GACS · Free OSINT Certification
Learn to investigate scams, fake accounts and money trails
A free eight-lesson open-source intelligence (OSINT) course that teaches you how to find out who is really behind a website, wallet, phone number or social account — using only free, public tools — and write it up so others can verify it. The lessons and the completion certificate are free. The $49 certification exam is optional.
~1 hour · 8 lessons Free certificate · optional $49 credential No experience needed
Free lessons, free forever
All eight lessons, the practice tools and the advanced OIA field manual are free to read. No card, no trial.
Free completion certificate
Finish the lessons and pass the ten-question final check to earn a free GACS OSINT Fundamentals certificate with a shareable URL.
Optional paid credential
Want proof an employer can check? The $49 GCOA exam is timed and closed-book, and gives you a signed credential. Pay once, no renewal.
What you’ll be able to do after the eight lessons
- Turn a username or phone number into linked accounts — and know when a match is only a coincidence
- Check who registered a domain, when, and what else shares its hosting or analytics ID
- Find where an image or profile photo first appeared with reverse image search
- Look up a crypto wallet on a public blockchain explorer and read what it shows
- Stay legal and safe: what not to collect, and how to research without exposing yourself
- Write a finding as fact, inference and confidence, with evidence someone else can check
The eight lessons, and what each one teaches
This is the whole course, in order. Each lesson is a short read with one takeaway you can use the same day. Work through all eight, pass the ten-question final assessment, and you earn the free completion certificate.
Lesson 1
What OSINT actually is — and what it is not
Public collection plus verification plus a stated confidence level. Drop any of the three and it is just internet searching.
You’ll practise: Separating verified facts from guesses on a real scam report in the public registry.
Lesson 2
Law, ethics and the harm you can cause
Write the question down first. If a piece of data does not help answer it, you should not be keeping it.
You’ll practise: Writing the one question your investigation must answer before you collect anything.
Lesson 3
Setting up a safe research workspace
One clean browser profile, one folder per case, screenshots taken immediately. Everything else is optional.
You’ll practise: Setting up a clean browser profile and a dated case folder.
Lesson 4
Search like an analyst — operators and pivots
Every finding is a new search term. Work the pivots until they stop producing new material.
You’ll practise: Search operators (site:, quotes, filetype:) and pivoting from one finding to the next.
Lesson 5
People, usernames and phone numbers
One matching name is a coincidence. Two independent identifiers is a lead. Nothing is a fact until you can show where it came from.
You’ll practise: Checking a handle with the social account scanner and corroborating it with a second identifier.
Lesson 6
Companies, domains and money trails
Registration dates, shared addresses and reused identifiers expose networks faster than any single document does.
You’ll practise: Domain age and hosting with the website checker, and tracing a payment address with the wallet checker.
Lesson 7
Verifying images, video and social accounts
Provenance beats forensics. The strongest question about any image or account is always: where did it first appear?
You’ll practise: Reverse image search and finding where a photo or account first appeared.
Lesson 8
Recording evidence and writing the finding
Fact, inference, confidence — in that order, every time. Undated screenshots without a URL are not evidence.
You’ll practise: Writing a finding as fact, inference and confidence, with dated, URL-stamped evidence.
Want a credential an employer can check?
The course stays free, forever. If you want proof you can put on a CV, sit the optional certification exam. It is issued as the GACS Certified OSINT Analyst.
What the exam tests
- Search operators
- WHOIS, passive DNS & certificate logs
- EXIF, geolocation & chronolocation
- Username corroboration
- Source reliability & bias
- Hashing & chain of custody
- OPSEC & legal limits
- Company registries & shell companies
- Blockchain explorers
- Reporting uncertain findings
- 40 questions, 45 minutes, 80% to pass
- 3 attempts included
- Sealed, printable certificate
- Cum Laude honours for a 100% first attempt
- Permanent public verification page
Where your $49 goes: the certificate fee keeps the courses, scam checks, and scam registry free for everyone, so GACS can keep protecting people from fraud.
One-time payment. No membership, no renewal fee.
Free, Certified or Diploma — what’s the difference?
The lessons are free forever. Pay only if you want a credential someone else can check, or the advanced diploma with a graded capstone.
Step 1 · Free
OSINT Fundamentals course
8 short lessons: legal limits, a safe workspace, search pivots, usernames and phone numbers, domains and money trails, image and account verification, writing the finding.
Start free lesson 1Step 3 · One-time $599
OIA Diploma — OSINT Intelligence Analyst
A 7-chapter field manual (doctrine, OPSEC, SOCMINT, GEOINT, dark-web tradecraft, infrastructure attribution) ending in a graded capstone: a Target Package and Attribution Brief.
See the OIA diploma — $599
| What you get | Free course | Certified ($49) | OIA Diploma ($599) |
|---|---|---|---|
| 8 OSINT lessons + practice on live tools | |||
| 10-question final check + completion certificate | |||
| Timed, closed-book exam | 40 questions · 45 min · 80% to pass | Diploma final exam | |
| Attempts included | — | 3 | Included |
| Signed, printable credential with public verification page | |||
| Cum Laude distinction for a first-attempt 100% within time | |||
| LinkedIn badge page with seal | |||
| 7-chapter advanced field manual (SOCMINT, GEOINT, attribution) | Read free | Read free | |
| Graded capstone: Target Package & Attribution Brief | |||
| Price | Free | $49 once | $599 once |
Get new case files and course updates by email
Each week we send the newest verified scam reports as short case files — real investigations you can practise the syllabus on — plus a note whenever a new module or exam version goes live. Free, and you can unsubscribe in one click.
Who this OSINT course is for
Complete beginners
You have never run an investigation and want a structured path instead of a pile of YouTube videos. Start at module one.
Fraud and compliance analysts
You already review alerts and want the attribution and evidence modules so your write-ups hold up under challenge.
Volunteers and scam hunters
You already help people who have been scammed and want to work to a standard, and to file reports others can verify.
Frequently asked questions
Is the OSINT certification really free?
Yes. Every lesson, the study book, the practice questions and the final exam are free to read and free to take. There is no trial and no card required. The only paid option is the separate $49 certification exam, for people who want a timed, verifiable credential — you never need it to finish the course.
How long does the free OSINT course take?
The core course is eight lessons and takes about an hour end to end, including the ten-question final assessment. If you also work through the free study book and the wider free certification exams, budget several more hours — but nothing beyond the eight lessons is required to finish and earn the completion certificate.
Do I need experience to start OSINT training?
No. The first lesson assumes zero background and starts with what open-source intelligence is, what is legal to collect, and where beginners get themselves into trouble. Analysts already working in fraud or compliance usually skip straight to the attribution and reporting lessons.
What does the OSINT certificate actually prove?
It shows you completed all eight lessons and passed the ten-question final assessment. Each certificate has a public verification URL an employer can open. It is an independent training completion certificate.
Is this OSINT certification recognised by employers?
It is recognised the way any independent training certificate is: as evidence you studied the material. It carries most weight when you attach work of your own — a written investigation using the reporting method taught in lesson eight.
What tools does the course use?
Free and public ones only — search operators, WHOIS and DNS lookups, reverse image search, blockchain explorers, and the GACS website checker, wallet checker and social scanner. Nothing in the syllabus requires a paid subscription.
Can I put the certificate on LinkedIn?
Yes. Every certificate has a shareable public URL you can add to the licences and certifications section, and the verification page shows the issue date and the exam version you passed.
What's the difference between the free certificate and the $49 certification?
The free completion certificate shows you finished the eight lessons and passed a ten-question check. The $49 GACS Certified OSINT Analyst (GCOA) exam is a timed, closed-book test — 40 questions in 45 minutes, 80% to pass, three attempts — covering search operators, WHOIS and passive DNS, image geolocation, username corroboration, chain of custody and reporting confidence. Passing gives a signed, printable credential with a public verification page and a LinkedIn badge. It is a one-time payment with no renewal fee.
Who is the OIA diploma for?
The OIA (OSINT Intelligence Analyst) diploma is for people who want to go beyond fundamentals: fraud investigators, analysts and serious volunteers. It adds a seven-chapter field manual on doctrine, OPSEC, social-media intelligence, geolocation, dark-web tradecraft and infrastructure attribution, and ends in a graded capstone — a Target Package and Attribution Brief. It costs $599, paid once.
Practise on live cases
The fastest way to learn open-source intelligence is to run the workflow on something real. These tools are free and are the same ones used in the lessons.
- Website checker — domain age, hosting and risk signals for any site.
- Social account scanner — check a profile before you deal with it.
- Public scam registry — thousands of verified reports to study.
- Free AML course — the money-laundering companion to this syllabus.
Start in 30 seconds
No signup required to read the material. Create a free account only when you’re ready to take the exam and earn your certificate.
Hiring for a fraud role rather than an intelligence one? The free fraud analyst certification pairs this course with AML training and compares it honestly against a paid credential like the CFE.
Want a credential an employer can check?
The course stays free, forever. If you want proof you can put on a CV, sit the optional certification exam. It is issued as the GACS Certified OSINT Analyst.
What the exam tests
- Search operators
- WHOIS, passive DNS & certificate logs
- EXIF, geolocation & chronolocation
- Username corroboration
- Source reliability & bias
- Hashing & chain of custody
- OPSEC & legal limits
- Company registries & shell companies
- Blockchain explorers
- Reporting uncertain findings
- 40 questions, 45 minutes, 80% to pass
- 3 attempts included
- Sealed, printable certificate
- Cum Laude honours for a 100% first attempt
- Permanent public verification page
Where your $49 goes: the certificate fee keeps the courses, scam checks, and scam registry free for everyone, so GACS can keep protecting people from fraud.
One-time payment. No membership, no renewal fee.
Authoritative sources
Independent primary sources used to check and corroborate the guidance on this page.
FBI Internet Crime Complaint Center (IC3)Official US channel for reporting internet-enabled fraud and cybercrime.
US Federal Trade Commission — ReportFraudConsumer fraud reporting and published enforcement data.
UK Report FraudUK national reporting centre for fraud and cybercrime.
Canadian Anti-Fraud CentreCanada's central repository for fraud reports and scam alerts.