Checking a Digital Credential: What Verification Proves

For recruiters, admissions officers and anyone who receives credentials.

This course is for people who receive digital credentials and have to decide what to do with them. That includes HR and talent acquisition teams, quality, registry and admissions staff, and staff at professional bodies and sector associations. You do not need any prior knowledge. You will practise on realistic cases, using a standard verifier, and you will finish with a lab in which you verify five sample credentials and record a decision with reasons for each.

A digital credential can pass every technical check and still leave important questions open. This course shows you what a verification result proves, what it leaves open, and how to ask for the right amount of extra evidence without slowing down every application.

Learning outcomes. After this course you can:

1. Verify a digital credential with a standard verifier and read the result correctly.
2. Separate what verification proves (integrity, issuer, status) from what it does not prove (quality of assessment, current competence, identity of the presenter).
3. Check issuer credibility using registries, quality labels and accreditation status.
4. Decide what further evidence to request in proportion to the stakes.

Workload. About 2 hours of self-paced study, including the lab. This course covers the self-paced part. Facilitator notes in each module describe optional live or workshop elements.

Assessment. You complete a lab: you verify five sample credentials (valid, expired, revoked, tampered, and valid but from an unknown issuer) and record a decision with reasons. A person assesses your log using the rubric in "Assessment and badge". The file also contains a short knowledge check. Nothing in this file grades your lab.

Badge. "Checking a Digital Credential: What Verification Proves (Ability, L1)", alignment code ICSF-STND-L1-A. The badge evidence is your completed verification log with decisions. A badge shows that you completed the tasks and met the rubric in a controlled setting. It does not prove competence in any specific job.

Framework alignment. ICoBC Credentialing Skills Framework (ICSF), skill STND "Standards and interoperability" (VRITE pillar: Trustworthiness), level L1 "Contribute", stage A "Ability".

A note on status. Some topics in this course are still developing, in particular wallets under the European digital identity framework. Status as of November 2026; check before publishing.

Why verifiers matter

The problem a verifier solves

Before digital credentials, a certificate was a piece of paper or a PDF. Anyone with a scanner and a little skill could change a name or a grade. Receivers had two options: trust the document or phone the issuer. Phoning scales badly. A recruiter who receives 300 applications for one post cannot call 300 institutions.

A digital credential built on an open standard carries its proof with it. The issuer signs the data cryptographically. A verifier, which is a tool that reads the credential and checks the signature, can then answer three questions in seconds:

• Integrity: has the data changed since the issuer signed it?
• Issuer: which organisation signed it, and can the signing key be linked to that organisation?
• Status: is the credential still in force, or has it expired or been revoked?

These three checks are the core of what verification proves. Everything else you want to know about a credential needs another source.

Open standards and portability

Several open specifications describe how credentials are structured and secured. Open Badges 3.0 and Comprehensive Learner Record (CLR) 2.0 are current specifications for badges and richer learner records. They build on the W3C Verifiable Credentials Data Model 2.0, which has been a W3C Recommendation since 2025. Related specifications for status lists and for securing mechanisms continue to evolve, so tools may differ in which versions they support.

For a receiver, the value of open standards is portability. A credential issued by one organisation can be checked by a verifier built by a different organisation, because both follow the same published rules. The earner can also keep the credential in a wallet of their choice and share it with any receiver.

Platform support is still uneven. Some tools handle only part of a specification. When you choose a verifier, look for evidence of conformance certification from the standard's owner or a recognised test programme, and do not rely on a tool's own claim of "compatibility".

Where this fits in the bigger picture

Verification is one step in a chain of trust. The chain runs from the learning and assessment, through the issuer's decision to award, to the signed credential, to the earner who presents it, to you. A verifier tests only the middle links. The links before and after need other kinds of checks, and later modules cover them.

Graphic: what a verifier checks along the chain of trust

Credentials from agents and auto-filled forms

Some applications are now filled in by software, including AI assistants acting for the applicant. Such a tool may attach a credential file on the applicant's behalf. A verifier can confirm that the file is intact and issued by a particular organisation. It cannot tell you whether the person or agent presenting the file is the person the credential was issued to. The link between a credential and the person presenting it is called holder binding. Module 3 explains it and module 5 shows how to respond to it.

Worked example: a bulk shortlisting task in a corporate academy

Amara works in the HR department of a logistics company that runs its own corporate academy. For an internal move into a team-lead programme, 40 staff have attached badges from the academy's leadership course. Before the audit, Amara opened each PDF and checked that it "looked right". She now runs each badge through a standard verifier instead. In 10 minutes (illustrative) she can state three things for each badge: the data is unchanged, the signing organisation is the academy, and the badge has not been revoked. She notes that she has not yet checked how the course was assessed. That is a separate question, covered in module 4.

Practice activity: sort the questions

Below are six questions a receiver might ask. Decide which a verifier can answer and which need another source. Write your sorting in your own notes, then open the answer.

1. Has the credential data been altered since issue?
2. Did the course include a proctored exam?
3. Which organisation signed the credential?
4. Is the person on the screen the person named in the credential?
5. Has the credential been revoked?
6. Can this person still do the task today?

Quiz: Why verifiers matter

Running a verification

What you need

You need three things to run a verification: the credential itself, a standard verifier, and a clear idea of what you want to learn. The credential may arrive as a file, a link, a QR code or a share from a wallet. A standard verifier is a tool that follows the open specifications and reports its results in a structured way.

When you choose a verifier, check these points:

• It states which specifications and versions it supports.
• It shows evidence of conformance certification or published test results.
• It shows the individual checks it ran, not just one green or red sign.
• It does not require you to upload the credential to a service you do not know. If the credential contains personal data, you need a lawful basis to process it, so follow your organisation's data protection policy.

The steps

Follow the same steps for each credential. A fixed routine protects you from skipping a check when you are busy.

1. Receive the credential through a trusted route. Prefer a link or share action from the earner's wallet or the issuer's platform over a screenshot. A screenshot cannot be verified.
2. Open it in the verifier. Load the file, paste the link or scan the code.
3. Wait for all checks to finish. Some verifiers fetch the issuer's public key and the status information from the internet. If the verifier cannot reach these, it may show a partial result.
4. Read the individual results. Look at integrity, issuer and status separately.
5. Record the result. Write down the date and time, the verifier you used, and each result. A result can change later, for example if the credential is revoked.

Common routes into the verifier

Credentials reach you in different forms. A badge image may carry the data inside the image file. A JSON file holds the data directly. A web link points to a page where the issuer or a platform hosts the credential. A QR code often encodes such a link. A wallet share sends the credential directly from the earner's wallet to your tool. If you only have a plain image or a PDF printout with no embedded data, a verifier has nothing to check, and you should ask for the original file or link.

Graphic: the five steps of a verification

Worked example: admissions check at a college

Tomasz is a registry officer at a vocational college. An applicant for a part-time course submits a digital badge from a short programming course as evidence of prior learning. Tomasz asks the applicant to share the badge through a link rather than a screenshot. He opens the link in his team's standard verifier. The verifier shows three separate checks: the data is intact, the signature is linked to a named issuer, and the status is "active". Tomasz writes in the admissions record: date, verifier name and version, and the three results. He has not yet looked at who the issuer is or how the course was assessed. He marks those as open items.

Practice activity: pick the better route

For each of these four situations, decide whether the receiver should ask for a different form of the credential before verifying. Then check your reasoning.

1. An applicant pastes a screenshot of a badge into an online form.
2. An applicant sends a link from their wallet's share function.
3. A candidate sends a PDF printout of a certificate with no link or QR code.
4. A university sends a QR code that opens a hosted credential page.

Quiz: Running a verification

Reading the result

The main outcomes

A verifier typically reports one of a small number of outcomes. The wording differs between tools, so learn the meaning rather than the label.

Expired does not always mean the earner lacks the skill. Some credentials are time-limited by design, for example a safety certificate with a renewal cycle. An expired credential tells you that the issuer no longer vouches for it. Revoked is different: the issuer has withdrawn its statement, sometimes because of error or misconduct. Tampered means that something in the data changed after signing, which can come from a deliberate change or from a corrupted file. Either way you cannot rely on it.

What "valid" proves and does not prove

A "valid" result proves three things: the data has not changed, a specific key signed it, and the issuer has not revoked it. A signature shows that a key holder signed this data. Whether that key belongs to a trustworthy organisation is a question for the issuer check in module 4.

A valid result does not prove:

• Quality of assessment. The credential may reward attendance, a quiz or a rigorous practical exam. The signature looks the same in all cases. A 2026 symposium discussion made this point clearly: a valid signature does not certify assessment quality.
• Current competence. Skills fade and fields change. A credential records a past decision.
• Identity of the presenter. The file can be passed to someone else, or presented by software acting for the applicant.

Graphic: proves and does not prove

Holder binding

Holder binding links a credential to the person or agent presenting it. Some credential formats and wallets support a proof from the holder, for example the holder's wallet signs a fresh request from the verifier to show control of a key. If your verifier supports such a presentation check, a pass means the presenter controls the key the credential was issued to. It still does not prove that the person at the keyboard is a particular human being, because the key can sit in an app that software drives.

Without holder binding, a file can be copied and presented by anyone. This matters most when applications are auto-filled or when an AI agent submits on someone's behalf. In such cases, treat the credential as a claim about the earner and look for a separate way to link the presenter to the earner when the stakes call for it. Module 5 covers when and how.

The European digital identity framework is relevant here. Member States must offer at least one EUDI Wallet by 24 December 2026. Germany plans its state wallet ("d-you") for 2 January 2027, with basic functions first. Regulated private sectors must accept the wallet about one year after issuance starts. Readiness varies widely between Member States. This is an emerging area, so do not assume that applicants or institutions can use a wallet today. Status as of November 2026; check before publishing.

Worked example: a revoked badge at a corporate academy

Priya works in talent acquisition at a manufacturing firm. A candidate for a quality technician role attaches a "Lean Practitioner" badge. Priya runs it through the verifier. The result is: integrity intact, issuer recognised, status revoked. She does not reject the candidate at once. She writes in her notes: "Badge revoked by the issuer; reason unknown." She asks the candidate to explain and to supply any replacement credential. The candidate replies that the badge was reissued after a name correction and sends the new link. Priya verifies the new one: all three checks pass. Her note records both results.

Practice activity: read five results

Read these five short result summaries. For each, write in one line what you can state and what you cannot state. Then compare with the answer.

A. Integrity intact, issuer recognised, status active.
B. Integrity failed.
C. Integrity intact, issuer not recognised, status active.
D. Integrity intact, issuer recognised, status expired on 1 March 2026.
E. Integrity intact, issuer recognised, status revoked.

Quiz: Reading the result

Beyond the signature: issuer and assessment quality

Who is the issuer?

A signature proves that a key signed the data. It does not prove that the organisation behind the key is trustworthy. Anyone can create a key and sign a credential with an impressive name. The issuer check asks: is this organisation real, is it who it claims to be, and is it a credible source for this kind of credential?

Useful sources for an issuer check:

• Registries. Public registers of education providers, awarding organisations or professional bodies. Many countries and regions keep official lists. Check the register directly, not a link supplied by the earner.
• Accreditation and recognition status. For regulated qualifications, the competent public body or accrediting organisation publishes who is recognised. Check the status and the scope: an accredited provider may be accredited for some programmes only.
• Quality labels and quality assurance outcomes. Some sectors use quality labels or external review reports. Check who awards the label, whether the label is current, and whether it covers the credential in question.
• The issuer's own information. A credible issuer publishes who it is, how to contact it, and how its credentials are assessed and revoked.

An issuer's absence from a registry does not prove bad faith. A corporate academy or a small training provider may not appear in a national register because none applies to it. In that case, you rely on other signals and on your own proportionate checks, which module 5 covers.

How good was the assessment?

The second question is about what the credential stands for. Two credentials with the same title can reflect very different effort. Ask:

• What was assessed? Knowledge recall, applied tasks, workplace performance?
• How was it assessed? Self-declared, automated quiz, assessor judgement, supervised exam?
• By whom? Who made the award decision, and were they independent of the teaching?
• Against what? Published criteria, a framework level, an occupational standard?
• Is there a rule for the award? Pass mark, retake policy, evidence retention.

Open Badges 3.0 and CLR 2.0 allow issuers to include criteria, evidence and alignment to frameworks in the credential data. Look for these fields. A credential with clear criteria and an alignment statement gives you more to work with than one with only a title and an image. Fields can be filled in with marketing language, so read them critically and compare the stated criteria with the issuer's public description.

This is the point of the 2026 symposium remark: a valid signature does not certify assessment quality. The signature says nothing about how hard or easy the award was. Assessment quality needs its own evidence.

Graphic: two separate questions after a valid result

Putting the checks together

You do not need to run every check for every credential. Match the effort to the stakes, which module 5 covers. For now, practise the checks themselves. A short issuer check typically takes a few minutes: find the issuer's name in the credential, search the relevant register or accreditation list through its official site, and note whether the issuer appears, with what status and scope. A short assessment check asks you to read the criteria in the credential and the issuer's public description, and to note any gaps.

Worked example: an unknown issuer at a university

Sofia is an admissions officer at a university. An applicant for a master's programme submits a digital badge titled "Advanced Data Analysis". The verifier shows: integrity intact, status active, signature valid, issuer name "Northfield Learning Hub" with no match in the verifier's list of known issuers. Sofia searches the national register of recognised providers through the official site and finds no entry. She then opens the issuer's own website and finds a short description, a contact address and no information on assessment. She records: "Valid signature; issuer not found in the register; assessment method unknown." She does not call the badge fake. She writes to the applicant to ask for the course syllabus, the assessment description and a transcript or work sample, and she sets the badge aside as supporting evidence only, pending a reply.

Practice activity: draft an issuer and assessment check

You are a recruiter and receive a valid badge titled "Project Management Professional Skills" from an issuer called "Brightpath Academy", which is not in your verifier's list. Write four short questions you would put to the issuer's public information or to the earner, two about the issuer and two about the assessment. Compare with the sample answer.

Quiz: Beyond the signature

Decisions proportionate to the stakes

Matching effort to the stakes

Every decision has a cost of being wrong and a cost of checking. Shortlisting someone for a first interview carries low risk, because the later steps catch errors. Awarding a place on a regulated programme, or hiring for a safety-critical or financial post, carries high risk. The further evidence you request should match the stakes. Too little leaves you exposed. Too much slows everyone and can exclude honest applicants who lack easy access to documents.

A simple way to think about stakes uses three questions:

1. What happens if this credential is false or overstated? Consider harm to people, legal exposure and cost.
2. How much does this credential weigh in the decision? A supporting detail needs less checking than the sole evidence for a requirement.
3. Can the later steps catch an error? A later practical test, probation or supervised work reduces the risk.

A decision path

After the verification, use a decision path. The graphic below shows one version. You may adapt it to your organisation's policy, as long as you record the reasons.

• Integrity failed (tampered): reject the credential as evidence. Where there is reason to suspect deliberate falsification, follow your organisation's procedure for reporting concerns.
• Revoked: do not rely on it. Ask for an explanation and for replacement evidence.
• Expired: ask whether a renewal exists; decide whether the expiry matters for the requirement.
• Valid, known issuer, low stakes: accept as supporting evidence and record the checks.
• Valid, unknown issuer or unclear assessment, low stakes: accept with a note, or ask for a brief description of the assessment.
• Valid, medium or high stakes: run the issuer and assessment checks, and ask for further evidence such as a work sample, a transcript, an interview or a practical task.
• High stakes or auto-filled application: add a presenter check, for example a live check against an identity document or a holder-bound presentation from a wallet, in line with your data protection rules and policy.

What further evidence can you ask for?

Choose evidence that fits what the credential claims. For a skill, a short practical task or a work sample shows current performance. For a qualification, an official transcript from the awarding organisation or a confirmation from its registry service helps. For identity, use a lawful identity check suited to your setting. For current competence, ask for recent work, a reference or a live demonstration. Explain why you ask, keep requests consistent across applicants, and offer a reasonable alternative where an applicant cannot provide the first form of evidence.

Handling auto-filled and agent-submitted applications

When an application arrives through a form-filling tool or an AI agent, you cannot assume the applicant has seen or approved each attachment. A valid credential in such an application is still only a claim until it is linked to the person. Reasonable responses include asking the applicant to confirm and present the credential directly at a later step, using a holder-bound presentation where your tools support it, and recording that the presenter was not yet bound to the credential. Do this fairly: applicants may legitimately use assistive tools, so treat the tool as a channel and not as a sign of bad faith.

Graphic: decision path after verification

Worked example: proportionate evidence in a corporate academy and a college

Corporate academy. Lena in an HR department reviews internal applications for a trainer role. A candidate presents a valid badge from an external facilitation course. The issuer is not in any register. The stakes are medium: the trainer will teach new starters but works under a lead trainer for six months. Lena accepts the badge as supporting evidence, asks for a 10-minute teach-back demonstration, and records: "Valid, issuer unlisted, assessment unknown; proportionate step: demonstration."

College. Marcus, a registry officer at a training provider, receives a valid certificate from a recognised awarding body for a prerequisite unit. The issuer is in the national register and the unit is within its accredited scope. The stakes are low because the course includes an early skills check. Marcus accepts, records the register check, and takes no further steps. If the applicant had applied for a licensed practice route, he would also ask for a transcript from the awarding body and a live identity check.

Practice activity: choose the proportionate step

For each case, choose accept, ask for more or reject, and name the further evidence if any. Then compare with the answer.

1. A valid, recognised-issuer badge supports a CV line for a junior marketing role. Stakes: low.
2. A valid badge from an unknown issuer is the only evidence of a safety qualification for a site supervisor post. Stakes: high.
3. A badge is reported as tampered by the verifier.
4. A valid badge arrives in an auto-filled application for a role with access to client funds.

Quiz: Decisions proportionate to the stakes

Assessment and badge

The lab

You now complete the assessed task. It is a controlled lab: you work with sample credentials provided by your course facilitator or training provider, in a sandbox, so no real person's data is involved.

Task. Verify five sample credentials with a standard verifier and record a decision with reasons for each:

1. A valid credential from a known issuer.
2. An expired credential.
3. A revoked credential.
4. A tampered credential.
5. A valid credential from an unknown issuer.

For each credential, complete one row of the verification log with these fields:

• Credential reference and date and time of the check.
• Verifier used (name and version).
• Result for integrity, issuer and status, as shown by the verifier.
• What the result proves, in one or two sentences.
• What the result does not prove, in one or two sentences.
• Issuer check: sources consulted and finding (required for credential 5, and for credential 1 where the issuer is not obvious).
• Stakes level you assume for the scenario you have been given (low, medium or high).
• Decision: accept, ask for more, or reject.
• Reasons for the decision.
• Further evidence requested, if any, and why it fits the stakes.
• Note on presenter binding: whether the presenter is linked to the credential and what you would do if not.

Write in your own words. Use the sample scenario sheet from your facilitator to set the stakes.

Rubric

The assessor rates each criterion as Not yet, Meets or Strong.

Pass rule

To earn the badge, the learner must:

• complete all five rows of the verification log with all required fields;
• reach Meets or Strong on all seven criteria (no criterion at Not yet);
• complete the knowledge check below (the module quizzes are for practice and are not scored for the badge).

A learner with any criterion at Not yet receives written feedback and may resubmit the affected rows. The assessor makes the final decision, not this file.

Evidence submitted for the badge

• The completed verification log with decisions (all five rows).
• The assessor's rubric record, held by the awarding organisation.
• The date of completion of the knowledge check.

The badge "Checking a Digital Credential: What Verification Proves (Ability, L1)" carries the alignment code ICSF-STND-L1-A. It records that you completed the tasks and met the rubric in a controlled setting. It does not prove competence in a specific job.

Final knowledge check

Answer all ten questions. Each has four options and one correct answer.

Sources and further reading

Status as of November 2026; check before publishing.

• 1EdTech Consortium: Open Badges 3.0 specification and Comprehensive Learner Record (CLR) Standard 2.0 specification, published on the 1EdTech website (1edtech.org). Check the website for the current version and the conformance certification programme.
• World Wide Web Consortium (W3C): Verifiable Credentials Data Model v2.0, W3C Recommendation, published on the W3C website (w3.org/TR). Check the same site for related specifications on securing mechanisms and status lists, which continue to evolve.
• European Union: Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (eIDAS 2.0), published in the Official Journal of the European Union and available through EUR-Lex (eur-lex.europa.eu).
• European Commission: pages on the European Digital Identity Wallet, published on the European Commission website. Check the current implementation status for your Member State, including the German state wallet plan.
• ICoBC: Credentialing Skills Framework (ICSF) and VRITE pillars, published by the International Council on Badges and Credentials (icobc.net). Check the ICoBC website for the current framework text.

Time-sensitive facts in this course. The dates for the EUDI Wallet (24 December 2026 for Member State offers, 2 January 2027 for the planned German wallet, and acceptance by regulated private sectors about one year after issuance starts) and the state of tool and platform support for Open Badges 3.0, CLR 2.0 and related W3C specifications can change. Status as of November 2026; check before publishing.