Shopify store sells fake COVID vaccine certs for $20

Scammers lost little time setting up online stores to sell fraudulent COVID-19 vaccination certificates after the first jabs started to be used in the US, says DomainTools.

The cybersecurity specialist identified the first Shopify-backed store selling fake certificates on January 31, a few weeks after the US immunisation programme got underway. The covid-19vaccinationcards.com storefront redirected to vaccination-cards.com and was selling cards for $20 apiece, or four for $60.

DomainTools’ senior security researcher Chad Anderson writes in a blog post that the cards carried the logo of the US Center for Disease Control and Prevention (CDC).

“Though selling a printed card is not necessarily illegal, the pricing, logo, and cardstock of these “vaccination records” demonstrate a level of intent to pass as legitimate cards from the CDC,” according to Anderson, who says another recent example of the scam was the sale of UK-themed cards on eBay.

“The DomainTools Research team has reached out to Shopify regarding this site and is monitoring for similar instances of COVID-19 vaccine cards,” he adds.

With no nationwide, or even international, database for verifying vaccinations in place, paper record cards are currently the only way to tell if an individual has been vaccinated, but are easy to forge.

Depth Perception: An Important Authentication Tool for Security Features

DomainTools notes that social media is flooded with people proudly displaying their vaccination certificates in the US, giving “would-be fraudsters a chance to copy details such as batch numbers and other information”, and the government is recommending these images be taken down.

What is needed is a set of standards for a digital certificate that could be used to allow public access to venues, or to ease international travel, according to proponents of ‘vaccine passport’ schemes. Greece, Israel, the UK and the EU have all started either introducing such a certificate or are considering doing so.

Singapore meanwhile has said there needs to be a secure, mutually recognised certification scheme, and that using digital rather than printed certificates could help to ensure authenticity. Meanwhile, the International Air Transport Association (IATA) has said it plans to unveil a digital COVID-19 Travel Pass within the next few weeks.

The pass takes the form of an app that verifies a passenger has had the tests or vaccines required to enter a country, and aims to revitalise the beleaguered travel industry.