As My Vaccine Pass becomes a ticket to freedom, an illegal market is brewing for those who aren’t yet double-jabbed. Dylan Reeve investigates for IRL. 

New Zealand’s traffic light system comes into play today, and perhaps inevitably, it’s being accompanied by a new black market for stolen, shared and faked vaccine passes.

The My Vaccine Pass system is technically designed in a way that makes it functionally impossible to create fake passes, but that’s only true if passes are verified using the official verifier app. Because the only information on the pass is a name and date of birth, it would also be necessary to check some type of ID in order to confirm that a pass belongs to the person presenting it.

However, the government’s official advice to businesses about the passes makes it clear that both these steps are optional. Simply looking at a pass is good enough for the purposes of the Protection Framework.

The practical choices in the way the system is implemented mean that, in the real world, it’s probably trivial for an unvaccinated person to simply use another person’s pass, or possibly even present a totally fake one.

A Telegram seller who, when I last spoke to them, was selling fake vaccine record cards recently made a big pivot to buying and selling official My Vaccine Passes.

The seller, “Vax Card NZ”, told me via Telegram private message on Wednesday that they were diversifying: “Just transitioning to cover the digital passes, but we still are selling the cards.”

They went on to explain that they’re trying to build up a stock of official passes with a variety of names and birth dates. “We ideally need a variety of cards to cover the base demographics,” they said, in order to be able to offer suitable options to buyers. But so far they’ve not had much luck getting official cards, and have been raising the price they’re offering to buy the passes. “We started at $50 and are now offering $125, and will continue to raise prices until we are able to purchase enough stock,” they continued. 

As of Wednesday, Vax Card NZ reported that they hadn’t been able to buy any cards, but they were expecting that to change. “This will likely happen when the passes start to be used as people will be able to photograph other people’s passes and then sell them,” they explained, pointing out that all they needed was an image of the official QR code in order to recreate the pass for sale.

This functionally creates a market for stolen vaccine passes, incentivising people to capture images of strangers’ vaccine passes; a process Vax Card NZ has called “mining” in their online advertisements.

The way the official vaccine passes have been designed also means it’s possible to create an entirely fake pass with any name and date of birth. The fake pass would look real to any person reviewing it, but would neither pass nor fail if scanned by the official verifier app – it simply wouldn’t scan at all, leaving the person checking the pass with the decision of whether or not to trust it.

The practical realities of the system are the issue, according to Andrew Chen, research fellow at Koi Tū, the Centre for Informed Futures at the University of Auckland. “In an ideal world checking a vaccine pass would have three steps,” explained Chen. “Step one, a human would visually sight the pass to confirm it looks like a vaccine pass.”

Step two, according to Chen is: “Scan the QR code to confirm the pass is legitimately issued by the Ministry of Health, and that the name that appears on the pass is the same as the one that shows in the verifier app.”

Finally, step three is: “A photo ID check to confirm the person carrying the pass is the person named on the pass.”

In reality though, that three-step process probably won’t happen in most places. Even in cases where those steps are followed, businesses have no obligation (or power) to detain anyone who presents an improper vaccine pass, although a Ministry of Health spokesperson told The Spinoff that police will have the power to conduct spot checks at venues to verify passes and ID. “Fraudulent use or misuse of My Vaccine Passes will be taken very seriously,” said the ministry spokesperson, confirming that police and other agencies will investigate reported misuse and fraud on a case-by-case basis.

With a potential $12,000 fine or six months in prison, anyone using a fraudulent pass is making a fairly significant gamble that they’ll go undetected.

Conversations within New Zealand’s Covid denial and anti-vax online communities about the vaccine pass system have been getting increasingly urgent as the framework has moved from theory to reality. Some are seeking to establish their own alternatives to the mainstream services they’ll be locked out of, setting up groups and websites to facilitate direct trade and identify businesses still happy to serve those without vaccine passes.

Others are looking for loopholes and schemes to gain access to restricted events and businesses while not being vaccinated. Shelling out a few bucks for a fraudulent pass seems an easy choice for some, and it’s likely even more will jump on board if the early adopters report success. 

The idea of vaccine pass fraud can seem pretty daunting, but according to Chen we probably don’t need to get too concerned, as our high vaccination rates and past Covid experience play in our favour. “I’d say the impact of fraud in New Zealand is likely to be lower than other [countries],” he says, pointing out that we’re generally still pretty wary of high case numbers and more diligent with distancing and masks.

Phew.