It will cost Singaporeans about S$400 to “prove” they are vaccinated without actually being jabbed. For Thais, forged certificates are being offered for about THB2,500. They’ll set Malaysians back around RM250.
As nations including Singapore and its neighbors seek a path to pandemic endgame through vaccine mandates, the black market threatens to undercut those efforts with bogus certificates being marketed in growing numbers online, according to Israeli IT security firm Check Point.
“The growth of the black market for fake vaccination cards has been exponential,” the firm said. “Our expectation is that the black market for fake coronavirus vaccination cards will continue to thrive as more policy requiring vaccination proof gets rolled out.”
Instead of getting vaccinated at no cost, Singaporeans are being offered the kind of counterfeit certificate that would enable them to dine out, travel, and more without being protected against COVID-19 for EUR250 (US$300) in cryptocurrency.
The sellers, mostly in Europe, may claim the certificates are “authentic,” “registered” or emailed by a “doctor.” But these are just keywords for their sham documents.
Fake Singapore vaccine certificates, also called passports, are the costliest of documents for 28 nations found for sale in illicit corners of the internet, according to Check Point. And selling these counterfeits is hot – the 1,000 sellers of a month ago are now 10,000, it found.
The GovTech agency, which issues the documents, could not be reached for comment by publication time.
As vaccine distribution ramped up earlier this year, the black market has shifted from bootleg vaccines and phony test results to certificates, with more than 1,200 for sale on the dark web as of March. Since then, dealers have migrated to Telegram, a safe haven for the conspiracy-minded where forgers can anonymously access tens of thousands of subscribers.
“Over the past nine months, we witnessed a mass consumerization of the black market by a macro-shift of the black market to Telegram,” said Check Point’s head of product vulnerabilities research, Oded Vanunu. Check Point is one of Israel’s largest companies and has close ties with that nation’s intelligence services.
Outside Singapore, Thailand and Malaysia, fake certificates are also for sale to Indonesians for US$80 to US$100, among many other locales worldwide. Check Point said the least expensive of those found were for India, at just US$75.
A cursory search of Telegram found multiple channels offering fake certificates. While those in Europe were much larger, a Malaysian channel with nearly 5,000 members advertised fake “digital certificates” for US$60.
These are not necessarily domestic operations – those selling Singaporean or Thai docs could be operating anywhere. While no Thai-language channels could be readily found, Check Point said it found Thai docs including “registered vax certificate vax cards and vax passports” for sale in a group with at least 6,000 members.
The number of subscribers and sellers in such channels has grown nearly 10 times since a broader vaccine mandate was announced in the United States last week, according to the firm.
Still, there is no data available quantifying sales. And what is being advertised doesn’t necessarily square up with the real world. For example, Thailand does not yet have vaccine passports per se, but rather certificates intended for international use. And Indonesia and Malaysia have introduced digital certificates for which no physical document exists. In the Malaysian Telegram channel, a seller offering bogus docs claimed to be able to hack government systems to obtain digital certificates.
But Check Point did share images showing a conversation purportedly with a seller offering a Singaporean certificate. In their chat, the seller assures the buyer that he or she would be “fit to travel, work, shop, and many more” and that all of the buyer’s details “will reflect as fully vaccinated once checked.”
Late last month, Singapore immigration began to recognize vaccine certificates for travelers. Locals who were fully vaccinated were also allowed to dine out and attend larger gatherings by showing proof of vaccination status on the TraceTogether government app. A small but vocal contingent of anti-vaxxers has decried the rules as discriminatory.
The fake Singaporean vaccine passports for sale were counterfeits of originals obtained by hackers, Check Point said, without mentioning which database they may have accessed.
The only source for Singaporeans to obtain vaccine certificates is the Notarise government website. After registration, Singaporeans receive certificates by email and the government’s SingPass app.
Fighting back
Two things can help to curtail the fake vaccine card market: cutting demand and improving document security. Greater government cooperation would be the most effective route.
“Countries should cooperate and share info regarding such data and create a secure repository with encryption keys to allow people to roam using legit only certifications and to be able to detect forged and fake ones,” Check Point said.
Here are the vaccination certificates Check Point found for sale online, and their relative costs:
- Australia: US$80
- India: US$75
- Indonesia: US$80-100
- Singapore: US$295
- Thailand: US$80
- Austria: US$176
- Brazil: US$80
- United Emirates: US$200
- Portugal: US$176
- Canada: US$120
- Cyprus: US$176
- Finland: US$176
- France: US$176
- Greece: US$176
- Italy: US$176
- Ireland: US$176
- Latvia: US$176-235
- Lithuania: US$176
- Malta: US$176
- Netherlands: US$176
- Poland: US$176
- Romania: US$176
- Spain: US$176
- Sweden: US$176
- Switzerland: US$176
- United Kingdom: US$118-176
- Ukraine: US$176
- US: US$150-200
Additional writing by Todd Ruiz.
Other stories:
The Online Citizen shuts down ahead of Singapore gov’t deadline
‘He’s illiterate’: Hot mic picks up parliament trash-talking, internet pretty sure who did it (Video)
