Cybercriminals Offer to Sell Fake Canadian COVID-19 Vaccination Certificates Online

As provinces and employers across Canada increase restrictions on unvaccinated people or introduce vaccine passports, cybercriminals are trying to profit by offering fake vaccination certificates for sale online.

Vendors are offering fake vaccination proof documents for several provinces that apparently look like the real thing. Some of them even claim to be able to enter data from fake certificates into official government databases.

Prices and promises vary depending on the offers CBC News sees on platforms like Telegram. A seller is offering fake proof of vaccination cards or QR codes for several provinces – including Manitoba and British Columbia – for $ 200, payable in Bitcoin or Ethereum cryptocurrencies. They agree to deliver the false documents within 48 hours by mail or in “just a few hours” if they are sent electronically.

Just minutes after CBC News contacted the seller, the seller sent a photo of an Ontario proof of vaccination form that appears to be identical to those issued by many Ontario vaccination clinics. Photos posted online by the seller of false proof of vaccination documents for British Columbia and Manitoba also reflect the official documents.

The seller bragged that the information about the fake cards got entered into the provincial databases.

Another salesperson claimed to be based in Montreal. His channel, which was followed by 320,065 subscribers when viewed by CBC News, included offers of false proof of vaccination from several jurisdictions around the world – and featured photos of a proof of vaccination certificate from the ‘Alberta that looks like the real one.

There is no way to know how many false vaccination documents are in circulation in Canada.

Provincial health officials are questioning claims by sellers that they can ensure bogus vaccination data gets into government databases.

Provinces say they’re protecting their data

Marielle Tounsi, senior public affairs officer for the British Columbia Ministry of Health, said the province has taken steps to protect the integrity of her immunization card by using QR codes in addition to the coin. government issued photo ID.

“There is a review process to confirm the validity of uploaded recordings online,” Tounsi said. “This helps ensure that only valid records are registered in the provincial system.

“Each record submitted is reviewed and validated by qualified reviewers who verify the information. All records requiring further validation are escalated for further review. Any suspicious activity resulting from this review is referred to Information Security and would be reported to the appropriate authorities. “

The Manitoba Department of Health advises that the data must be entered into the provincial PHIMS database by government officials, based on a person’s address and immunization record. Any unvaccinated person in Manitoba entering or attempting to enter a space where vaccination is required is subject to a fine of $ 1,296.

Ontario Ministry of Health spokesperson Bill Campbell said more than 80 percent of Ontario residents over the age of 12 have already received two doses and will have access to a secure certificate.

“In addition to the secure certificate with watermark available for download, the QR codes will be available in October,” said Campbell.

Campbell did not address whether someone could enter false immunization data into the provincial database. He pointed out that providing false or inaccurate information to a business about vaccination status could result in a ticket of $ 750 or a fine of up to $ 100,000 and up to one year in prison.

Cyber ​​security experts say they’re seeing a surge in fake vaccine certificate offers in places like Telegram and the dark web – from people claiming they can enter fake data into official databases .

Liad Mizrachi, Senior Researcher at Check Point Software Technologies, reviewed claims by some vendors that they have access to the website of the European Center for Vaccine Disease Prevention and Control across Europe and can register their customers there. .

“The sellers then send fake documents from a bogus European Center for Disease Prevention and Control website, which could unintentionally convince border officials or site staff that a person is genuinely registered as fully vaccinated , which is clearly not the case, ”Mizrachi told CBC News. . “Our CPR team discovered this through a URL embedded in a QR code, which shows a link to the fake database.”

Mizrachi said governments around the world should come together on a unified global database to verify legitimate vaccination certificates.

“Not only do unvaccinated people have easy and inexpensive access to forged documents, but these documents now appear to be linked to credible-looking websites, making it even easier for fraudsters to sneak their way onto the net.” , did he declare.

WATCH: Expert warns of ‘dramatic increase’ in websites offering fake immunization documents

Robert Falzon, engineering manager at Check Point Software’s Canadian office, said the company first saw offers to sell bogus vaccination certificates emerge in the United States, but it has since seen ” a dramatic increase “in these offers in Canada.

He said Canada’s decentralized approach – with each province applying its own proof of vaccination system – has created an opening for sellers.

“From a health care perspective, we’ve seen a kind of patchwork approach as to how each of the provinces is going to address this,” he said. “And because of that, again, it created an opening… for various different groups across Canada to establish and specialize.”

Falzon said dark web sellers want to keep their reputation for keeping their promises.

“Dark web markets, they’re like a regular store in a lot of ways. They’ve got reviews and they’re also trying to keep doing business for other things,” he said. “So you’ll find people who leave reviews on drug and gun purchases and say that person was a great salesperson and so on.”

Using false documents as bait

Derek Manky is the Vancouver-based Global Threat Intelligence and Alliance Leader at FortiGuard Labs, a Fortinet cybersecurity company. He said his company is also seeing attempts on the dark web to lure people in with offers of fake vaccination documents, targeting different regions in different languages.

“What we see in these markets are a variety of services, including everything, from $ 5 to basically selling regular paper. So fake blank vaccine passports in the US, for example,” a- he declared.

“We’re seeing things in Canada targeted for around $ 50 for harvested or stolen QR codes with people’s real identities on them, saying, ‘We’ll give you this on the cheap for $ 50, but you have to make your own fake coin. identity when you ‘go to verify.’ “

WATCH: Expert warns of ‘bad sites’ luring unwary people with fake vaccination documents

Manky said his company saw false documents of double-dose vaccines being offered in Canada for prices of up to $ 1,000 by sellers who claimed the data would be entered into a national database.

Manky said cybercriminals should never be trusted and the risks of buying fake vaccination certificates online are high.

“These are infamous sites,” Manky told CBC News. “They phish for information. They try to infect you with malware in order to hold you for ransom, for example. It can quickly get out of hand.”

Police and health officials have reported very few cases of Canadians caught with false immunization documents.

Jeff Thomson, senior RCMP intelligence analyst at the Canadian Anti-Fraud Center, said the center had only received four reports of fake vaccination documents since July 1 – an anonymous report on a website selling fake certificates , one on fake certificates sold on Instagram and Snapchat, one on a website selling vaccine and mask exemption documents and a case of a person approached on Facebook by a person of the same name asking if they were ready to sell his vaccination QR code.

If someone paid for a fake vaccination certificate and did not receive one, they would be unlikely to file a complaint with the anti-fraud center, Thomson said.

Tammy Jarbeau, senior media relations advisor for Health Canada and the Public Health Agency of Canada (PHAC), said as of September 14, seven fines have been issued for falsified COVID-19 test results or fraudulent and that two fines had been imposed for suspected falsified or fraudulent vaccination documents presented at a point of entry into Canada.

“In addition, many cases are still under investigation and await results,” Jarbeau wrote. “PHAC may also refer a case to the police in the relevant jurisdiction, with respect to potential criminal charges. “

Jarbeau said fines have been imposed in British Columbia and Ontario for forged documents and referrals have been made to police in Ontario and Alberta.

Elizabeth Thompson can be reached at [email protected]