COVID-19 vaccination certificates in the Darkweb
This study exposes a security and public health problem by revealing the availability of fraudulent vaccination certificates, which could undermine pandemic control efforts.
The paper investigates the market for fake COVID-19 vaccination certificates on the darkweb, focusing on the EU Digital Green Certificate, and finds that sellers advertise capabilities to issue forged certificates in most countries, with some examples verified as valid using national mobile apps.
COVID-19 vaccines have been rolled out in many countries and with them a number of vaccination certificates. For instance, the EU is utilizing a digital certificate in the form of a QR-code that is digitally signed and can be easily validated throughout all EU countries. In this paper, we investigate the current state of the COVID-19 vaccination certificate market in the darkweb with a focus on the EU Digital Green Certificate (DGC). We investigate $17$ marketplaces and $10$ vendor shops, that include vaccination certificates in their listings. Our results suggest that a multitude of sellers in both types of platforms are advertising selling capabilities. According to their claims, it is possible to buy fake vaccination certificates issued in most countries worldwide. We demonstrate some examples of such sellers, including how they advertise their capabilities, and the methods they claim to be using to provide their services. We highlight two particular cases of vendor shops, with one of them showing an elevated degree of professionalism, showcasing forged valid certificates, the validity of which we verify using two different national mobile COVID-19 applications.