# Spotting a fake verification page

A QR code is a picture of a link. Anyone can print one, and anyone can point it
at a page they built themselves — including a page designed to look exactly like
this one. That is the whole trick, and it is worth two minutes of your time if
you check cards at a door.

## The one thing that cannot be faked

**The address bar.** A real Amatya ID card resolves to:

```
https://siddhixsys.com/v/XXXXXXXXXXXXXXXX
```

Look at what comes immediately before the first single slash. It must be exactly
`siddhixsys.com`. Everything else on a page — the layout, the colours, the tick,
the wording, even a padlock — can be copied in an afternoon. The domain cannot.

Addresses built to be misread:

| Looks like | Actually is |
|---|---|
| `siddhixsys.com.verify-id.in` | `verify-id.in` — the real name is the LAST one |
| `siddhixsys-verify.com` | a different domain entirely |
| `siddhixsys.co` | a different domain entirely |
| `siddhÍxsys.com` | a lookalike character |

The padlock only means the connection is encrypted. A fake site can have one.

## What a real page will and will not say

Amatya ID states exactly what it knows and nothing more:

- **"Issued by the account that controls this page"** — this is the normal
  result. It means someone with an account issued the card. It does NOT mean we
  have checked who they are.
- **A confirmed organisation** is shown differently, and only after a human at
  SIDDHI xSYS has checked that organisation out of band.
- A card that is expired, cancelled or under review says so plainly.

Be suspicious of any page that goes further than that — a page claiming a card
is "government verified", or showing an official-looking seal, is telling you
something we would never say.

## Habits that make you hard to fool

1. **Type it, do not scan it.** For anything that matters, read the code printed
   on the card and open `siddhixsys.com/v/` yourself. A QR that goes somewhere
   else cannot survive that.
2. **Check the photo before the page.** The most common fake is not a clever
   website — it is a real card belonging to someone else.
3. **A page that hurries you is a warning.** Countdowns, "verify now to avoid a
   fine", anything asking you to pay or to enter an OTP: no verification page of
   ours will ever ask for money, a password or a one-time code.
4. **Widgets are not proof.** Anyone can put a status widget on their own page;
   ours deliberately shows no tick inside a frame, and always links out to the
   real address for that reason.

## If you think a card is fake

Open the real verification page and use **Report this card** at the bottom. A
person reads those. Reports alone never take a card down — that would let anyone
silence a genuine school by complaining — but they do get a card frozen while it
is checked, which closes the window a fake is useful in.