own, a red flag. Ask, and accept another proof where the issuer allows one.

Does a verified certification prove the candidate is the holder?

No. It proves the credential exists in a name, with a status and dates. You should still run your normal identity step for remote candidates (the candidate identity verification checklist covers how) and ask questions that only someone with the skill can answer. For cloud roles, cloud engineer screening questions includes probes that test what an AWS or Azure certification claims; for project managers, see project manager phone screen questions.

What should agencies write in the submittal?

One line per credential, so the client can see what you checked: "AWS Certified Solutions Architect, Associate: verified on aws.amazon.com/verification on [date], active, expires [date]." Do not attach verification codes or member numbers to submittals; they are the candidate's to share, and the client can ask for its own check.