Due Diligence
20
May 2014

Using Error Level Analysis to Identify Fake Certificates

When you’re given documentation and certificates by Chinese companies, the possibility of them having been faked using Photoshop may be on your mind.

There are many different techniques you can try for checking Chinese certificates, but to truly ensure valid documentation verification is required.

If you are technically minded and have been sent a JPEG of the certificate, here is an interesting check that you can try for yourself: error level analysis.

This is by no means a sure-fire technique, and requires some subjective analysis on the part of the user. However, in many cases it can reveal that a digital image has been artificially altered.

What is Error Level Analysis?

The JPEG image format is popular because it can reduce the file-size of photographic images. It does this with a compression algorithm, which involves removing information that the algorithm determines is less important or less noticeable to the human eye.

Each time an image is saved in the JPEG format, a certain amount of information is lost and can never be retrieved. This loss of information is the error level. In other words, the more times an image is compressed with the JPEG algorithm, the higher its error level.

The technique of error level analysis involves, surprisingly enough, analysing this error level across the image. More white in the analysis image means a higher error level in that part of the image, and more black indicates a lower error level.

Edges (lines of contrast) should have similar error levels (amount of white in the analysis image). Similar surfaces, textures, patterns, colouring and so on should also have similar error levels within one image. If the error level differs significantly between different parts of the same image, this suggests that parts of it have been edited or super-imposed.

Note that it’s not the amount of black or white in the analysis image that’s important in itself. Instead, it’s unexpected differences in the error level.

An Example

Let’s have a look at a practical example of how this works. Here’s an original, unedited scan of a document we found through Google:

Original document we found on Google

If we run an error level analysis algorithm on the image, we get this:

Error level analysis on the original document scan

There are lighter and darker areas in the ELA image, indicating different error levels. However, in general it appears that similar textures, edges and so on have similar error levels. At a glance, it would appear that this image has not been significantly edited.

But what if we try to edit the original scan to change some of the information? We made some changes to the scan:

  • We increased the contrast on some parts of the image
  • We resized some parts of the image
  • We filled in some areas of the background with solid colour
  • We added a stamp from another image

You can see these changes in the image below:

The document scan with several rough changes made

In this case the edits may be obvious to the naked eye, but we’re just using this as an example. A careful scammer would create more careful alterations that would be less obvious in the image.

If we run error level analysis on this edited image, we get this result:

Error level analysis of the edited document

Notice how the edited areas have much more white in them (they’re brighter) than other similar areas on the document. Most of the ELA image is dark, indicating a minimal error level. But certain areas now stand out in the ELA image due to having a higher error level:

  • The parts of the certificate border that we edited have become brighter (got a higher error level) than the rest of the border, despite the texture being the same.
  • The half of the original stamp that we edited has become much brighter than the other half.
  • The additional, fake stamp also has a higher error level than other items on the document, despite having a similar texture and similar edges.

These changes may have been obvious in the plain edited image, but they’re extremely stark and hard to miss in the ELA image. That is the value of ELA; it can make edits more obvious than they are to the naked eye in the plain image. This is helpful when trying to spot more subtle edits made by scammers.

Remember that it’s not the brightness or darkness in itself that matters. In the original, unedited image, certain areas were brighter than others in the ELA image. What matters is when similar parts of the image (e.g. edges and patterns) have disparate error levels.

How Do You Do Error Level Analysis?

You can carry out error level analysis using free software. The open source GIMP image editor can do it using a free script. Once you’ve got that script installed in GIMP, just go to the Image menu, and Error Level Analysis is available as an option for the current image.

The process shouldn’t take very long, and you’ll be able to see a graphical representation of the error level across the image. You can edit and save this representation just like any other image.

It’s up to you to carry out the analysis yourself, though. You’ve got to look at the resulting representation and assess whether you think any areas look markedly different to the rest of the image. As shown above, edited or superimposed areas are likely (but not certain) to come out in different colours and contrast than the rest of the image.

Larger, higher quality images work much better for error level analysis. Edits will be much more visible in analyses of these images compared to smaller ones.

You can learn more about error level analysis at FotoForensics.

How China Checkup Uses Error Level Analysis

Whether it’s an ISO 9001 certificate, Foreign trade registration certificate or business licence here at China Checkup we have carried out certificate verifications on all of them, and found many fakes.

All of our verification services are carried out thoroughly using a variety of tools and sources in order to draw a firm conclusion. We use error level analysis primarily as a basic tool to make a quick initial check for inconsistencies.

Here are a couple of case studies:

Shipment to USA

Recently a customer in the US got in touch because his container of products hadn’t showed up and he could no longer contact his Chinese supplier.

He provided us with a whole catalogue of convincing documentation the “company” had provided him with, and at first sight it certainly looked convincing. The documents he received included:

  • Certificate of Origin
  • Bill of Lading
  • Certificate of Quality
  • Certificate of Aflatoxin
  • Fumigation/Disinfection Certificate
  • Health Certificate
  • Phytosanitary Certificate

Initially we were unable to check these documents because they had been sent in PDF form by the client. But when we received JPEG versions our error level analysis checks showed up some concerns and sure enough it was eventually found that all of the documents had been fraudulently “photoshopped”.

Unfortunately for the customer he carried out these verifications AFTER paying for the goods, not BEFORE.

New “ISO 9001 Certified” Supplier

Error level analysis of a fake ISO 9001 certificate

We recently verified a company in Guangxi province who had provided our customer with a copy of their ISO 9001 certificate.

Carrying out error level analysis on the document immediately raised concerns.  As you can see in the image below the certificate’s border mysteriously disappears at the top and in a small section on the left and right hand side.

The brightest section of the certificate is where the scope of certification is stated – presumably it has been edited many times for each occasion the certificate is copied.

In fact, we knew the document was fake the moment we looked at it, because the certificate was for the year 2000 version of ISO 9001 yet claimed to have been issued in 2012.

ISO 9001 was revised in the year 2008 and no certification company would issue a new certificate to the old version of the standard 4 years after it was updated.

Need to check a Chinese company’s ISO 9001 certificate? Find online resources or check out our verification service.

Try Error Level Analysis Yourself

If you’re analysing scans of documents shown to you by a Chinese company, you should be in quite a nice position to get hold of high resolution, good quality images to analyse.

Always remember, though, that error level analysis can’t conclusively prove anything. You certainly should not rely on error level analysis to verify important documentation. For a more accurate verification, read about our certificate verification services.

Verify a China Company.

✔ Order online today & get peace of mind

Further reading