Diploma mills and fake certification bodies: the Axact case, and how to check a credential is real

What is a diploma mill?

The US Federal Trade Commission's consumer page on college degree scams (May 2021) describes the signs: programs that require no studying, exams or contact with professors, degrees awarded for "experience", degrees offered fast, and pushy advertising. It adds that some fake programs make up an accreditor, or lie about being accredited by a real one.

The second half of that definition matters more than the first. Anyone can print a diploma. What makes a mill work is a second layer of paper that makes the first look checked: an accreditation certificate, a seal, a letter from an official-sounding council. The same trick works for professional certificates and safety cards, where the fake is a card from a trainer or a body that never trained you.

How Axact worked, step by step

Axact is the case to know, because its methods are written down in a US criminal complaint and in two later court filings. On 21 December 2016 the US Attorney for the Southern District of New York announced charges against Umair Hamid, who used the aliases "Shah Khan" and "the Shah". Charges are allegations, and the release said so. Here is the scheme as prosecutors described it.

1. The schools. Axact "promoted and claimed to have an affiliation with approximately 350 fictitious high schools and universities", advertised online as genuine schools. Reports at the time named some of them: "Barkley" and "Columbiana", names chosen to sound like famous American universities, according to the Guardian (27 May 2015).
2. The phone line. During some periods since 2014, Axact took about 5,000 calls a day from people wanting to buy or enrol. Some callers appeared to believe they were phoning the school itself. When asked where a school was, sales staff were told to give fictitious addresses.
3. The upfront fee. Buyers paid, believing they would get real courses and a legitimate degree. Prosecutors said they received no legitimate instruction and "fake and worthless diplomas".
4. The upsell. After a sale, agents were trained to sell extra "accreditation" or "certifications" to make the diploma look more legitimate. Diplomas were fitted with fake stamps said to carry the seal and signature of the US Secretary of State and of state officials.
5. The money trail. Hamid and a co-conspirator opened US bank accounts in the names of shell entities, moved the money on to accounts in the US, the United Arab Emirates and Canada, and ran a payment account to collect consumer funds.

The complaint put the total at "at least approximately $140 million from tens of thousands of consumers". Hamid's role, according to the later sentencing release, included acting as Axact's main contact when it bought websites for fake schools from a former competitor. Those sites then kept taking enrolment fees under Axact's control.

Step 4 is where buyers get hurt twice. The accreditation certificate and the government seal cost extra, and they are the parts that turn a novelty print into a document that someone may later treat as a fraud.

How the Axact cases ended in New York and in Pakistan

The two countries reached very different results, and both are on the record.

In the United States. Hamid was arrested on 19 December 2016 and charged with wire fraud, conspiracy to commit wire fraud and aggravated identity theft. On 6 April 2017 he pleaded guilty to one count of conspiracy to commit wire fraud. The plea release said the scheme "collected tens of millions of dollars from thousands of customers", and that after Pakistani police closed Axact in May 2015, Hamid resumed selling fake diplomas to US buyers and travelled to the US in 2016 to open a bank account for the money. On 28 August 2017 Judge Ronnie Abrams sentenced him to 21 months in prison and ordered him to forfeit $5,303,020. The Acting US Attorney, Joon H. Kim, said: "Defendants like Hamid who profit from fake schools face very real penalties, including prison time."

In Pakistan. The Federal Investigation Agency raided Axact's Karachi offices in May 2015, days after a New York Times investigation. The agency's provincial director told reporters: "We have seized hundreds of thousands of fake degrees" (Guardian, 27 May 2015). Chief executive Shoaib Shaikh was detained. On 5 July 2018 a sessions court in Islamabad convicted Shaikh and 22 others; Dawn reported that the sentences ran concurrently, so the longest time any of them faced in jail was seven years, with a fine of Rs1.3 million each.

That was not the end. University World News reported on 5 May 2024 that the Sindh High Court acquitted Shaikh and other directors on 10 March 2023, and that the Islamabad High Court acquitted all the accused on 29 November 2023. In January 2024, lawyers for Axact and Shaikh told The Independent that he had been acquitted by both High Courts and that no cases were pending against him.

Axact's side. From the start, Axact denied running a degree scam. In May 2015 its website said: "All 10 business units of Axact are completely legitimate, legal and committed to enhancing the quality of IT services across the world" (BBC, 27 May 2015). The Guardian reported that the company called the case a conspiracy by rival media groups. Hamid's US guilty plea stands, and so does the forfeiture.

Case file: two more mills that ended up in court

In November 2009 a group of buyers filed a class action in the US District Court for the Eastern District of Michigan (case 2:09-cv-14345). The complaint quoted Belford's own website: Belford "[i]s the only fully accredited high school providing high school diplomas based upon your life experience or online equivalency test", and Belford University "proudly offers its life experience degrees to Belford High School graduates". It said the two accreditors Belford named, the International Accreditation Agency for Online Universities and the Universal Council for Online Education Accreditation, were "either utterly fictitious entities or are active participants in this fraud", and that their certificates for the high school and the university were identical apart from a name swap. One plaintiff, the complaint alleged, was charged about $250 after an online test.

Belford answered through its managing coordinator, who said in a sworn declaration filed in August 2010 that he lived in Pakistan, that Belford was located in Panama, and that only about 10% of its students lived in the United States. In August 2012 the court entered a default judgment for $22,783,500 against defendants including Belford High School and both accreditors, according to Truth in Advertising's case summary. A background screening firm, Scherzer International, reported that the class covered more than 30,000 US residents and that the court ordered the Belford websites forfeited. A settlement giving class members an award based on what they had paid won final approval in July 2017.

In Spokane, Washington, federal indictments returned in 2005 said a family operation had sold fake high school and college degrees to more than 9,000 people in 131 countries, for more than $1 million, under names such as St. Regis University, James Monroe University and Robertstown University. It also sold counterfeit degrees in the names of real universities, including the University of Maryland and Texas A&M, according to AP's report of 30 July 2008. Investigators said more than $43,000 in bribes went to three Liberian diplomats, and court filings said a Liberian "Board of Education" offered accreditation in return.

The leader, Dixie Ellen Randock, pleaded guilty with her husband and daughter on 26 March 2008 to conspiracy to commit wire and mail fraud. She was sentenced in July 2008 to three years in prison, and her daughter to a year.

What happens to the people who bought or used the paper?

This is the part sellers leave out. In every case above, the buyers' names ended up somewhere that mattered.

The Spokane buyer list became public. In July 2008 The Spokesman-Review published the list of names from the case, which ICE put at 9,612. Immigration and Customs Enforcement (ICE) then went through it looking for federal employees, and AP reported that at least nine people with .gov email addresses worked for federal agencies. An ICE spokesman said it would be up to each agency to act against any federal employee who used a fake degree to get a job. In May 2009 Washington state health officials accused a social worker and two counsellors of buying fake doctorates from the same mill and using them at work.

A fake credential can end in prison. The UK case of Zholia Alemi involved a forged copy of a real degree, the same document trick without the mill. She used forged University of Auckland medical qualifications to join the UK medical register and worked as an NHS psychiatrist for over 20 years. At Manchester Crown Court she was found guilty of 13 counts of fraud, two of forgery, three of deception and two of using material to falsify medical qualifications, and on 28 February 2023 she was jailed for seven years. On 4 June 2025 the Crown Prosecution Service obtained a confiscation order of £406,624, with two and a half more years in prison if she does not pay.

Cards get cancelled. In the 2026 New York safety card case below, the city's Department of Buildings invalidated the site safety training cards the company had issued. A worker holding one was left with a void card, whatever they knew about how it was issued.

The duped buyers had to sue to get anything back. Belford's buyers needed a federal class action, a default judgment and a settlement that took nearly eight years from filing to final approval. Axact's victims were invited to contact prosecutors about restitution.

The pattern for your own risk is simple. If you believed a mill was real and never used the paper, you are a victim. If you knew it was bought, and you put it on a job application, a licence form or a visa file, you are the one making the false claim. That is why Operation Nightingale cost nurses their licences years after they bought a diploma.

Fake certification bodies: the same trick on a smaller card

Diploma mills get the headlines, but the cheaper version is a fake certificate or training card. The seller is often a real, authorised trainer who skips the training.

OSHA, the US workplace safety agency, says plainly on its card facts page that only OSHA-authorised trainers may teach the 10-hour and 30-hour courses and issue the cards, that it has seen "an increase in fraudulent activity related to these courses over the past several years", and that it publishes a public list of authorised trainers.

Two Brooklyn cases show what that fraud looks like:

• National Site Safety (2025). An authorised OSHA trainer sold dozens of fake safety cards to New York construction workers who never received the training, according to the Brooklyn District Attorney. Investigators made an undercover purchase of an OSHA-30 card. The owner pleaded guilty to second-degree falsifying business records and was sentenced on 30 April 2025 to six months in jail.
• Redcode Inc. (2026). On 8 September 2026 the Brooklyn District Attorney and the city's Department of Investigation announced an indictment charging a training company with locations in Brooklyn and Queens, its owner and an associate. Prosecutors allege that between April and July 2025 they agreed to provide undercover investigators with site safety and OSHA cards for $500 each without the training, had them sign attendance sheets, and reported the training as completed. The defendants are due back in court on 4 November 2026. These are charges, and an indictment is not proof of guilt.

The last detail from that release is the one to remember: the Department of Buildings invalidated the site safety training cards Redcode issued. A card from a real, authorised provider is still worthless if the hours behind it never happened.

The money machine: what a fake credential costs

Prices from the public record give a sense of the trade:

• About $250, the charge one Belford buyer said he paid after an online test (complaint, 2009). The same complaint listed card debits of $99 and $137.55 by Education Services Provider, a company sued alongside the school.
• £500 for a fake University of Kent degree certificate offered on a website in China, found by a BBC South East investigation (BBC, 3 January 2017).
• $500 for each safety card in the 2026 Redcode case, as charged.
• More than $1 million from over 9,000 buyers in the Spokane case, as indicted.
• At least about $140 million from tens of thousands of buyers for Axact, according to the US complaint, and $5,303,020 forfeited by one executive.

The structure repeats. A low entry price gets you to the phone. The real margin comes from the add-ons: "accreditation", transcripts, a government seal, an embassy legalisation. Axact's sales staff were trained to sell those extras after the first payment, and buyers paid more each time to make the paper look more official.

For you, the cost is the fee plus whatever you lose if it is checked: the job, the licence, or the visa.

Is there a diploma mill list?

Not a single official one. New mills appear faster than any list can be updated, and names are cheap to change. Axact ran about 350 school names at once.

The UK's official degree verification service, Prospects Hedd, comes closest. On 29 October 2026 its homepage said it held details of 471 recognised UK institutions and 243 bogus ones. In January 2017 Hedd told the BBC it had closed a fake "Stafford University" (the real one is Staffordshire University) and a bogus "Surrey University", and had come across a "Wolverhamton university" spelt without the p. Its director, Jayne Rowley, said: "Under UK law you are not allowed to call yourself a university unless you are entitled to do so and that requires an order from the Secretary of State."

In the US, the useful list runs the other way. Instead of looking for a school on a list of fakes, check whether the school and its accreditor appear on the list of real ones. If they are missing, that tells you more than any blacklist could.

How to check a credential in five minutes

Use these checks before you pay for a course, and before you trust a certificate someone hands you.

1. US college or university. Search the school in the US Department of Education's accreditation database (DAPIP). The FTC also points to College Navigator. If the school is missing, or its accreditor is missing, treat it as unaccredited.
2. The accreditor itself. A mill's accreditor will have a grand name and a website, but it will not be one the Department of Education recognises. Belford's two accreditors had websites and certificates too.
3. UK degree. Check the institution on Hedd. Employers can verify an individual's award through Hedd from £14 with the graduate's consent; it is not for graduates to check their own awards.
4. IT and professional certifications. Real issuers run a public check. Our page on whether employers verify certifications lists how AWS, CompTIA, Microsoft, PMI and ISC2 do it. If the "issuer" has no verification service, ask why.
5. Training cards. For an OSHA 10 or 30-hour card, find the trainer on OSHA's public list of authorised trainers, and do the hours. If a seller offers the card without the course, that is the Redcode pattern.

If the check fails after you have paid, keep the receipts and report it. In the US, OSHA asks people to report fraudulent trainers to the Department of Labor's Office of Inspector General.

Red flags you can test yourself

Each of these is a test you can run on an offer today:

1. Credit for life experience alone. Belford advertised diplomas "based upon your life experience". Real colleges may give some credit for prior learning, but they still make you study and sit assessments.
2. A name one letter away from a famous one. Barkley, Columbiana, Stafford University and Wolverhamton are all real examples from the cases above.
3. An accreditor you cannot find in DAPIP. Search it. If it only exists on its own website, it is decoration.
4. The upsell after you pay. Being offered "accreditation", an apostille or a government seal for an extra fee is the Axact script.
5. A fixed price per degree. Real programmes charge per course or per credit and take time. A flat price for a finished doctorate is a product you are buying, and the study it claims to show never happened.
6. A card without the hours. An OSHA 30 card means 30 hours of training. If the seller offers to sign you in, you are buying the Redcode charge sheet.
7. The adviser promises employers will accept it. Prosecutors listed exactly this claim, that the degrees were "valid and accepted by employers", among Axact's false representations.
8. An address nobody can visit. Axact's staff gave fictitious addresses. Belford said it was in Panama while its documents were kept in Pakistan.

The honest route: credentials that survive a check

The people in these cases were buying a shortcut past a requirement. Most of those requirements have a real route that takes months, and leaves you with something an employer can verify in a minute.

If the barrier is a degree requirement, start with certification instead of a degree, which covers the four job types where a certification genuinely replaces a degree. If you never finished high school, no high school diploma yet sets out the order to do things in. For IT, the CompTIA A+ guide covers the two exams, the domains and a study plan, and you can put your target date into the free study plan tool on this page.

The same logic applies to exam questions: a pass built on leaked answers is as fragile as a bought diploma, as the ExamTopics case study shows. ExamTips Pro adds a week by week plan and practice questions for one exam at a time. It is preparation for a real exam that you sit yourself, and the certificate at the end is one any employer can look up.