Police spot checks may be needed to prevent My Vaccine Pass identity fraud

Sunday, 21 November 2021

Vaccine pass checks will occur ‘offline’, which means it will not be possible to audit their use to check for signs a pass may have been repeatedly copied.

Firms won’t need to check customers showing My Vaccine Passes are the people named on the passes in order to benefit from the rights they bring to operate at higher Covid alert levels, the Health Ministry says.

The ministry has also indicated the passes will not use any technology that would lessen the risk of unvaccinated people using a duplicate pass that had been printed out or downloaded by a legitimate holder, and pretending to be them.

But police “spots checks” are possible, it says.

The vaccine passes will be required to enter ‘high risk’ events and venues, including summer festivals, under the ‘traffic light’ alert level system that is expected to take effect in December.

* Covid vaccine pass: Your questions answered and all the key details you need to know

* Covid-19: How New Zealand vaccine passes will work and how to get one

Hospitality businesses such as restaurants and bars and those providing ‘close contact’ services, such as hairdressers and gyms, will also need to check passes in order to operate with fewer restrictions under the traffic light system.

The passes, which are designed to prove people are double-vaccinated, show the holder’s name and date of birth along with a QR code that businesses can scan to check the pass’ validity, and an expiry date.

But the passes – which can be downloaded to a phone or printed out – do not prove the person presenting the pass is the person named on the pass.

That has raised questions over whether businesses would need to conduct separate ID checks, to check the name on the pass matched a photo ID.

The Health Ministry said in a statement supplied by spokesman Jon Hoyle that firms would not need to check IDs along with the passes to benefit from their privileges.

But the ministry said they would have the right to do so if they wanted, for example if they suspected fraud.

The QR codes on the passes contain a digital signature which means they will not show as valid if they have been tampered with.

But the ministry indicated they did not incorporate any technology that would prevent someone from copying a pass and pretending to be that person.

Rather, the pass simply confirmed that, at the time of issue, the person named on the pass met the requirements to be considered vaccinated for Covid in New Zealand, it said.

“This is similar to approaches used overseas, and is designed to allow presentation and verification without an online lookup.”

The approach means the ministry will not be able to audit the use of passes, for example to see if any had been used a suspicious number of times and was likely to have been used by multiple people.

“For privacy reasons, there is no central reporting of how many times an individual pass has been scanned, in order to avoid a situation where it may be possible to track an individual,” it said.

The system also means passes could not be revoked in situations where they had been abused.

“The ability to revoke individual passes would require that verifiers check a central list of revoked passes, which may raise privacy and ‘social licence’ issues,” it said.

But the ministry said police would be able to conduct spot checks.

“Police could be requested to check that a customer’s ID matches their pass, or make spot checks at venues. Their approach will be first to educate the public, then enforce,” the ministry said.