European Commission acts against fake EU Digital COVID certificates

The European Commission has adopted an EU mechanism that allows revoking fraudulent or erroneous EU Digital COVID Certificates (EUDCCs).

With this measure, once a certificate is revoked in one member state, it will also show as invalid in all other member states.


Since the EUDCC system started in July 2021, more than 1.7 billion certificates have been issued. In addition to the 27 EU member states, another 35 non-EU countries territories have joined the scheme, including the UK the non-EU Schengen members – Iceland, Lichtenstein, Norway, Switzerland.

Due to its successful role in helping to lift travel restrictions, EU certificates have sometimes become a target for fraudsters. The new feature means that when fraud or mistakes are detected, the concerned certificates can be revoked in all member states.

However, the Commission says the overall number of fraudulently or mistakenly issued certificates “remains very low”.


Last year Italian police said they had uncovered several online schemes offering to sell fake EUDCCs. The cybercrime prosecutor team in Milan led the investigation, which showed that thousands of people were ready to pay for false certificates. Instances of fake certificates for sale have also been reported in Austria, Germany Ireland.

Meanwhile, cybersecurity concerns have been raised by software developers regarding the EUDCC’s use of unencrypted barcodes, which could potentially make them vulnerable to cybercrime abuse.  

There have also been fears that the NHS COVID certificate scheme could be open to fraud due to a glitch in the online system which allows users to obtain a certificate by entering a false negative test result.

Earlier this month, the Council of the EU approved the extension of the EUDCC scheme for an additional year until 30 June 2023. The current regulation establishing the certificates was adopted in June 2021 expires on 30 June 2022. For the extension to be adopted in time before the expiry date, the Council the European Parliament must reach an agreement under the ordinary legislative procedure before that date.

In December the Commission reduced the validity period of the certificates to nine months to encourage people to have boosters, based on the European Centre for Disease Prevention Control’s recommendation that the third jab should be given within six months.


A European Commission press release states: “While several member states have already deployed revocation systems at national level, the new system at EU level will allow the secure efficient revocation cross-border via the EU Gateway. This improvement should further strengthen the trust confidence in the EU Digital COVID Certificate system.”

Source link