Cybercriminals are offering to sell fake Canadian COVID-19 vaccination certificates online

As provinces and employers across Canada increase restrictions on the unvaccinated or introduce vaccine passports, cybercriminals are attempting tocashinby offering fake vaccination certificates for saleonline.

Sellers are offering phoneyproof-of-vaccination documentsfor several provinces that apparently look just like the real thing. Some of them evenclaim to be able to enter the data from the fake certificates into official government databases.

Prices and promises vary, according to offers viewed by CBC News on platforms like Telegram. One selleris offering fake proof-of-vaccination cards or QR codes for several provinces including Manitoba and B.C. for $200, payable in Bitcoin or Ethereum cryptocurrencies. They promise to deliverthe fake documents within 48 hours by mail or in"just a few hours" if they'rebeing sent electronically.

Just minutes afterCBC News reached out to the seller, they senta picture of an Ontario proof-of-vaccination form that appears to be identical to those being issued by many Ontario vaccination clinics. Photos posted online by the seller of fakeproof-of-vaccination documents for B.C and Manitoba also mirror official documents.

The seller boasted that information on the bogus cards is entered in provincial databases.

Another sellerclaimed to be based in Montreal. His channel, which was being followed by 320,065 subscribers when it was viewed by CBC News, included offers of fake proof-of-vaccination from several jurisdictions around the world and featuredphotos of an Alberta proof-of-vaccination certificate that resembles the real one.

There is no way to know how many fake vaccination documentsare in circulation in Canada.

Provincial health authoritiescall into question sellers' claims that theycan ensure the fake vaccination data is inserted into government databases.

Provinces say they're protecting their data

Marielle Tounsi, senior public affairs officer for British Columbia's ministry of health, said the province has taken steps to protect the integrity of its vaccine card by using QR codes in addition to government-issued photo ID.

"There is a review process to confirm the validity of records that are uploaded online," Tounsi said. "This helps to ensure that only valid records are recorded in the provincial system.

"Each record submission is reviewed and validated by qualified reviewers that verify the information.Any records that require additional validation are escalated for further review. Any suspicious activity from this review is referred to Information Security and would be reported to the appropriate authorities."

Manitoba's health department saysdata must be entered into the provincialPHIMSdatabase by government officials, based on an individual's address and immunization record.Anyone unvaccinatedin Manitoba who enters a space where vaccination is required, or attempts to, can face a fine of$1,296.

Ontario Health Ministry spokesperson Bill Campbell said more than 80 per cent of Ontario residentsover 12 years old already have received two doses and will have access toa secure certificate.

"In addition to the secure watermarked certificate available for download, QR codes will be available in October," said Campbell.

Campbell didn't address the question of whether someone could enter fake vaccination data inthe provincial database. He did point out that providing false or inaccurate information to a business about vaccination status could result in a ticket for $750 or a penalty of up to $100,000 and up to a year in jail.

Cyber security experts say they are seeing a sharp increase in the number of offers of fake vaccine certificatesin places like Telegram and the dark web from people who claimto beable to enter the bogus data into official databases.

Liad Mizrachi, senior researcher with Check Point Software Technologies, looked into some sellers' claimsthat theyhave access to the European Centre for Disease Prevention and Control's website of vaccinated people across Europe and can register their customersthere.

"The sellers then send false documentation from a fake European Centre for Disease Prevention and Control website, which might convince unwitting border officials or venue staff that a person is genuinely registered as fully vaccinated, which is clearly not the case," Mizrachitold CBC News. "Our CPR team discovered this through a URL embedded in a QR code, which shows a link to the fake database."

Mizrachi saidgovernments around the world shouldcome togetheron aunified global database to verify legitimate vaccinationcertificates.

"Not only do unvaccinated people have easy and cheap access to forged documents, but those documents now appear to link to credible-looking websites, making it even easier for fraudsters to slip through the net," he said.

WATCH: Expert warns of a "dramatic uptick" in websites offering fake vaccination documents

Number of sites on the dark web offering fake vaccine passports for sale is rising, says expert

3 years ago

Duration 1:03

Robert Falzon, head engineer at Check Point Software Technologies Canada, says there has been a 'dramatic uptick' in sites selling fake vaccine documentation

Robert Falzon, head of engineering at Check Point Software's Canadian office, said the company first saw offers to sell fake vaccination certificates emergein the United States but has since seen"a dramatic uptick"in such offersin Canada.

He said Canada's decentralizedapproach witheach province runningits own proof-of-vaccination system has created an opening for the sellers.

"From a healthcare perspective, we've seen a sort of patchwork approach to how each of the provinces are going to address it," he said. "And because of that, again, it's created an opening ... for various different groups across Canada to set up and specialize."

Falzon said sellers on the dark web want to maintain their reputations for delivering on the promises they make.

"The dark web marketplaces, they're just like a regular store in a lot of ways. They have reviews and they're also trying to continue to do business for other things," he said. "So you'll find people leaving reviews for drug purchases and weapons purchases and saying this person was a wonderful seller and so forth."

Using fake documents as bait

Derek Manky is the Vancouver-based chief of insights and global threat alliances at Fortinet's FortiGuard Labs, a cybersecurity firm. Hesaid his company is also seeing attempts on the dark web to lure people with offers of fake vaccination documents, targeting different regions in different languages.

"What we're seeing on these marketplaces are a variety of services, including everything from as cheap as $5 for just selling essentially stock paper. So, fake blank vaccine passports in the U.S., as an example," he said.

"We're seeing things in Canada targeted for about $50 for harvested or stolen QR codes with people's real identity on them, saying, 'We'll give you this for cheap for $50, but you have to create your own fake ID when you're going in to verify.'"

WATCH: Expert warns of 'nefarious sites' luring the unwary with fake vaccination documents

Canadians should take care when visiting unknown online sites or links, says expert

3 years ago

Duration 0:57

Cyber security expert Derek Manky says some sites are used to gather personal information and it's important for Canadians to have safeguards in place when coming across unknown sites or links.

Manky said his company has seen fakedouble-dose vaccine documents beingofferedin Canada at prices ashigh as $1,000 by sellers who claimthe data will be entered into a national database.

Manky said cybercriminals should never be trusted and the risks involved in trying to buy fake vaccination certificatesonline are high.

"These are nefarious sites," Manky told CBC News. "They're phishing for information. They're trying to infect you with pieces of malware so they can hold you for ransom, as an example. It can quickly spiral out of control."

Police and health officials have reported very few cases of Canadians being caught with fake vaccination documents.

Jeff Thomson, senior RCMP intelligence analyst at the Canadian Anti-Fraud Centre, said the centre has received just four reports about false vaccination documents since July 1 one anonymous report about a website selling fake certificates, one about fake certificates being sold on Instagram and Snapchat, one about a website selling vaccine and mask exemption paperwork and one case of a person approached on Facebook by someone with the same name asking if they were willing to sell their vaccination QR code.

If someone paid for a fake vaccination certificate and didn't receive one, they would be unlikely to file a complaint with the anti-fraud centre, Thomson said.

Tammy Jarbeau, senior media relations adviser for Health Canada and the Public Health Agency of Canada (PHAC), said thatas of Sept. 14, seven fines have been issued for falsified or fraudulent COVID-19 test results and two fines have beenissued for suspected falsified or fraudulentvaccination documentspresented at a point of entry to Canada.

"In addition, there are many cases that are still under investigation and are awaiting outcome," Jarbeau wrote. "PHAC may also refer a case to police in the jurisdiction involved, with regard to potential criminal charges."

Jarbeau said fines have been issued in British Columbia and Ontario for falsified documents and referrals have been made to police in Ontario and Alberta.

Elizabeth Thompson can be reached at elizabeth.thompson@cbc.ca