How to Verify a COI: Complete Checklist | COI File
A systematic guide to verifying certificates of insurance. Learn to spot fake COIs, verify coverage limits, confirm additional insured status, and validate every certificate before filing.
You receive a COI from a vendor. You glance at it. It looks official. You file it. Done.
That's how most organizations handle certificate verification -- and it's how expired certificates, insufficient limits, missing additional insured endorsements, and outright fake COIs slip through. Filing an unverified COI is worse than having no COI at all, because it gives you false confidence that you're protected when you're not.
This 12-point checklist takes under 5 minutes per COI and catches the errors that create real liability. Use it for every certificate that crosses your desk.
The 12-Point COI Verification Checklist
Work through each point in order. If any point fails, flag the COI for follow-up and do not file it until the issue is resolved.
- Check the ACORD form version.
The current standard is ACORD 25 (2016/03 or later). Older versions may lack critical fields. If the form looks homemade or uses a non-standard layout, verify it directly with the agent -- don't assume it's legitimate.
- Verify the named insured matches the vendor.
The name in the "Insured" box must exactly match the vendor's legal name on your contract. "ABC Construction" vs "ABC Construction LLC" is a mismatch. A DBA ("doing business as") name alone is insufficient -- the legal entity name must appear. If they don't match, the policy may not cover the entity you're actually hiring.
- Confirm the policy effective date is current.
The effective date must be on or before today's date. If the effective date is in the future, coverage hasn't started yet -- the vendor cannot begin work. Also check that the effective date isn't suspiciously close to the date you requested the COI (a classic sign of a vendor who bought coverage just to get a COI, then plans to cancel).
- Check the expiration date.
The policy must remain active through the entire period the vendor will be working. If the expiration date falls mid-project, you need a plan for renewal before the lapse. Most policies are annual -- if you see a policy term shorter than 12 months, ask why.
- Verify coverage types match your requirements.
Check that the COI shows all required policy types. At minimum, most contracts require General Liability and Workers' Compensation. Depending on the trade, you may also need Auto Liability, Umbrella/Excess Liability, Professional Liability, Pollution Liability, or Builder's Risk. If a required type is missing, the COI is non-compliant.
- Verify coverage limits meet your minimums.
Each policy type has minimum limits specified in your contract. For general liability, $1M per occurrence / $2M aggregate is the most common baseline. Check both per occurrence AND aggregate limits -- a vendor with $1M per occurrence but only $1M aggregate is effectively half-covered compared to one with $2M aggregate. Check umbrella limits too if they're used to meet total limit requirements.
- Confirm additional insured status.
Look in the Description of Operations section for language explicitly adding your entity as additional insured. The entity name must match your legal name exactly. Check which endorsement form is referenced (CG 20 10 vs CG 20 37). If you require completed operations coverage, CG 20 10 is insufficient -- you need CG 20 37 or equivalent. The additional insured box alone is not enough -- you need the endorsement notation.
- Verify waiver of subrogation.
A waiver of subrogation prevents the vendor's insurer from suing you after paying a claim. Look for "waiver of subrogation" language in the Description of Operations section, with your entity name and the applicable policy types. Without this waiver, the vendor's insurer could pay a claim to the vendor, then turn around and sue you to recover the money.
- Check for primary and non-contributory language.
This language ensures the vendor's insurance pays first in the event of a claim -- before your own insurance. Look for "primary and non-contributory" in the Description of Operations section. Without it, your own insurance may be forced to contribute, which increases your costs and potentially your premiums.
- Verify the certificate holder information.
Your legal entity name and correct mailing address must appear in the certificate holder box. This ensures you receive cancellation notices if the policy is terminated mid-term. An incorrect address means cancellation notices go to the wrong place -- and you won't know the policy is cancelled until it's too late.
- Check the insurance carrier and agent.
Verify the carrier has an A.M. Best rating of A- or higher (indicates financial strength to pay claims). Verify the carrier is licensed/admitted in your state through your state Department of Insurance website. Confirm the agent's contact information is valid -- a quick online search should confirm the agency exists. For high-risk or high-value contracts, call the agent using a phone number you look up independently (not the one on the COI) to confirm the policy is in force.
- Document your verification.
Note the date you verified the COI, who verified it, and any issues found/resolved. Save the COI, the verification notes, and any agent correspondence together. In an audit or claim situation, you'll need to prove not just that you collected COIs -- but that you verified them. An unverified COI in your file provides minimal audit protection.
Red Flags: Spotting Fake and Suspicious COIs
Deliberately fraudulent COIs are less common than simple errors, but they happen -- especially with smaller, cash-strapped vendors trying to win contracts without paying for insurance. Here are the red flags that should trigger a direct call to the agent:
- Inconsistent fonts or formatting. A real ACORD 25 is generated by agency management software with consistent fonts and alignment. Hand-typed COIs with mixed fonts, suspicious alignment, or oddly formatted dates are red flags.
- Policy numbers that don't match carrier conventions. Each carrier uses specific policy number formats. A policy number like "12345" from a major carrier is suspicious -- real policy numbers are longer and follow predictable patterns.
- Agent contact information that doesn't check out. The phone number goes to a disconnected line, a generic voicemail, or a personal cell phone. The agency address is a P.O. box or residential address. Search the agency online -- if it doesn't exist, the COI is likely fake.
- Suspicious dates. Policy effective date on a weekend or holiday (insurers typically don't bind coverage on Sundays). Start and end dates that don't align with standard policy terms (e.g., a 7-month general liability policy). A COI issued "just today" with an effective date "just today" from a vendor you've been asking for weeks.
- Limits that exceed what the carrier writes. Some carriers don't write $5M general liability policies for small contractors. If the coverage seems unusually high for the vendor's size and the carrier's typical book of business, verify.
- Vendor resists verification. If a vendor tells you "just trust the certificate" or gets defensive when you mention calling the agent, that's a red flag. Legitimate vendors with legitimate insurance have nothing to hide.
Agent Errors vs. Deliberate Fraud
Not every problem on a COI means someone is trying to deceive you. Most issues are simple agent errors -- but you need to know the difference:
| Scenario | Likely Agent Error | Possible Fraud |
|---|---|---|
| Wrong effective date | Agent typed issuance date instead of effective date -- call, they correct it | Policy was cancelled but agent re-issued a COI with a new date |
| Missing additional insured notation | Agent forgot to list it in Description of Operations -- call, they add it to the COI | Endorsement was never actually added to the policy; vendor asked for it on the COI without paying for it |
| Wrong entity name | Agent used an old name or DBA instead of legal name -- call, they reissue | Vendor gave the agent a name that doesn't exist as a legal entity to obscure their identity |
| Lower limits than expected | Vendor has a lower-limit policy; agent accurately reported it -- this is a compliance issue, not error | Vendor doctored the COI to show higher limits than the actual policy |
| Policy shows as active but agent says cancelled | N/A -- this is never an error | Vendor paid first installment, got COI, stopped paying -- policy was cancelled for non-payment but old COI still circulates |
The rule of thumb: if the carrier and agent are real, the policy exists, and the vendor is the named insured, most discrepancies are agent errors that can be resolved with a phone call. If the carrier is fake, the agent doesn't exist, or the policy number leads nowhere -- that's fraud.
When to Call the Agent Directly
Most COIs don't require a phone call. But in these situations, pick up the phone:
- High-value contracts. If the vendor's work involves significant risk (roofing, structural work, hazardous materials) or the contract value exceeds $100K, a 5-minute verification call is cheap insurance.
- Multiple red flags. One or two minor issues might be errors. Three or more suspicious items -- call the agent.
- First-time vendor. You have no history with this vendor. Verify comprehensively before they start work.
- Prior compliance issues. If this vendor has submitted late, non-compliant, or questionable COIs before, verify every time.
- Claims or incidents involving this vendor. After an incident, confirm the policy was active on the date of loss before filing a claim.
When you call, use a phone number you find independently -- not the number printed on the COI. Say: "I'm verifying coverage for [Vendor Name], policy number [X]. Can you confirm the policy is active, the effective date is [Date], the limits are [Limits], and [Your Entity] is listed as additional insured?" Most agents will confirm these details in under two minutes.
Tools for Faster Verification
The 12-point checklist works, but it doesn't scale. If you're verifying 20+ COIs per month, manual verification becomes a bottleneck. COI tracking software with AI extraction can:
- Extract all 12 verification points from the COI automatically
- Flag non-compliant certificates before you even look at them
- Compare extracted data against your contract requirements
- Track expiration dates and send automatic renewal alerts to vendors
- Maintain a complete audit trail of every verification
COI File does all of this and is free for up to 5 vendors. Try it free today -- no credit card required.
Frequently Asked Questions
Sources & References
- International Risk Management Institute (IRMI) -- Comprehensive resources on certificate verification best practices. irmi.com
- A.M. Best -- Insurance carrier financial strength ratings for verifying carrier legitimacy. ambest.com
- National Association of Insurance Commissioners (NAIC) -- State insurance department directory for verifying carrier licensing. naic.org
- ACORD -- Official standards body for the ACORD 25 certificate form. acord.org
Related Resources
- What Is a Certificate of Insurance? -- the complete guide to understanding COIs
- What Is an Additional Insured? -- understand the critical difference between certificate holder and additional insured
- Free COI Requirements Checklist -- downloadable checklist matching this verification process
- COI Tracking: The Complete Guide -- automate verification with AI extraction and expiration alerts
- COI Tracking for Property Managers -- how property managers verify vendor COIs at scale
- COI Tracking for General Contractors -- subcontractor COI verification for GCs
Firdaosh Bano
COI Compliance Specialist
Firdaosh Bano is a COI compliance specialist and the founder of COI File. She spent 6 years managing vendor compliance for commercial properties - tracking 2,000+ COIs across 150+ properties in spreadsheets before building the tool she wished she'd had. She writes about certificate of insurance compliance, vendor risk management, and making insurance tracking less painful for small teams.