Counterfeit COVID Vaccine Card Market Takes Hold in the U.S. and Europe

As authorities struggle to balance the commercial reopenings with public health concerns, business owners, local administrators, and public health officials are turning to proof of COVID-19 vaccination as a method for filtering access to goods and services. In some major cities around the U.S., access to indoor spaces is now contingent on a person’s ability to produce a CDC vaccine card. This development has led to dramatic increases in activity in English-language illicit communities from threat actors looking to sell, buy, or produce proof of vaccination certificates. 

Flashpoint analysts are seeing the English-language counterfeit COVID-19 certificate market follow similar patterns as the Russian-language market, where offerings of COVID-19 documentation rose sharply after major cities announced vaccine mandates earlier this summer. 

Flashpoint analysts have found several mentions of threat actors on illicit communities selling vaccination certificates or other COVID-related public health documentation, which they claim will be valid in the U.S. and Europe. These certificates are mostly advertised in underground communities, chat rooms, and other closed channels where advertisers can reach their customer bases. 

On July 14, a threat actor operating under the alias “Freedom” claimed they could provide vaccine cards for interested buyers on a Telegram channel focused on protesting public health restrictions. The threat actor further claimed they had health professionals and doctors working with them to falsify this documentation—a likely embellishment the threat actor uses for advertising purposes. Flashpoint analysts believe this advertisement was placed in an anti-COVID lockdown channel in order to target customers who are skeptical of vaccines and lockdowns in the U.S. Another threat actor operating under the alias “BigDOCS” advertised COVID-negative letters allegedly valid in the U.S. for $40 (USD). 

Flashpoint analysts have also observed the sale of vaccine cards persisting on chat services such as Telegram. Threat actors specializing in the sale of counterfeit documentation have continued adding COVID-19 vaccine cards to their product list. A threat actor operating under the alias “R” on the Telegram channel “World of Style” is offering a vaccine card for $100, with an overnight shipping option for $125.

Flashpoint also found similar advertisements for COVID-19 vaccine certificates available for the EU market. On the illicit forum Nulled, a threat actor operating under the alias “covido” was offering vaccine certificates valid in the EU. The certificates were offered for $450. The threat actor advertising the certificate mentioned that they are also a vaccine skeptic who doesn’t trust the government and doesn’t want to be forced to take the vaccine. 

On the Telegram channel “Coronavirus Vaccine Passport And Certificate,” a threat actor operating under the alias “Coronavirus Vaccine Passport And Certificate,” advertises COVID-19 vaccine cards valid in the U.S. and posts images of the cards they are selling. 

The threat actor posted the following images of an alleged completed vaccine card they are selling, with the name of the client and other PII redacted. The threat actor advertised they can falsify documentation for both a two-shot Pfizer vaccine and a single shot Johnson & Johnson vaccine. 

Additionally, Flashpoint analysts have observed threat actors sharing free methods on how to make their own COVID-19 vaccine cards as well as free CDC templates for threat actors to print on their own. 

Given the increased scrutiny from the U.S. government on the sale and distribution of fake COVID-19 vaccine cards, Flashpoint analysts have observed a rise in threat actors sharing methods on how to make their own vaccine card. On August 14, a threat actor operating under the alias “CrackWhore” posted on the English-and Russian-language illicit forum Raid Forums sharing a method on how one can make their own vaccine card. The threat actor also provided a CDC template for others to print cards. The threat actor’s method has received positive reviews from other threat actors operating on the forum. 

Furthermore, Flashpoint analysts have observed threat actors on the image board 4chan sharing CDC COVID-19 vaccine templates, which can be accessed for free through open-web sources. This template can be seen below with redactions from Flashpoint analysts to prevent reproduction. 

Sign up for a free trial to see firsthand how Flashpoint is actively tracking the emerging sale of counterfeit COVID-19 documentation in illicit markets. Discover how you can level up your cyber vigilance and response with actionable threat intelligence from Flashpoint.