Official NHS passes used to prove double-jabbed status are being sold on an encrypted messaging app to people who refuse to be vaccinated, The Mail on Sunday can reveal.
The certificates – which are uploaded on to the NHS‘s mobile phone app – should only be available to those who have been fully inoculated.
They can be used for foreign travel and to gain access to nightclubs, stadiums and other venues for big events. They will also be used to ensure that care home staff have been fully vaccinated when it becomes mandatory next month.
But our investigation exposes the fraudsters who are selling genuine passes for up to £750 each on the messaging app Telegram to people who won’t have the jab.
An undercover reporter bought an NHS vaccine pass, including a unique digital QR code, on behalf of someone who has not yet been vaccinated. It was uploaded on to the official NHS app four days after the order was taken.
After verifying the pass was genuine, the QR code was used to gain access to a nightclub in London and the Louvre Museum in Paris. It was also used to successfully fill in the Government’s passenger locator form, which is intended to protect Britain’s borders by ensuring that those entering the UK have been double-jabbed.
After being alerted by the MoS, NHS England said it had launched an investigation and had passed our dossier of evidence to the relevant authorities.
The exposure of a black market in vaccine passes will be of particular concern to elderly care home residents and their relatives. In order to maximise the safety of those they care for, employees who work with elderly people will have to prove they have been fully inoculated by November 11.
But to the growing annoyance of Ministers, an estimated 42,000 – or eight per cent of the care home workforce – are expected to miss the deadline.
ACCUSED: Jordan Goodall, who supplied a fake NHS Covid pass which we have scored through to prevent its use
The fake NHS Covid pass handed out which we have scored through to prevent its use
Signalling his irritation, Health Secretary Sajid Javid yesterday told BBC Radio 4’s Today programme: ‘If you work in a care home, you are working with some of the most vulnerable people in our country and if you cannot be bothered to go and get vaccinated, then get out and go and get another job.’
The illicit trade also throws into doubt strict new rules in Scotland and Wales. Since Friday people in Scotland have had to prove they are doubled-jabbed before entering certain venues and events. Proof of vaccination, or a negative Covid test, will be mandatory for some venues in Wales from October 11.
Shadow Health Secretary Jonathan Ashworth last night expressed horror at what the MoS had uncovered.
‘This is a staggering breach of NHS security, allowing these crooks and villains to unscrupulously sell fake vaccine passports and in turn putting people’s health seriously at risk,’ he said.
‘This is nothing short of a scandal. Sajid Javid needs to order an immediate inquiry and find out why this breach has been allowed to happen, how it happened and for how long it’s been going on.’ Mr Ashworth added: ‘If it wasn’t conference season we would be demanding that the Secretary of State comes to the House of Commons on Monday to explain how on earth this has happened.’
The investigation began after concerned doctors alerted the MoS to the scam. Our reporters quickly discovered four brazen fraudsters peddling Covid passes on Telegram, which is popular with criminals and terrorists due to its military-grade encryption.
One account called ‘Legit vaccine passports’ offered to sell vaccine certificates and to digitally upload them to an individual’s phone, via the NHS app, for £750.
The anonymous account holder, who used a pseudonym ‘Doctor J’, had almost 500 subscribers and offered an ‘express delivery’ service with a discount of up to £200 for multiple orders.
Posing as a potential buyer, our reporter contacted Doctor J and asked if he could ‘sort an NHS vaccine certificate’.
The fraudster not only agreed, but boasted that he could arrange the manipulation of an individual’s NHS records to make it falsely appear as if they had been double jabbed.
‘It’s not actually just the certificate,’ he declared. ‘It will be on the system that you’ve had both jabs with a real date, a real batch number.
‘So the way it works you obviously have to download the NHS App, send us your full name, date of birth and NHS number and then obviously we input it on the system and … within 48 to 72 hours it will be up on the app ready to use.’
He claimed to have processed ten vaccine certificates that week, with another five awaiting his attention the next day.
After agreeing to buy the pass, the reporter provided details of an individual who had not been vaccinated for medical reasons and who had agreed to help expose the scandal. Three days later, Doctor J sent a message apparently showing that our buyer’s NHS records had been altered and now falsely showed the dates of two Covid vaccinations – one on June 27 and another on August 16.
Within a further 24 hours, our buyer’s NHS app had been updated and now included a fraudulent vaccine pass.
Astonishingly, the app falsely stated that our buyer had received two Pfizer-BioNTech Covid vaccination doses, each of which had its own vaccine batch number.
It also wrongly claimed that he had been given the jabs at the St Charles Centre for Health, a large clinic in Notting Hill, West London.
An official vaccine pass QR code had been generated on the app for use both domestically and for international travel, while an official document displaying the pass had also been downloaded.
The reporter tested the pass using the NHS Covid Pass Verifier app, which is used by large nightclubs and other venues to prove that customers have been jabbed. The app declared that the pass was ‘valid’.
The MoS also successfully used the fraudulent pass to carry out the vaccination status checks required by the Government’s passenger locator form, which is required to enter the UK from a foreign country. This data was not submitted and was simply used to demonstrate that the pass worked.
A reporter then used the pass on Friday night to enter a nightclub in South London with a capacity of more than 550 people.
The venue’s rules say: ‘When arriving, please ensure you are able to provide proof for at least one of the following: a negative Covid test taken within 48 hours, [or that] you are double-vaccinated … The best way to provide proof will be through registering your results with the NHS app.’
The reporter also used the certificate in France to enter a cafe and a restaurant, check into a hotel and visit the Louvre Museum. Vaccine passports are mandatory in all public settings in France and are strictly enforced.
Doctor J initially demanded payment via PayPal or Bitcoin, a cryptocurrency used by criminals to mask their identities, but our reporter persuaded him to accept a payment via bank transfer which allowed us to uncover his true identity as Jordan Goodall.
The 23-year-old, from Oakley, a village near Basingstoke in Hampshire, describes himself on the LinkedIn website as an independent foreign exchange trader who set up a fund management company in July. He lives with his parents and drives a silver BMW 3 Series car.
Doctor J initially demanded payment via PayPal or Bitcoin, a cryptocurrency used by criminals to mask their identities, but our reporter persuaded him to accept a payment via bank transfer which allowed us to uncover his true identity as Jordan Goodall (pictured on a flight in Dubai)
Confronted by the MoS yesterday, he initially suggested that ‘someone stitched me up then’ before denying he was Doctor J.
‘I don’t know what you are on about. Anyone could’ve just given you my details,’ he added.
Doctor J’s Telegram channel was deleted within half an hour of the conversation. It is unclear if Doctor J was acting alone or with the assistance of an NHS insider – or insiders.
Thousands of vaccine centres across the UK, including GP surgeries, hospitals and pharmacies, have the ability to update an individual’s vaccination record on a central database previously used to record flu vaccinations. Those details are then disseminated throughout the NHS and, crucially, link to an individual’s phone via the NHS app.
It is understood the NHS found no evidence that its systems have been hacked and Doctor J indicated that he has a ‘connection’ to whom he sends details – suggesting the ability to access NHS computers.
The MoS last week ordered another two vaccine passports purportedly on behalf of care workers from two more Telegram fraudsters. One named ‘Dr Jeffery’ ran a channel under the name ‘NHS Vaccinations’ with more than 77,000 subscribers and sold a certificate for £200, payable in Bitcoin.
Another named Theo Brandy ran a channel called ‘UK, Ireland vaccine cards’ and sold a pass for £180 in Bitcoin. Both passes are due to be delivered early this week.
Vaccine refuseniks who have bought NHS Covid certificates to falsely show they have been jabbed have provided testimonials which have been posted on Telegram.
Shane, thought to be an oil worker, said: ‘It’s on there [the NHS App]! Haven’t a clue how you’ve done that I honestly thought it was a scam.
‘Mate your [sic] a life saver I can now keep my job and don’t have to put my life at risk. I have already started passing your details on to my work colleagues.’
Another said: ‘I got it!!! Wow. Thank u so much. I am so grateful to u [sic]. Might I be able to get my wife done as well?’
Last night, an NHS spokesman said: ‘Defrauding the NHS and the taxpayer will not be tolerated and after The Mail On Sunday shared their investigation we immediately took steps to identify potentially fraudulent vaccination records. The information has been passed directly to the relevant authorities.’
The MoS asked the NHS to ensure that the fake records we had commissioned were immediately deleted.
Encrypted app where you can buy cocaine and a gold plated AK-47
By Molly Clayton for The Mail on Sunday
Hard drugs, fake documents and even a gold assault rifle – all can be bought on the secretive app Telegram, our startling investigation found.
We discovered a vendor on the app offering a gold AK-47 assault rifle and delivery to UK addresses within four days.
Another dealer advertised three grams of heroin to be delivered by first-class post for £80.
We discovered a vendor on the app offering a gold AK-47 assault rifle and delivery to UK addresses within four days
Tech-savvy crime gangs use Telegram – a free, Russian-owned mobile phone app popular with teenagers – to offer the weapons, fake documents and illicit drugs, including heroin, cocaine, ecstasy and ketamine.
The dealers hide behind the app’s end-to-end encryption, which guarantees no one other than those chatting can read the messages – a feature that the creators of the app, used by 500 million people, claim cannot be hacked by the authorities.
The illegal service operates on a digital retail system called Televend available on Telegram, which was founded in 2013 by the Russian technology billionaire Pavel Durov.
Televend’s online stores are operated 24 hours a day by computer bots that use software to perform automated tasks and mimic human responses.
Televend launched in 2018 and swiftly became an alternative to trading on the dark web, a part of the internet invisible to search engines and accessed via a browser providing anonymity.
It charges a commission on sales and has more than 200,000 registered users and thousands of vendors operating an online criminal bazaar.
To expose how Telegram allows drug pushers to operate with ease, the MoS combed through lists of sellers on Televend advertising illicit substances to UK buyers. Some offered bulk discounts and invited customers to rate and review purchases. One dealer, called ‘The TripAdviser Vendor’, advertised hallucinogens including LSD, magic mushrooms and ‘100 per cent medical-grade’ ketamine.
Tech-savvy crime gangs use Telegram – a free, Russian-owned mobile phone app popular with teenagers – to offer the weapons, fake documents and illicit drugs, including heroin, cocaine, ecstasy and ketamine
The dealer told an undercover reporter: ‘Our mission is to get the highest quality products right to your doorstep without having to worry. Once you’ve paid, it’s all in good hands.
‘We have had years’ experience with psychedelics and we find they shine compared to the more popular hard drugs like cocaine or heroin and meth. The thing is with psychedelics you can self-heal and build through these.’
The ‘TripAdviser Vendor’ said consignments of drugs were shipped to any address in the UK within two working days after payment using the cryptocurrency Bitcoin.
The site claims a 100 per cent success rate with deliveries and carries 165 positive reviews from customers.
Our reporter – acting in the public interest to expose a crime – purchased a gram of ketamine, a party drug blamed for about 30 deaths in the UK a year, sending a numeric code for £30 worth of Bitcoin bought from an online site.
The entire process took less than five minutes.
‘This ketamine is 100 per cent medical grade with shards mixed with a little grain and really clean trip/high,’ the vendor said. ‘It is not bashed with any bulking agents such as MSG (salt) that is commonly found mixed with ketamine.’
The seller also boasted that its ketamine is so pure that buyers risk ‘falling into a k-hole’ – drug slang describing the out-of-body experience users report from taking a high dose, saying: ‘It is possibly the highest quality on the market to date. This stuff is the real deal. K Hole warning!’
The computer bot verified the payment before the package was delivered by Royal Mail within two days to a secure postbox.
It is now with the police and is understood to have tested positive as pure ketamine.
Last night, the Home Office said: ‘We are continuing to work closely with the National Crime Agency and others to help us tackle the use of encrypted devices used to plot vile crimes under the radar.
‘We are giving them the resources, powers and tools they need to keep our country safe and we are clear that online companies must not allow their platforms to be used to sell illegal drugs.
‘Our Online Safety Bill will force them to remove this content or face large fines.’
Neither Televend nor Telegram (which hosts Televend but does not operate or authorise it) responded to requests for comment.