Some vaccine pass users may be having their identities stolen and sold to unvaccinated people as part of an emerging black market.

Efforts to bypass the system used to exclude unvaccinated people from many public spaces may be finding success due to an inherent flaw in the system.

Stuff obtained a vaccine pass via an online platform, in exchange for $20 worth of the cryptocurrency Dogecoin.

It is a legitimate pass, belonging to a vaccinated person. Scanning it with the Ministry of Health’s (MOH) official app shows it is valid, meaning it could be used to gain entry to any place or service requiring vaccination.

Using, or selling, such a pass is illegal and constitutes identity fraud. However, there are few practical barriers to using one.

 

Because it is a valid pass, the only way to expose the fraud would be by manually checking the person's identity through a form of photo ID. Doing so is not legally required, and – anecdotally speaking – happens infrequently. A business would have no power to detain someone found to be using a fraudulent pass.

The police have the power to do spot checks of vaccine passes, which serves as the primary deterrent.

The scale of the black market is unclear, given how recently it has emerged. The service used by Stuff says it has a backlog of requests, and already has hundreds of subscribers to its online offering.

Anonymous reviews posted on its site from purported users boast of its effectiveness: “Pass works beautifully at restaurants and bars,” one user wrote. “This pass works great for anywhere that scans with the MOH pass checker app like restaurants and cafes,” wrote another.

The service says it will buy legitimate vaccine passes for up to $75. It also recommends a way of harvesting legitimate certificates from unwitting users.

It is unclear if the pass obtained by Stuff was voluntarily sold to the service or harvested (attempts to locate its owner were unsuccessful).

The process

Buying a pass is easy if you know where to look.

The service is actively advertised in online spaces frequented by people who are anti-vaccination.

When you request a pass, you are asked for your age and sex. You can buy either a legitimate pass belonging to someone else or a custom pass with your own name and birthdate. The latter, unlike the former, cannot be scanned by the Ministry of Health app, but would not show up as fraudulent, either.

READ MORE

• Black market sales of vaccination passes reported to police
• Jacinda Ardern says vaccine passes don't need to be scanned, Ministry of Health says they do
• Police ready to help businesses enforce vaccine pass - Government
• Thousands of returnees vaccinated abroad still stuck without vaccine pass

The service says it has passes available for both men and women in nearly all age groups. You can select the format you’d like – iPhone, Android, or a paper version.

Both the online platform and the cryptocurrency it trades in are anonymous and largely unregulated, meaning it is difficult, if not impossible, to determine who is behind the black market

The ease with which the vaccine pass system can be exploited raises questions about the system’s usefulness.

“I believe that it is very likely that every unvaccinated person who wants a vaccine certificate has been able to get one,” says Dr Andrew Chen, a research fellow at Koi Tū: The Centre for Informed Futures.

“We don't have firm population-level data for this, but the widespread anecdotes would indicate that it is relatively easy to get one if you want one.

“It is particularly concerning that groups like the one selling passes online have resorted to stealing other people's legitimate credentials, rather than asking for vaccinated people to sell or share them voluntarily.”

By their very nature, any digital identity document has privacy issues, Chen says. While Covid-19 was a good justification for having them – and New Zealand’s approach to them was as good, or better, than many other jurisdictions – their value is diminished if they are easily exploited, he says.

“If the effectiveness of the passes is compromised because unvaccinated people can enter the same spaces as vaccinated people, then that also compromises the justification for having the passes.

“At that point we are just getting the social and ethical harms without the benefits.”

Fixes to the problem would likely face either technical or legal constraints.

One method would be for the ministry to keep a list of passes known to be used fraudulently and refuse to verify them through the app. But, as Chen says, doing so would be “a game of whack-a-mole”.

Another would be to incorporate photographs into the vaccine pass system, but doing so would likely be complex and time-consuming to set up.

Questions to the police about its enforcement actions relating to misused passes were referred to the Ministry of Health.

A spokesperson said fraudulent use or misuse of vaccine passes was taken “very seriously”.

“Police have confirmed that complaints regarding the misuse/fraudulent use of vaccine passes will be dealt with on a case-by-case basis and that they’ll work alongside other key agencies including the Ministry of Health to investigate reported breaches,” they said.

“Police are able to enforce the legitimate use of the [passes] and can ask to check that a person’s ID matches their pass or make spot checks at venues.”