Fake credential providers have forced firms to turn verifications more thorough and intrusive over the years.