March 27, 2026
Before COVID, most evaluation companies would have frowned upon accepting emailed documents. To authenticate documents, typically original documents or official documents sent in a sealed envelope are required. The pandemic changed all of that. When the world shut down, we had to consider other secure ways to receive academic documents from international students. The question still remained – should we accept these emailed credential scans? Rise of digital documents For years, ECE resisted accepting emailed documents because we did not consider them official. As the pandemic spread around the world, institutions began asking that we accept emailed documents while their offices were closed for health reasons. A few years later, what started as a temporary solution has become acceptable practice. While we were willing to work with emailed documents, we initially considered it a temporary measure aimed at helping institutions deal with pandemic shutdowns and the resulting limited access to office space. As the pandemic subsided, most office spaces re-opened, and official documents were available again for shipping. Interestingly, the pandemic inadvertently started a new trend: widespread adoption of digital documents and electronic document portals by many institutions around the world. It is easy, secure, and environmentally friendly. Save the trees! With that said, does ECE still accept emailed documents? Yes, we still accept emailed documents from relevant sources. However, we have established an email authentication process that each emailed document goes through before it is accepted for evaluation purposes. We also only consider accepting emailed, authenticated documents if no digital transfer or electronic portal option is available. Emails are not a substitute for established trusted practices offered by the institution in question. Why do we need to vet emails? Primarily, emails can be spoofed to pass off fraudulent documents as legitimate. Second, emails could be sent by an unknown source, which would render the documents unofficial or unacceptable. Thus, we prioritize email authentication practices when dealing with emailed documents. We have become very efficient in knowing what to look for and when to hold up the evaluation for further investigation. Adventures in email authentication One of our interesting discoveries involved an email sent to us from an African university account by what appeared to be a member of the academic registry staff, judging by the title listed in the email. Although the person was a publicly listed staff member of the university, the email address for the account was different by one letter from what was publicly listed on the university's website. The correct email address used the person's first name initial followed by the full last name (e.g., hsmith). The fake email address used the first and middle name initials followed by the last name (e.g., hasmith). A small detail that is amazingly easy to miss. Another issue was that the email transmission failed to pass through the DMARC and DKIM email security protocols and indicated origin from a server we have not seen used in any prior communications with the same university. Something wasn’t adding up! Another case involved an email from a university in the Middle East, but from a completely unverifiable Gmail account. While it is common for some institutions to use Gmail accounts, it is not acceptable if we cannot verify those accounts on their website or through other official means. In this instance, we contacted a known contact at the university and notified the applicant that we were reaching out for more information. Not too long after, we received a response indicating the documents were not authentic, and the email address in question was not authorized for official communications. We took another step and used a free email checker tool (ECE uses the Free Email Verifier by Wiza) to see if the email address was still active (which it was when we first reviewed this case). Lo and behold, the email address was no longer deliverable. We never found out whether the person worked at the university, but we now know that whoever sent the email was not authorized to do so. The value of email authentication became even more apparent when we received a message from a reputable email address of a university. From the looks of it, it was a regular official email with attached academic documents. Nothing of note there. However, when we inspected the message header more closely, the red flags popped up. The email transmission failed several authentication protocols, which was unusual for messages received from what was considered an official email address. It was enough to hold up the evaluation process and contact the university for verification. In all these cases, we confirmed that the emailed documents were fraudulent, further demonstrating the importance of exercising caution when working with emailed documents. We will be sharing a more detailed resource on email authentication via the Connection Advantage soon. In the meantime, the advice is: “know your sender and verify how the email was sent." Happy emailing, everyone!