Forge402 Verified: Site, Creator and Artwork Verification on BSV

ForgeChainOS whitepaper. Draft for public review, October 2026. Status: scoped, not yet built.

Abstract

Platforms verify accounts on their own turf. Forge402 Verified lets a business, a creator or an artist prove three things on the open web, permanently, and to any person or AI agent that checks: that their domain is really them, that their accounts and wallet are really theirs, and, for artists, that a given work is really theirs. Every record and every status change is anchored on the BSV blockchain. Nobody, including us, can quietly edit that history.

1. The problem

Impersonation is the most-reported fraud category in the United States. The FTC's 2025 data puts reported fraud losses at about $16 billion, a record, with imposter scams at about $3.5 billion and business impersonation alone at about $1 billion. Industry estimates put roughly a fifth of digital ad spend lost to fraud, and bots now make up more than half of web traffic, much of it malicious (Imperva, 2026).

For creators the problem is personal. Models and talent fight fake accounts. Photographers and painters see their work copied and resold. Buyers can't easily tell an original from a reproduction, or the real artist's page from a clone.

2. What exists today

• Platform checkmarks (X, Meta, Google Business). These verify an account inside one platform. They mean nothing off-platform, cost a monthly fee, and the platform can revoke them.
• BIMI with VMC/CMC certificates. This is the closest open-web analog: a logo and checkmark in Gmail. A VMC costs about $1,350–1,400 a year retail and needs a registered trademark.
• EV SSL. This is the cautionary tale. Browsers removed the identity indicator in 2019 because users ignored it. A badge that nobody's software checks is worth nothing.
• Reputation lists (Safe Browsing, ScamAdviser, Trustpilot). These rate a site after harm has happened, by crowd or crawl.
• Media provenance (C2PA Content Credentials) and art registries (Verisart, Artory, Tagsmart, Art Loss Register).

None of these gives a portable, owner-controlled, publicly verifiable proof that "this domain is this business" that both humans and agents can read, that isn't owned by a platform, and that has a public revocation trail.

3. How it works

A verified site publishes a small signed record, /.well-known/forge402.json, inside its ForgeTransducer agent card. The owner's key signs it and it is anchored on BSV. Each status change (issued, renewed, downgraded, revoked) becomes a new anchored record. Anyone can check it three ways:

1. On a public verification page.
2. By reading the card, which AI agents do automatically.
3. By looking up the chain transaction, which anyone can do, forever.

Tiers

A score from 0 to 100 is built only from signals anyone can verify: tier, email authentication, TLS age, anchor freshness, Transducer completeness, revocation history and lookalike exposure. There are no crowd stars and no paid boosts.

The mark is our own seal. It never imitates a platform's checkmark.

4. Where it fits, honestly

• Impersonation and clone sites (strong fit). Put one link in every bio, invoice, email footer, or QR code on a storefront or gallery wall. It opens the verification page. The F3 tier adds lookalike monitoring: new typo-domains and clone pages are flagged to the owner.
• Scams that target customers (strong fit). Customers learn to check the seal before they pay.
• Creators: models, talent, photographers and artists (strong fit). Verified creator links tie a person's real domain, socials and wallet together, so fakes stand out.
• Click fraud (narrow fit). Verifying a site doesn't stop bots clicking ads. What we can offer is verified-publisher attestation and reporting that separates human from agent traffic on a client's own campaigns. We sell that as a report, not a cure.
• Personal identity theft (out of scope). That is regulated KYC territory.

5. Hacked wallets: what a record can and can't do

Tracing. Stolen coins on a public ledger can always be followed, token or not.

What Forge402 adds is proof of ownership before the theft. An F2 record anchored months earlier says that a verified business controlled a given address as of a given date. That evidence is signed and timestamped by an independent issuer. Police, exchange compliance desks, insurers and courts ask for exactly that.

BSV has a consensus-level Digital Asset Recovery process. Through the network's Alert System, a court order can freeze named coins on nodes and reassign them. A pre-existing, chain-anchored ownership record is strong supporting evidence for such an order.

Limits. Recovery is a court process, not a button. Speed matters: once funds leave BSV through an exchange, the chase moves to that exchange.

Design rules. - The key that signs "this is the real wallet" never lives in that wallet. - A compromise report becomes a public revocation ("payments to this address after time T are not ours"), visible at once to customers and agents. - An optional Recovery Assist service watches the stolen coins and assembles an evidence pack.

6. For artists: the Forge402 certificate of authenticity

This extends ForgeArt. The same three proofs apply to a work instead of a domain:

1. Verified artist. The artist's domain, socials and wallet are proven to belong to the artist.
2. A certificate for each work. It records the title, artist, date, medium, dimensions, edition and an image fingerprint. It also includes a surface fingerprint: hashed macro photographs of brushwork, grain or print detail. The artist signs it, the issuer co-signs it, and it is anchored on chain.
3. Physical binding. A chain proves the record, not that the object in front of you is the one recorded. So each work carries a tamper-evident NFC/QR label that opens its certificate, and the surface-fingerprint photos let anyone or any appraiser compare. A forger can copy a QR code but can't copy the paint.
4. Provenance. Each sale adds a transfer record, building an append-only ownership history. Resale royalties follow ForgeArt terms.
5. Stolen-work flag. An owner can mark a work stolen. Anyone who scans its tag sees it, and an evidence pack is ready for police and insurers.

The difference from existing registries: the record is artist-owned and sovereign, no platform holds it, it costs little enough per work for a working artist, and it uses the same seal as the artist's verified site. One identity covers every work.

7. Proposed pricing

• F1 Domain: $49 a year, or included with a ForgeTransducer site.
• F2 Business / Creator: $199 a year for a business. Creator rate: $49 a year.
• F3 Brand with lookalike watch: $499 a year.
• Artwork certificate: $9 per work digital, or $19 with a tamper-evident NFC tag. Transfers $5.
• Lookup API: single lookups are free. Bulk lookups for marketplaces, ad networks and payment processors are paid per query over x402.

Pricing is a proposal and may change before launch.

8. Status and roadmap

Forge402 Verified is scoped and not yet live. The first sites to be verified will be ForgeChainOS's own sites and our launch artist clients. The build order is:

1. The record format and verification page.
2. F1 automation.
3. The score engine.
4. Human-reviewed F2.
5. Lookalike monitoring.
6. The bulk API.

Terms of service and liability language will be reviewed by counsel before F2 launches. Nothing in this paper is legal advice.

9. In one line

Forge402 lets a business or an artist prove, on the open web and to any agent, that it is really them, and it makes the imposter the one who has to explain the missing seal.

Sources: FTC Consumer Sentinel 2025 data (released 2026); Imperva Bad Bot Report 2026; BIMI Group and issuer pricing (DigiCert, Sectigo); BSV Blockchain Digital Asset Recovery documentation. Related: ForgeArt · ForgeTransducer.

© 2026 ForgeChainOS. All rights reserved.