Check Point Research (CPR) sees a global boom in the black market for fake vaccine certificates on Telegram, following US President Biden’s vaccine mandate announcements made last week.
· Black market expands to serve 28 countries, nine of which are new: Austria, Brazil, Latvia, Lithuania, Malta, Portugal, Singapore, Thailand, UAE
· Price for fake vaccine certificates jumps globally, including the US, where the price doubled from $100 to $200
· # of sellers and subscribers increase by 10x and 12x, respectively.
· Vendors have innovated on sales techniques by using bots that create certificates on the spot
Check Point Research (CPR) reports a boom in the black market for fake vaccine certificates on Telegram, following US President Biden’s vaccine mandate announcements last Thursday.
Reach Expands to 28 Countries
The black market for fake vaccine certificates has expanded to serve 28 countries, nine of which are new, including: Austria, Brazil, Latvia, Lithuania, Malta, Portugal, Singapore, Thailand, UAE. The full list of countries can be seen in the appendix below.
Price Jumps
Prices globally range from US$85-US$200. Following Biden’s vaccine mandate announcement, the price for the CDC vaccine card in the US doubled, from $100 to $200.
# of Sellers Increases by 10x
On August 10, CPR saw roughly a 1000 vendors on Telegram. Now, CPR sees north of 10,000 vendors claiming to offer fake vaccine certificates, marking a 10x increase.
# of Subscribers increases by 12x
On Telegram, the vendors who sell fake vaccine certificates organize themselves in groups. The groups each have a subscriber base, indicative of demand. Prior to Biden’s announcement, CPR observed groups having around 25,000 subscribers. Biden’s announcement resulted in an immediate acceleration in the number of subscribers and followers, with some groups even peaking at a follower size as large as 300,000, a number we have not previously spotted.
New technique: Bots
CPR has spotted a new technique that sellers are using to sell more: bots. For example, in Austria, CPR found a Telegram bot that creates fake certificates for free. All one needs to do is fill in the relevant details and a .pdf file will be shared with them containing all their filled data, such as in the case attached- a negative PCR test.
Quote: Oded Vanunu, Head of Products Vulnerabilities Research at Check Point Software:
“We’ve been studying the black market for fraudulent coronavirus services all year. In January, the black market took place mostly on the Darknet, where one needed special software to access it. Back then, the market was likely designed for dealers, people who can distribute the fake goods in mass quantities within specific geographies. Over the past nine months, we witnessed a mass consumerization of the black market by a macro-shift of the black market to Telegram. Telegram appeals to vendors by its anonymity, reach and scale. As the Biden White House announced further vaccination guidelines, Check Point Research took a fresh look at the black market since our last update on August 10, 2021. The growth of the black market for fake vaccination cards has been exponential. The price for a fake CDC card has doubled. The reach of the black market expanded to include nine other countries. We estimate that the number of sellers on this back market have gone up by 10x. The number of subscribers of sellers, who organize themselves in Telegram groups, has grown by a multiple of twelve. Our expectation is that the black market for fake coronavirus vaccination cards will continue to thrive as more policy requiring vaccination proof gets rolled out.”
Appendix:
Tabel A: Price for given country
| Country | Price |
| Australia | 110AUD |
| Austria | 150€ |
| Brazil | $80 |
| Canada | 120$ |
| Cyprus | 150€ |
| Finland | 150€ |
| France | 150€ |
| Greece | 150€ |
| India | 75$ |
| Indonesia | 80-100$ |
| Ireland | 150€ |
| Italy | 150€ |
| Latvia | 150 – 200€ |
| Lithuania | 150€ |
| Malta | 150€ |
| Netherlands | 150€ |
| Poland | 150€ |
| Portugal | 150€ |
| Romania | 150€ |
| Singapore | 250€ |
| Spain | 150€ |
| Sweden | 150€ |
| Switzerland | 150€ |
| Thailand | 80$ |
| UK | 100-150€ |
| Ukraine | 150€ |
| United Emirates | $200 |
| US | $150 – $200 |
Table B: Changes in the black market since the start of the COVID-19 pandemic
| Date of report | What’s on sale | Volume of advertisement | Countries in which it was sold | Selling and distribution platform | Prices |
| December 2020 | Covid-19 Vaccines | A few hundreds | Mostly US sellers | Darknet | $250 |
| March 2021 | Forged negative COVID-19 test results and fake vaccine certificates | Darknet advertisements for COVID-19 vaccineshave increased by over 300% in past three months | Sellers based in the U.S. and European countries including France, Germany, Russia and Spain | Darknet and hacking forums | $135-$150 for fake vaccination certificate |
| August 2021 | Fake ‘vaccine passport’ certificates: EU Digital COVID certificate, CDC and NHS Covid vaccine cards and fake PCR COVID-19 Tests | Volume of advertisement groups and groups sizes publishing sellers multiplied by hundreds percent since the beginning of 2021 | Fake certificates from all around the world, where the majority are coming from Europe, countries such as France, Greece, Italy, the Netherlands and Switzerland related certifications. | Darknet and Telegram groups | $100-120 for fake vaccination certificate |
| September 2021 | Fake ‘vaccine passport’ certificates: EU Digital COVID certificate, CDC and NHS Covid vaccine cards and fake PCR COVID-19 Tests | Increase in the number of offers by 300% in the period from Jan 2021 to March-April, Mostly attributed to changes in EU countries towards the vaccine.Now we see the same effect happening in groups related to the CDC / USA vaccination certificates | Fake certificates from all around the world including: Australia, Brazil, Cyprus, Finland, India, Ireland, Latvia, Lithuania, Portugal, Poland, Romania, Thailand, UAE, UK, Ukraine and the US. | Telegram Groups and bots | Approx. $100 for fake certificate |
About Check Point Research:
Check Point Research provides leading cyber threat intelligence to Check Point Software customers and the greater intelligence community. The research team collects and analyzes global cyber-attack data stored on ThreatCloud to keep hackers at bay, while ensuring all Check Point products are updated with the latest protections. The research team consists of over 100 analysts and researchers cooperating with other security vendors, law enforcement and various CERTs.
About Check Point Software Technologies Ltd.:
Check Point Software Technologies Ltd. is a leading provider of cyber security solutions to corporate enterprises and governments globally. Check Point Infinity´s portfolio of solutions protects enterprises and public organizations from 5th generation cyber-attacks with an industry leading catch rate of malware, ransomware and other threats. Infinity comprises three core pillars delivering uncompromised security and generation V threat prevention across enterprise environments: Check Point Harmony, for remote users; Check Point CloudGuard, to automatically secure clouds; and Check Point Quantum, to protect network perimeters and datacenters, all controlled by the industry’s most comprehensive, intuitive unified security management. Check Point protects over 100,000 organizations of all sizes.
