Catch Me If You Can: A Pug, a Fake Airline Captain, and the Online Training Fraud Your LMS Won’t Talk About

In September 2025, a pug named Phoebe earned an Alberta defensive driving certificate. She followed that up with a boating licence and Alberta’s ProServe liquor-server certification. By the time the story reached the news, Phoebe the pug held more than 200 professional certifications — most of them completed online, many in a matter of minutes, using an AI tool operating on her behalf. She cannot see over a steering wheel. She is a dog.

Phoebe is funny until you finish the thought. Every certificate she “earned” came from a system that never once confirmed a human being was doing the work — or that the human being was who they claimed to be. That is not a quirk of one course. It is the default state of a large share of online safety and compliance training, and it is a problem that lands on the desk of the employer who trusts the certificate, not the platform that issued it.

When “certified” means nothing

Phoebe is the entertaining version of a problem the safety industry is now openly alarmed about. In late 2025, Canadian Occupational Safety reported a surge in fake occupational health and safety training certificates, with dozens of fraudulent credentials surfacing in Ontario in a matter of weeks — some of them “earned” by AI completing the training modules and assessments on the worker’s behalf.

The tooling has caught up to the incentive. As awarding bodies have warned, generative AI has turbocharged qualification fraud: a convincing certificate — complete with logos, signatures, QR codes, and official wording — can now be manufactured or “passed” in seconds. If your training provider checks nothing more than “did this browser session click through the slides and score 80 percent,” then it is not verifying competence. It is selling a receipt.

The seventeen-year captain

If Phoebe shows how easy the fraud is, the other end of the spectrum shows what it costs when nobody checks.

In June 2026, Canadian police charged a former Air Canada captain, Geoffrey Wall, after alleging he flew more than 900 flights over nearly 17 years without ever holding the Airline Transport Pilot Licence required to command the aircraft. He allegedly used forged licensing to deceive both the airline and the regulator, captaining Boeing 767, 777, and 787 aircraft carrying tens of thousands of passengers. The investigation — fittingly named Project Icarus — ended with seven criminal charges, including fraud and uttering forged documents. As one outlet put it, it reads “like a movie script.”

It reads like a specific movie script. In Catch Me If You Can, Frank Abagnale passed himself off as an airline pilot, a doctor, and a lawyer, cashing forged cheques across an industry that had no reliable way to confirm anyone was who they said they were. The story doesn’t end with the con man, though. It ends with the banks building the fraud controls — verification, identity checks, audit trails — that made his tricks obsolete, and with Abagnale himself spending decades helping them do it.

That is the whole point. Aviation and banking were embarrassed into building verification. Online training, for the most part, has not been. The dog and the captain are seventeen years and one punchline apart, but they are the same failure: a credential nobody checked.

If your LMS isn’t stopping fraud, it’s enabling it

Here is the uncomfortable framing for training vendors, and we include ourselves in it: when a learning platform has the means to verify identity and prevent fraud and chooses not to, it is not a neutral party. It is part of the problem. A course that a pug can pass is not a course. It is a liability with a completion screen.

The technology to fix this exists and is not exotic. Identity verification at enrolment and at assessment, monitoring to confirm a real person — not a script — is doing the work, and tamper-evident, independently verifiable certificates are all available today. The reason they are not universal is not cost or capability. It is that, for a long time, nobody made providers care. That is changing, and the providers who resist it are telling you something about how much they value the paper they sell.

The bill lands on your desk, not theirs

For a safety or HR buyer, this stops being an abstraction the moment something goes wrong, because the legal exposure does not sit with the platform. It sits with the employer.

In Canada, the Westray Law (Criminal Code s. 217.1, enacted through Bill C-45) makes owners, directors, managers, and supervisors criminally liable — up to and including imprisonment — where a failure to take reasonable steps leads to a workplace death. A forged or unverified safety certificate sitting in your training records is precisely the kind of “you should have known” gap that turns an accident into a negligence case. Provincial regulators add financial weight on top: occupational health and safety offences routinely draw six- and seven-figure fines, and inadequate or negligent training opens the door to civil suits, denied insurance claims, stop-work orders, and workers’-compensation cost recovery. Insurers are increasingly clear that a certificate they cannot validate is a certificate they can decline.

Put plainly: when the forklift operator’s certificate turns out to have been “earned” by an AI — or a dog — it is not the training vendor standing in front of the judge. It is you.

What to demand from your training provider

Provocative headlines aside, this is meant to be useful. Before you renew with any online training provider, ask them to show you — not tell you — how they answer these questions. If they can’t, you now know where you stand.

• Do you verify who is actually taking the course? Look for real identity verification at enrolment and again at assessment, not just an email address and a checkbox.
• How do you stop a bot or an AI tool from completing the training? Ask specifically about automated-completion and scripted-session detection.
• Can a certificate be independently verified as genuine? Every certificate should link to a verification record hosted by the issuer, so an employer or regulator can confirm it in one click — and so a forged copy fails the check.
• Are certificates tamper-evident? A PDF anyone can duplicate in an image editor is not a credential.
• Is there an audit trail? You should be able to demonstrate to a regulator or an insurer exactly who completed what, when, and how their identity was confirmed.

These questions belong in the same conversation as price and course content — and they are the reason Gardril is built the way it is. Every learner is identity-verified and every assessment is AI-bot-blocked through Asgard, so a certificate means the real person named on it actually did the work — and CredentialVault makes that certificate tamper-resistant and independently verifiable at the source, so a forged copy simply fails the check. That is the entire job. A provider that treats it as optional is doing a different job than the one you are paying for.

Frequently asked questions

Did a dog really pass a defensive driving course?

Yes. In 2025, a pug named Phoebe obtained an Alberta defensive driving certificate and, ultimately, more than 200 online certifications, largely through an AI tool completing the courses. The case was widely reported by CBC and CTV News and prompted a provincial review of the certification process.

Who is liable if an employee has a fake training certificate?

In most cases, the employer. Regulators and courts generally hold the employer responsible for ensuring workers are genuinely trained and competent. In Canada, the Westray Law can create criminal liability for directors and supervisors where inadequate safety measures contribute to a workplace death.

How can I tell if an online training certificate is genuine?

A genuine certificate should be independently verifiable through the issuing provider — typically a verification page or QR code that confirms the record and the identity of the person who earned it. If a certificate cannot be verified at its source, treat it as unproven.

What should I look for in a fraud-resistant training provider?

Identity verification at enrolment and assessment, detection of bots and automated completion, tamper-evident certificates, source-based verification, and a complete audit trail you can produce for a regulator or insurer.