There has been a surge in the number of fake vaccine and Covid test certificates for sale ahead of the summer holidays, according to new research.
Vendors selling fraudulent certificates for travel have increased 20-fold, reports cyber security firm Check Point Software Technologies Ltd.
It found that, between early March and May 2021, the number of outlets selling these items on the Dark Web and via the messaging app Telegram had increased from five to more than 100.
Certificates for sale on Telegram include ones for the US (CDC), UK (NHS), Germany, India, Russia and the yellow international certificate of vaccination.
It comes following the government’s announcement that British travellers can use the NHS app as proof of full vaccination when entering other countries which require this to admit arrivals or to excuse them from mandatory pre-departure Covid testing.
The EU is set to launch its own digital travel pass scheme on 1 July, which will provide a free certificate in the form of a QR code on a smartphone or a paper document.
Check Point has warned that, without a global unified approach to verifying the validity of certificates, fragmented rules and ambiguity play into the hands of hackers and fraudsters.
“We urge governments to come together and act quickly to combat the increased sales of fake certificates on Telegram and the Darknet,” said Oded Vanunu, head of products vulnerability research at Check Point Software.
“Without a central system, it becomes much easier for hackers and fraudsters to fall through the cracks.
“Individuals must also remember that a QR code is nothing more than a quick and convenient way to access a website link; a link that in many cases they don’t even see.
“It’s not possible, therefore, to be certain that the resource is legitimate, and an attack could have already started.”
He added that, although the EU says its planned vaccination passports will be safe and secure, “hackers will always evolve to exploit new opportunities, and so we strongly advise everyone to use a mobile security solution that will protect their devices and data against phishing, malicious apps and malware.”
