Booming market for fake Covid-19 vaccine passports sparks alarm

Bogus coronavirus inoculation documents are a fast-growing scam, say cyber-security experts

A person using a card to pay online. Getty Images

Fake coronavirus vaccine passports are being sold online cheaply in a fast-growing scam that has alarmed authorities as countries rely on the documents to revive travel and their economies, cyber security experts said.

From Iceland to Israel, countries have started to lift lockdown restrictions for people who can prove they have been vaccinated.

"People are trying to circumvent that by creating false documents, essentially putting the lives of others at risk," Beenu Arora, founder of cyber intelligence firm Cyble, told the Thomson Reuters Foundation.

"We've seen hundreds of websites on the dark web where these documents are being sold ... at the price of peanuts."

The dark web is a part of the internet that lies beyond the reach of search engines, where users are largely anonymous and mainly pay with cryptocurrencies such as bitcoin.

Fake vaccination papers can be bought for as little as $12, Mr Arora said.

He said the number of listings had sharply risen since they started appearing in late February.

Oded Vanunu of cyber-security company Check Point said researchers at the company had found many dark web advertisements offering documents purportedly issued in the US, Russia and other countries.

"There's a big demand for it," Mr Vanunu said.

Forgeries have also appeared on regular websites and e-commerce platforms, said Chad Anderson, a senior security researcher at online threat intelligence company DomainTools.

Last week, 45 attorneys general from the US signed a letter calling on the heads of Twitter, eBay and Shopify to stop their platforms being used to sell fraudulent Covid-19 vaccine cards.

"The false and deceptive marketing and sales of fake Covid vaccine cards threatens the health of our communities, slows progress in getting our residents protected from the virus, and are a violation of the laws of many states," the letter said.

E-commerce company eBay said it was taking significant measures to block or quickly remove items that made false health claims including vaccine cards.

Days earlier, the FBI urged people not to post photos of their vaccination cards on social media because the information could be used by scammers to forge documents.

Mr Anderson said forging paper documents had become "so easy".

"It's trivial, especially with the editing tools that we have today," he said.

Mr Vanunu said that to make forgery more difficult, vaccination cards should be digitally signed with encrypted keys using a QR code system similar to that adopted in Israel.

Once scanned, the codes would reveal vaccine information and the name of the holder, to be checked against identity documents.

But to work for international travel, such a system would require countries to share data, Mr Vanunu said.

China, Bahrain and a few other nations have already introduced vaccine passports, with South Korea and the EU announcing plans for digital documents.

But the concept has faced strong opposition in other countries, including Britain, where more than 70 members of Parliament described the idea as "divisive and discriminatory".