When the Training Record Can Be Faked: The Trucking Crackdowns on Both Sides of the Border

When the people fixing your training records are the same people faking them, the paper trail isn't proof — it's a liability. That is the uncomfortable lesson buried in a federal enforcement story that, on the surface, looks like it's only about American trucking.

On July 16, 2026, the US Department of Homeland Security and the Department of Transportation announced a joint criminal investigation into roughly 75 entry-level commercial driver's license (CDL) schools suspected of falsifying training records and issuing improper certifications. It didn't come out of nowhere. It landed on top of a cleanup already in progress: the Federal Motor Carrier Safety Administration (FMCSA) has removed more than 9,500 unqualified training providers from its federal registry — what the agency has called the largest enforcement action against commercial driver training programs in its history.

If you're reading this in Canada and filing it under "American problems," don't. Two months before the US announcement, Ontario's Auditor General published a special report on this country's version of the same story — training schools certifying drivers who never completed the required hours, students told to sign off on training they didn't receive, and unregistered schools booking thousands of road tests. We'll get to it below, because the Canadian chapter is in some ways worse: Canada doesn't even have a national registry to purge.

Strip away the specifics of trucking and you're left with a problem almost every employer who buys safety or compliance training shares: a training record is only as trustworthy as the system that produced it. When that system lets a provider self-certify — and lets a certificate travel as a static PDF that no one can independently check — a forged record and a real one look exactly alike until something goes wrong.

What actually happened in the United States

The Entry-Level Driver Training (ELDT) rule took effect on February 7, 2022. It requires anyone seeking a CDL to train through a provider listed on FMCSA's Training Provider Registry (TPR). Sensible on paper. But the registry was built on self-certification: providers attested to their own compliance to get listed, with little vetting up front. The list swelled past 32,000 providers, and the gap between "listed" and "legitimate" widened with it.

When FMCSA finally audited the registry, what it found is the tell. Investigators removed providers for falsified training records, unqualified instructors, missing behind-the-wheel training, and "ghost" locations that ran no actual training at all — some programs advertising a CDL in as little as two days. The removals came in waves through late 2025 and into 2026, and now a subset of schools faces a criminal probe.

The through-line isn't that trucking is uniquely corrupt. It's that a self-certified record with no independent way to verify it is an open invitation. Give bad actors a certificate that only has to look right, and some of them will simply manufacture it.

The real problem isn't trucking — it's self-certified paper

Here's why this should matter to a safety manager who has never bought a CDL course in their life. Most workplace training records in circulation today have the same structural weakness the TPR had: they are self-attested and they end their life as a PDF.

A PDF certificate asserts a name, a course, and a date. It cannot prove any of them. It can't prove the named person is the one who actually did the training. It can't prove the content was real. And it can't prove it hasn't been altered since it was issued — changing a date or a name in a downloaded certificate takes about thirty seconds. The document protects the employer right up until the moment it's tested — an incident, an inspection, a claim — at which point "we have the certificates on file" turns out to mean far less than it looked like it did.

This is the same rot underneath the buyer's guides we've written for other kinds of safety training: from the outside, a rigorous course and a hollow one produce certificates that look identical. The only thing that separates them is whether the certificate can prove a specific, named person genuinely earned it. The CDL crackdown is that problem finally getting prosecuted.

Why a certificate can't defend itself

Two failures hide inside an ordinary training certificate, and the CDL fraud makes both visible.

The first is completion versus competence. A record that says an account reached the end of a course tells you nothing about whether the person can actually do the job safely. A dashboard full of green checkmarks is reassurance, not evidence.

The second is deeper and it's the one the fraud turns on: identity and integrity. Who actually did the training, and has the record been tampered with since? A login-only course can't answer the first question — the account holder could have handed the credentials to anyone. And a static certificate can't answer the second — nothing stops it from being edited, and nothing lets a third party confirm it's authentic without simply trusting whoever hands it over. When the issuer is the same party with an incentive to cut corners, "trust the paper" is exactly the wrong instruction.

Canada is running the same experiment — Ontario just published the results

Canada has no FMCSA and no Training Provider Registry. Commercial licensing and training oversight belong to each province — and that patchwork is exactly where the same fraud pattern has taken root.

In May 2026, Ontario's Auditor General released a special report on large commercial truck driver licensing, and its findings read like the FMCSA audit with the serial numbers filed off. A quarter of Ontario's 216 truck driver training schools had never been inspected at all. Undercover audit work found colleges that certified students on a fraction of the required 103.5 hours — one delivered barely half. Students reported being instructed to sign off on training hours they never received — "I was told I needed to sign it anyways for their records or in case of an audit," one told the auditors, which is as clean a description of manufactured evidence as you will find. Seventeen schools that had never registered as career colleges booked more than 3,200 road-test appointments anyway; schools with expired or revoked registrations booked thousands more. The province responded by ordering inspections of every truck-driving career college.

The testing side is compromised too. In January 2026, the OPP charged five driving examiners and three instructors with 24 Criminal Code offences after a Ministry of Transportation investigation into commercial driver exam fraud in Kingston and the GTA. The Ontario Trucking Association's president called it "just the tip of the iceberg."

None of this is happening because Canada lacks training rules. After the 2018 Humboldt Broncos crash, mandatory entry-level training (MELT) spread across the country — Ontario had moved first in 2017, Saskatchewan, Manitoba and Alberta followed in 2019, and British Columbia and Prince Edward Island later joined. But a mandated number of training hours is only as real as the record saying the hours happened — and Ontario's auditor just showed how easily that record is manufactured. Meanwhile the requirements themselves keep shifting: Alberta is replacing MELT with a new competency-based learning pathway. Whatever the rulebook of the day says, the structural weakness is constant: self-attested hours, recorded on paper the school controls, checked by no one until something goes wrong.

That's the Canadian lesson in one line: the US at least had a central registry to audit and purge. In Canada, the same fraud has to be caught province by province, school by school — which means the burden of knowing whether a driver's training was real falls that much harder on the employer holding the certificate.

What a verifiable credential changes

This is the part where the fix is genuinely structural rather than just "try harder to spot fakes."

A verifiable credential is a training record issued as tamper-evident, cryptographically signed data rather than a printable document. It's built on an open standard — the W3C Verifiable Credentials data model — and it changes three things at once:

• It can't be silently altered. Change one character and the cryptographic signature breaks, so a forged or edited record fails verification instead of passing as real.
• Anyone can check it, without trusting the issuer's word. An auditor, a carrier, a client, or a regulator can verify the credential against the issuer's signature on the spot — not phone the school and hope someone picks up.
• A revoked issuer is visible. When an issuer is removed or discredited, credentials tied to them can be flagged, so a record from a purged provider doesn't quietly keep passing.

Put plainly: a verifiable credential moves proof out of a document that can be faked and into math that can't. The CDL scandal is what happens when thousands of records have no such property. A credential system built on verifiable records is the version of the same paperwork that would have made most of this fraud fail on contact — a fabricated record simply doesn't verify.

None of this replaces the government's own systems of record — FMCSA's registry in the United States, provincial licensing in Canada. But verifiable credentials attack the specific weakness the fraud exploited — records that look authentic and can't be checked — and that weakness is everywhere, not just in trucking.

Where Gardril fits

Gardril was built around this problem, because the market it entered was full of certificates that couldn't stand behind their own names.

Two design choices do the work. First, identity is verified at the point of assessment — confirming that the person who completes the graded assessment is the person named on the record, so an impersonation is caught before a certificate is ever issued, without turning the whole course into surveillance. Second, the record itself is issued as a CredentialVault verifiable credential rather than a static PDF — a tamper-evident credential, tied to the verified learner and built on open standards, that an auditor or a client can confirm on the spot.

Gardril issues its safety training as CredentialVault verifiable credentials — an implementation of the same verifiable-record model described above.

The point isn't that a credential platform makes anyone comply with a rule. It's that when the record can be verified by anyone, the incentive to fake it collapses — a hollow credential stops being worth issuing, because it can't survive the first check. That's the model worth asking any training vendor about, whoever they are.

You can see how Gardril approaches verified, defensible safety training if you want the working example.

What this means for you as an employer

You don't have to reform a federal registry — or a provincial college system — to protect your own organization. Three things to do now:

• If you employ Class 1/Class A drivers in Canada, verify the training school, not just the licence. Confirm the school is a registered, in-good-standing training provider in its province (in Ontario, a registered career college), ask for the detailed training record — dates, hours, instructor — behind the certificate, and treat a school that can't produce one as the red flag it is. Document what you checked; that record of diligence is yours to keep.
• If you run cross-border fleets, audit US-trained hires against the TPR. Confirm each driver's training provider is still active at tpr.fmcsa.dot.gov, document that you checked, and plan retraining for anyone trained through a removed provider — a certificate from a purged school may be invalid.
• For every other kind of safety training, apply the lesson before you renew or buy. Ask whether the record verifies who actually did the assessment, whether it certifies demonstrated competency rather than mere completion, and whether it's issued as a verifiable credential a third party can check — not a PDF you're asked to take on faith.

The certificate is the easy part. Proving the right person genuinely earned it — and being able to show it to someone who doesn't have to trust you — is the part that holds up when it counts.

Frequently asked questions

What did Ontario's Auditor General find about truck driver training?

The May 2026 special report found that a quarter of Ontario's 216 truck-driver training schools had never been inspected, that some colleges certified students who completed only a fraction of the mandatory 103.5 hours, that students were told to sign off on hours they never received, and that unregistered or suspended schools booked thousands of road tests. Ontario ordered inspections of every truck-driving career college in response.

Does Canada have an equivalent of the US Training Provider Registry?

No. Commercial driver licensing and training oversight are provincial. There is no single national registry of approved training providers to check — or to purge — which is why verifying a Canadian driver's training means checking the school's standing with its province and asking for the detailed training record behind the certificate.

What is MELT?

Mandatory entry-level training — the minimum training now required before a Class 1/Class A road test in most provinces, adopted widely after the 2018 Humboldt Broncos crash (Ontario first, in 2017). Requirements vary by province and continue to evolve; Alberta is replacing MELT with a competency-based learning pathway.

What are the 75 US CDL schools being investigated for?

Federal authorities announced on July 16, 2026 that DHS and DOT/FMCSA opened a joint criminal investigation into roughly 75 entry-level CDL training schools suspected of falsifying training records and issuing improper certifications. It follows the removal of more than 9,500 unqualified providers from FMCSA's Training Provider Registry.

What is a verifiable credential, and how does it prevent fake training records?

A verifiable credential is a training record issued as tamper-evident, cryptographically signed data based on the W3C Verifiable Credentials standard, rather than a printable PDF. Because any change breaks the signature and anyone can verify it against the issuer without trusting a printout, a forged or altered record fails verification instead of passing as authentic.

Does a credential platform replace government registries or make training compliant on its own?

No. Government systems — like FMCSA's registry or provincial licensing — remain the system of record, and no platform makes a person compliant by itself. Verifiable credentials address a narrower but pervasive weakness — records that look authentic and can't be independently checked — which is the specific gap this fraud exploited.