“You don’t have to get vaccinated to obtain a certificate,” an anonymous Telegram channel tells its 500 followers. “We’ll do it all for you.”
The channel, called “Getting COVID-certificate,” claims to sell forged vaccination documents, both paper and digital, which will pass for the real thing.
It’s one of many accounts offering falsified vaccination certificates on social media. As proof of vaccination becomes increasingly important in everyday life, these scams started booming in Ukraine a month ago to meet growing demand.
By Sept. 23, all of Ukraine’s 24 oblasts moved from the “green” to the “yellow” adaptive quarantine status, imposing restrictions on dining out, mass gatherings and cultural events. People with proof of vaccination are exempt from these restrictions.
Some people also buy forged vaccination documents to travel abroad. The European Union countries began accepting Ukrainian certificates in August. Other people buy fakes to display at their workplace on news that businesses may be shut down if the majority of their staff is unvaccinated.
“The sale of fake tests and vaccination certificates is turning into a real illegal industry,” Mykhailo Radutskyy, the chairperson of the parliamentary committee on health, said on Facebook on Sept. 8.
The problem is serious enough to have drawn the attention of the president. At a Sept. 27 discussion at his office, President Volodymyr Zelensky asked the Cabinet of Ministers to come up with ways to fight the spread of forged coronavirus tests and vaccination certificates.
The government said it is working on tougher penalties for faking medical documents. The Health Ministry announced it would revoke licenses from clinics involved in forging certificates.
The police have opened over 300 criminal investigations into such scams, Chief Sanitary Doctor Ihor Kuzin told news outlet RBK-Ukraine on Sept. 27. A few fraudsters, including medical workers, were caught. Now, police are going after the customers.
Five steps
The Kyiv Post found at least six accounts offering fake vaccination certificates on Telegram, a messenger app widely used in Ukraine for selling drugs and other illegal activities.
The “Getting COVID-certificate” Telegram channel was set up on Sept. 13 and has since actively promoted its services. One of its posts lists the five steps of making a forged certificate.
“Designers create a certificate, programmers enter this information into the databases of the Ministry of Digital Transformation of Ukraine, then we dispose of the numbered ampoules and within 13–14 working days you will see a certificate and a QR code in your app,” the account says.
By “numbered ampoules,” the channel was likely referring to vials of vaccine kept in medical institutions throughout the country. These vials are numbered. It’s possible that the scam involved discarding a dose of vaccine that would have otherwise been used.
A woman receives a dose of CoronaVac, the vaccine against coronavirus made by the Chinese company Sinovac, in the vaccination center launched in the International Exhibition Center in Kyiv on May 29, 2021. (Volodymyr Petrov)
“If you need a paper document with a stamp, we will mail it to you,” the channel says.
To find out more, the Kyiv Post went undercover and pretended to be Larysa, a Ukrainian woman who is unwilling to get a shot but eager to go on vacation to Italy, where vaccination is mandatory for entry.
It’s possible to get a fake certification for two types of vaccines, a channel manager, who introduced herself as Ekateryna Morgunova, told the Kyiv Post.
“You can choose either Moderna or Pfizer. For travel, it is better to have a digital certificate that would be available in Diia application,” she said referring to the e-governance mobile app.
“A digital certificate costs Hr 1,250, a paper one costs Hr 1,100, a set of both costs Hr 1,800,” she said, adding that it would take two weeks to prepare either of them.
She claimed that these certificates are identical to real ones and are accepted at home and internationally.
Poor paper copy
“The document is genuine. Yes, it has the stamps of a doctor and a medical center,” the Telegram account says about its forged paper certificate.
To prove this, the scammers published an example in the Telegram channel.
At first glance, this vaccination certificate looks like the real thing. It lists the brand of the vaccine, Pfizer in this case, and the issue date, May 28. The names of the patient and the doctor are hidden for privacy reasons.
But the name of the medical center that allegedly issued the document is visible. It is a state-owned clinic located in central Kyiv, called Primary Healthcare Center No. 2.
A forged vaccination certificate scammers published as an example of work on their Telegram channel called “Getting COVID-certificate” on Sept. 13, 2021. According to Primary Healthcare Center No. 2, mentioned on the stamp, this document is falsified.
The Kyiv Post confronted the clinic’s manager with the sample certificate.
“This is the first time I’m hearing about this… you’ve brought such ‘good’ news to me,” said center director Svitlana Symonenko.
Symonenko said her employees are well aware of criminal responsibility for forging documents.
“Our lawyer has worked with every single employee,” she said, “They are responsible people. I cannot think bad of my people.”
After examining the forged certificate closely, Symonenko said it looks nothing like the documents her institution issues.
“We even fill out the form differently. Where it says ‘COVID-19’ in the first column we just put the name of the vaccine, for example, Coronavac,” she said.
“The serial number of the vaccine is totally made up. We do not have such numbers in Kyiv at all. It’s clear to me that the person behind this has nothing to do with medicine,” Symonenko said.
The dates do not add up either. The administration of Shevchenkivsky district, where the clinic is based, told the Kyiv Post, that local hospitals received their first Pfizer vaccine batches in June, while the forged certificate was issued in late May.
“This stamp is not even similar to ours,” Symonenko said. “It’s twice as big as the stamp from my clinic.”
The Kyiv Post informed the police. Symonenko said she has done the same and that cops came to the clinic on Sept. 24 to investigate. According to her, it’s not the first time scammers have issued fake documents on behalf of her medical center.
About five years ago, fraudsters used the name of the clinic to issue fictitious disability letters for workers, a widespread practice in Ukraine to take sick leave. A police investigation failed to bring results.
But on Sept. 29, Kyiv cyber police said they caught a 22-year-old woman and a 24-year-old man allegedly responsible for the “Getting COVID-certificate” Telegram channel the Kyiv Post brought to their attention. Police said they forged at least 200 medical documents including tests and vaccination certificates. The pair faces from three to eight years in jail for large-scale fraud.
Hacking state databases?
But if forging paper medical documents is relatively easy — it’s a common illegal practice in Ukraine — falsifying digital ones is much more challenging, the Ministry of Digital Transformation believes.
The digital certificate has a unique QR code and can be generated only in the Diia app. Diia checks a person’s vaccination status in the Health Ministry’s vaccination database, where it’s filled in by medical workers who administer the shots.
Hacking the state database or Diia is nearly impossible, according to Mstyslav Banyk, head of electronic services development at Digital Transformation Ministry.
“Tests showed that there are no security vulnerabilities in Diia, or they are insignificant and do not affect the certificate element,” Banyk said during a briefing on Sept. 27.
“Diia will display the certificate only after a patient signs a form using facial recognition technology,” he said.
A patient shows his digital certificate of vaccination against COVID-19 in Diia, the e-governance application, opened on his mobile phone. In August, Ukrainian digital vaccination certificates were approved for use in the EU, reopening Europe to vaccinated Ukrainian travelers. Some Ukrainians who don’t want the vaccine but do want to travel buy fake certificates online. (Volodymyr Petrov)
A family doctor must also sign the form with their electronic key to issue a certificate in the first place. Otherwise, Banyk said, it won’t appear in the app.
But the “Getting COVID- certificate” Telegram channel claims it employs programmers able to break into the system and falsify someone’s vaccination record.
The only possible security flaw, Banyk said, is the human factor: “If a doctor forges the document, they are committing a crime and there will be consequences.”
One family doctor in Cherkasy Oblast, some 190 kilometers southwest of Kyiv, has already faced these consequences. Police searched her office on Sept. 27, looking for evidence of vaccination certificate forgery.
According to law enforcement, the doctor entered false information into the Health Ministry database, but deliberately made mistakes to avoid getting caught. This way, the certificates did not appear in the Diia app, but the doctor was still able to issue a paper version and affirm it with her stamp.
She allegedly took Hr 5,000 per certificate. Now the doctor faces up to six years in jail for information misconduct.
Patients who use fake certificates will also be brought to justice, the police said.
On Sept. 24, the police handed a notice of suspicion to a Ukrainian who tried to cross the border with a domestically-made vaccination certificate. He now faces up to two years in prison.
Since September, border guards have been actively checking travelers’ vaccination certificates using tablets with special software — 500 out of 300,000 certificates turned out to be invalid, according to a State Border Guard Service spokesperson.
Vasyl Zhyvoteniuk, a vaccination coordinator in the city of Kyiv, believes responsibility for fraud should be with the patients.
“First of all, these people are harming their health,” he told the Kyiv Post. Zhyvoteniuk says that preventing getting tested or vaccinated by having a fake certificate can lead to infection and eventually death.
“And they pay money for this. This is absurd,” he said, emphasizing that Kyiv and other cities have enough vaccines to go around and they are free. As of Sept. 29, Ukraine has 1.3 million doses ready to be used.
Why so popular?
Only 13.1% of the country’s 42 million citizens are fully vaccinated. This places Ukraine at the bottom of EU countries’ vaccination performance list, together with Bosnia and Herzegovina (13.1%).
Belarus (16%), Bulgaria (19.1%), and Moldova (19.3%) are doing slightly better.
Ukraine’s vaccination drive has been slow primarily because people have little trust in the authorities and vaccines.
Ukrainians’ opposition to vaccination is among the strongest in the world, according to a study by the Ilko Kucheriv Democratic Foundation and the Center of Political Sociology, conducted in August and published in September.
The survey showed that 56% of Ukrainians do not plan to get vaccinated.
Scammers exploit people’s vaccination skepticism and spread fakes about vaccines all over social media, encouraging them to buy forged certificates.
The “Getting COVID-certificate” Telegram channel did exactly that until it was shut down by the police.
Since mid-September, the account has been blogging about the disadvantages of vaccination. The channel claimed that cutting-edge mRNA vaccines, like Pfizer or Moderna, have not been licensed for use before the coronavirus pandemic.
“Progress makes new technologies emerge,” said Semen Yesylevsky, biophysicist and leading researcher at the Institute of Physics of Ukraine’s National Academy of Science. The Kyiv Post asked the scientist to assess the claims this Telegram channel spreads.
“Available mRNA vaccines have successfully passed all clinical trials and tests. Efficacy and safety have been proven in practice by billions of doses administered. Billions!” Yesylevskyy went on.
Another scammers’ claim is that mRNA vaccines cause allergies, autoimmune illnesses, and damage to the liver.
“It is nonsense and a lie,” said Yesylevskyy. According to him, the percentage of complications like allergies is insignificant. Moreover, there is no data on autoimmune illnesses or liver damage caused by vaccines.
Yet, Yesylevskyy said, it’s hard to measure the effect of forged vaccination certificates on the nations’ health as the scale of the problem is unknown.
“If we are talking about 1–2% of fakes this will not be a massive problem. But if it stands at 10–20% or more, then this would undermine and discredit the idea of vaccination.”
