Building on what Loren said, the "official" IOTA team has rules on activations, but they typically accept the word of the operator for common IOTAs. I have never been challenged on the activations I did for KH2, KH6, VQ9 or my /4 APE operations from NC (Bogue Banks Island, NA-112). They might demand proof from very rare island groups, but not for common ones.
For someone to claim credit for working one of these activations, Loren's right about the QSL cards. They actually don't have to have the IOTA number on them, but they DO have to have the unambiguous name of the island and it has to be part of the printed copy on the card, not hand-written in.