Fake COVID-19 vaccination cards are easy to acquire for anyone with a smartphone. Although counterfeits have long been accessible on the dark web, until now they’ve only been available to those willing to install complicated encryption software to make transactions on shady markets. 

Today, phony vaccination cards are easy to find and cheap to acquire for anyone with a Telegram messaging app account and a little cryptocurrency. The cards typically cost about $100 each, according to new research from Check Point, a Silicon Valley-based cybersecurity firm. 

There seems to be plenty of interest. The number of followers of Telegram groups offering vaccination credentials has soared 566% since early 2021. The number of fake vaccination card vendors on Telegram and WhatsApp jumped 257%. Over 2,500 Telegram groups now selling fake vaccine cards have over 100,000 followers, and some groups are approaching half a million.

• You’ve been vaccinated. So what should you do with your vaccine card?

Sellers who once confined themselves to the dark web also are migrating to mainstream messaging apps like Telegram, WhatsApp, Wickr and Jabber because of the apps’ ease of use, said Check Point researcher Oded Vanunu. “The dark web is clunky and weird,” he said. “It’s not where most of your customers are.”

Although new vendors of fake COVID-19 certificates still accept cryptocurrencies like Bitcoin and Monero, unlike their dark web counterparts they also accept regular monetary payments using common apps like PayPal. Gift cards from eBay, Steam and Amazon are also being accepted.

According to Check Point, there are two distinct consumer profiles among those who buy a fake vaccination card: people who don’t want the vaccine and those who can’t get the vaccine. “People and products need to travel,” Vanunu said. “As [the economy] gets going again, there’s going to be demand for the vaccine. The apps are filling a market need.”

Scammers also have been found selling bogus COVID-19 vaccination cards on eBay, Etsy and Shopify. Counterfeiters used common ecommerce tools to build authentic-looking custom shops and websites. Mainstream web tools have “introduced a new dynamic to society where people can counterfeit immunity and interplace it with a fake card,” said Khalifah Saoud, CEO of Fakespot, a company that uses AI to detect inauthentic content. “It’s a new concept we haven’t seen before.”