Start with an uncomfortable sentence: a certificate of insurance is not proof of insurance.
It's a summary document, prepared by an agent, describing coverage that existed at the moment of preparation. The standard ACORD form says as much on its face — it confers no rights on the holder and doesn't amend the policy. It is, functionally, a screenshot. And like a screenshot, it can be outdated the day after it was taken, and it can be edited by anyone with a PDF tool and twenty minutes.
Freight fraud operations know both things. Brokers' filing cabinets are full of green-looking certificates for policies that were cancelled for non-payment months ago, and inboxes receive genuinely fake certificates every day — real insurer names, real-looking agency blocks, invented policy numbers.
So the question isn't "do we have the COI on file." It's "what did we verify, and when."
What forged and doctored certificates get wrong
Most fakes fail on details the forger doesn't understand, because the forger has edited certificates but never issued one.
Coverage that's too convenient. Limits that exactly match whatever the broker's requirements page says, across every line, with round numbers everywhere. Real policies come out of underwriting with texture; fakes come out of your own requirements doc.
A producer block that doesn't resolve. The agency listed at the top is the document's origin. Look it up. Real agencies have phone numbers that answer, addresses that exist, and staff who can find the policy. Fakes list agencies that are out of business, unreachable, or real-but-uninvolved — the last being the tell that the forger copied a genuine certificate and swapped the insured.
An insurer that couldn't have written it. Every legitimate US insurer has an NAIC number and a licensing footprint you can check. Certificates naming insurers that don't exist, or naming real insurers for lines they don't write, are more common than you'd expect.
Dates that don't line up. Policy periods that don't match filing dates, certificates "issued" on weekends by agencies that weren't open, effective dates in the future on a carrier claiming years of coverage.
Auto liability standing in for cargo. Not forgery — misdirection. The certificate is genuine, the liability lines are real, and the cargo coverage a claim would actually need is absent or sublimited into uselessness. Read the cargo line like it's the only line, because on the day it matters, it is.
Verification that actually holds up
One principle: verify with the source, through a channel you found yourself.
Call or email the producing agent — using contact details you looked up independently, not the ones printed on the certificate, since a forger controls everything printed on the certificate. Confirm the policy exists, is in force today, covers the named insured, and includes the cargo coverage at the stated limit. Ask whether a cancellation is pending.
Cross-check the federal picture. Liability filings (the BMC-91 series) are visible on the carrier's public record; a certificate claiming liability coverage from an insurer that doesn't match the federal filing is a conversation.
And then the part almost nobody does: watch it. Coverage verified in March means nothing in July. Policies cancel mid-term constantly — non-payment is the leading cause — and no one sends brokers a courtesy note. Verification without monitoring is a photograph of a moving object.
The volume problem, and the honest answer to it
Everything above is straightforward on one certificate. A brokerage onboarding thirty carriers a week is looking at reading, checking and re-checking hundreds of documents a month, forever — which is why COI review decays into logo-glancing at almost every growing brokerage. The process doesn't fail because people are careless. It fails because it doesn't scale.
This is the problem Dollar Traq's COI verification was built for: Vault reads every certificate, extracts the coverage lines, verifies the producer and the policy details, checks the holder and limits against your requirements, and keeps watching expirations and changes — with 350,000+ certificates on file and every extraction shown with its source. The standard doesn't drop when the volume rises, because the reading isn't done by whoever's busiest.