I've been sent a certificate of compliance with PCI DSS (v. 3.2.1) in the form of a PDF. In it company A (issuer) claims that company B passed a formal assessment and is a level 2 merchant.
What options do I have to be more or less convinced that it was not just mocked up by the company and has actual merit?
I don't have first-hand experience with this, so I welcome a corrected answer from someone who does, but as far as I know, you should be able to find company A somewhere on the QSA list on the PCI council site. Once you've found them, you can contact them to confirm that they did, in fact, issue that certificate to company B.
Odds are good that it's valid, because faking a PCI audit would be easy to catch, but it's always good to confirm if you have any doubts.
The only document to rely on that an entity has been independently assessed as complaint is an Attestation of Compliance, which is a formal document completed by a Qualified Security Assessor (QSA). It is a few pages long. As @Bobson says, you can validate the status of the QSA that carried out an assessment here.
https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors
A 'certificate' is a worthless piece of paper. The PCI SSC has an FAQ describing why.
The only documentation recognized for PCI DSS validation are the official documents from the PCI SSC website. Any other form of certificate or documentation issued for the purposes of illustrating compliance to PCI DSS or any other PCI standard are not authorized or validated, and their use is not acceptable for evidencing compliance.
Also, and I appreciate that this is into the "weeds" of PCI lore, but an assessor is not able to say what "level" a service provider is. The concept of service provider levels is based on brands (i.e. Mastercard and Visa) service provider compliance programs. If the service provider has decided to apply to be on Visa's list, then you can also validate their compliance by looking at the list (although I caution against that because there are some service providers who get one environment or application assessed so they can be on the list but who offer many others that were not assessed) . However, if they say "we are level 2", Visa does not require an on-site assessment (i.e. an audit) of a level 2 service provider, so what you have at best is a self-assessment with some arbitrary "validation" by a QSA. The only evidence of PCI DSS compliance of a third party that shows they have been independently assessed is an "Attestation of Compliance for Onsite Assessments -- Service Providers" - you can see the blank version of this document here:
https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-AOC-ServiceProviders.docx
So if you have a document that looks like this and which is signed by a valid QSA then you have evidence of the service provider's PCI DSS compliance. Anything else is just optimistic paperwork.
Visa has been very firm in saying the only legitimate lookup of a service provider is to check the splisting. They discourage the use of documents claiming PCI compliance, as those cannot be as up-to-date as the online database.
