Fake Vaccination Certificates: How Healthcare Employers Detect Fraud

A fake vaccination certificate is any immunization record — paper record, PDF letter, or digital QR-linked certificate — fabricated, altered, or presented under someone else's identity to satisfy an employer's occupational health requirement. Canadian healthcare employers see four patterns: a forged paper record with an invented lot number, a fraudulent digital certificate with a non-resolving QR code, a genuine certificate reused under a different name, and an AI-generated certificate built from scratch.

This article is provided for informational purposes only and does not constitute legal or regulatory advice. Regulatory references are accurate as of the date of publication and vary by province and territory.

Why Canadian Healthcare Employers Are a Specific Target

Healthcare employers across Canada verify immunity status, not blanket vaccination status, as a condition of employment — a distinction that shapes what fraudsters try to fake. Most provincial COVID-19 vaccination mandates for healthcare workers were lifted between 2022 and 2024; British Columbia, for example, ended its mandate for health-authority facilities on July 26, 2024, when the province's public health emergency declaration ended, though workers there still must report their immunization status for tracking purposes. No Canadian jurisdiction currently makes COVID-19 vaccination a legal condition of healthcare employment in 2026, though PHAC's National Advisory Committee on Immunization (NACI) continues to recommend it for workers at increased exposure risk under its June 2026 guidance.

What remains a genuine, provincially regulated requirement is documented immunity to Hepatitis B, measles-mumps-rubella (MMR) and varicella for clinical staff and anyone performing exposure-prone procedures. Unlike a single national mandate, occupational health and safety obligations fall primarily under provincial and territorial jurisdiction — Ontario's Occupational Health and Safety Act requires employers to take every reasonable precaution against workplace hazards, while the Canadian Immunization Guide's chapter on immunization of workers sets the shared NACI clinical baseline that provinces then apply through their own onboarding policies. A candidate who cannot demonstrate Hepatitis B immunity cannot be cleared for exposure-prone procedures, putting direct pressure on the individual to produce paperwork rather than wait for screening.

This creates a second Canada-specific complication: there is no single national immunization registry. Ontario runs Panorama alongside Immunization Connect Ontario (ICON), its public-facing portal for viewing and submitting records; other provinces run their own separate systems with no cross-province interoperability. A hospital in Alberta verifying a candidate's immunization history from Quebec has no live registry to query — the certificate itself, submitted as a photograph, scan or PDF upload, becomes the entire basis for the clearance decision.

Private clinics, long-term care operators and home care agencies face the same immunity checks as large hospital networks but often outsource screening to a third-party clinic — concentrating reliance on the certificate itself, exactly the single point of failure a forged or reused certificate is designed to exploit.

Four Ways a Vaccination Certificate Gets Faked

A forged paper record uses an invented lot number

The oldest pattern is a physical or scanned paper record with a fabricated vaccine lot number, a non-existent issuing clinic, or a date altered with correction fluid or digital editing. Cross-referencing the stated lot number against known Health Canada-authorized ranges and checking the issuing clinic or pharmacy against a real, licensed provider catches a meaningful share of these before they reach a hiring decision — a manual visual read alone typically will not.

A fraudulent digital certificate carries a QR code that fails to resolve

Provincial digital vaccination certificates increasingly carry a QR code intended to link back to an issuing registry. A code that fails to resolve, resolves to an unrelated or generic page, or is a flat, non-functional image is a strong indicator the document was produced outside any legitimate provincial system — the same pattern documented in prescription fraud, where a static QR code is one of the clearest tells of forgery across medical document types generally.

A genuine certificate is reused under a different identity

An authentic vaccination record belonging to one person can be submitted by another candidate, particularly where agency and travel nurses move between provinces on tight onboarding timelines. This pattern defeats a purely visual check because the document itself is real — detecting it requires comparing the name, date of birth and any photographic ID on the certificate against the candidate's other pre-employment documents, and flagging font, spacing or layout inconsistencies that suggest identity fields were edited after issuance.

This pattern most often involves a family member or acquaintance rather than a stranger, since access to someone else's genuine record is the limiting factor — and it will usually still fail a date-of-birth cross-check even when the certificate itself scans as entirely genuine.

An AI-generated certificate image or PDF is built without any real immunization event

Consumer-grade generative tools can now produce a certificate image or PDF that mimics a provincial health ministry or private clinic template convincingly enough to pass a quick visual review, without any underlying immunization ever taking place. This is the fastest-growing category and the hardest for a human reviewer to catch unaided, because there is no altered original to compare against — the entire document is synthetic. Structural analysis, metadata inspection and font-consistency checks suit this pattern better than a side-by-side visual comparison, which is why detection increasingly relies on an additional layer of AI-generation signals, deployed according to client configuration, as a complement to existing structural checks rather than a replacement for occupational health verification.

Fraud Signals by Certificate Type

Regulatory and Data Protection Framework

Because immunization requirements are set provincially rather than federally, employers need to apply the framework relevant to where the worker is employed. Ontario, British Columbia, Quebec and other provinces each set their own occupational health and safety regulations, layered on the shared clinical baseline in the Canadian Immunization Guide. A national employer cannot rely on a single onboarding checklist — verification workflows need to reflect the province the record is submitted for.

Because a vaccination record is health information, it is sensitive personal information under PIPEDA, and the Office of the Privacy Commissioner's guidance on employee health information requires employers to limit collection to what is demonstrably necessary, obtain meaningful consent, and apply proportionate safeguards. Quebec employers face a stricter additional layer under Loi 25, which requires a privacy impact assessment for projects involving sensitive personal information such as health records.

Submitting a forged immunization record to secure or retain a role falls within the forgery and fraud provisions of the Criminal Code of Canada: section 366 defines forgery as making a false document with intent that it be relied on as genuine, section 367 sets a maximum penalty of ten years' imprisonment on indictment (or up to six months and a $5,000 fine on summary conviction), and section 368 separately criminalizes knowingly using or trafficking a forged document. Canadian enforcement has already reached this exact fact pattern: Ottawa police charged a Gatineau man with nine offences, including forgery, for producing and selling fake COVID-19 vaccine passports across Ontario and Quebec (CBC News), and a former Quebec pharmacy employee was sentenced to two years less a day of house arrest for forgery after producing fraudulent vaccine certificates from inside a licensed pharmacy (CTV News) — a reminder that certificate fraud has already implicated people with legitimate access to issuing systems, not just outside forgers.

Frequently Asked Questions

Canadian healthcare HR and compliance staff return to the same few questions on vaccination certificate fraud.

Do hospital or long-term care staff still need to be vaccinated against COVID-19 to work

No, in most provinces. Formal COVID-19 vaccination mandates for healthcare workers were lifted across Canada between 2022 and 2024 as public health emergency declarations ended — British Columbia's mandate ended July 26, 2024, for example. Some provinces still require workers to disclose their immunization status for tracking purposes even though vaccination itself is no longer a condition of employment. What remains genuine is documented immunity to Hepatitis B, MMR and varicella, which is the record that actually gets forged in practice.

Agency or travel nurses arrive with immunization paperwork from another province — how far are we expected to re-verify it

There is no single national registry to check it against, since each province runs its own immunization information system with no cross-province interoperability. The receiving employer remains responsible for confirming the record belongs to the individual presenting it — the identity-reuse pattern a purely visual check misses — and that the issuing clinic or pharmacy is genuine and licensed in its province of origin.

Can an employer contact a clinic or pharmacy to confirm a certificate is genuine without breaching privacy law

Yes, within limits, under both PIPEDA and, in Quebec, Loi 25. A clinic or pharmacy can confirm whether it issued a record bearing a specific reference or lot number without disclosing clinical information, provided the employer has a genuine, documented concern rather than a routine query on every submission.

How do we tell a real formatting quirk from a fraud signal without slowing down onboarding for every genuine candidate

This is a false positive problem more than a detection problem. Contextual analysis that weighs a document against typical variation for its issuing province or clinic, rather than flagging any deviation from a single template, keeps genuine candidates moving while still surfacing documents that warrant a second look.

Recommended Detection Approach for Healthcare Employers

Tier 1 — Automated check: structural and metadata analysis of the uploaded certificate, QR code resolution where present, cross-field consistency.

Tier 2 — Score-triggered review: identity cross-check against other onboarding documents, comparison against known lot number and clinic-licensing ranges, AI-generation signal review.

Tier 3 — Manual investigation: direct contact with the issuing clinic or previous employer's occupational health service, escalation to internal compliance or security, referral for disciplinary or criminal process where forgery is confirmed.

Manual review alone struggles to scale: the ACFE's 2024 Report to the Nations found organizations relying on manual detection catch only 37% of document fraud cases, with an average detection delay of 87 days — long enough for an unverified worker to complete onboarding and begin exposure-prone procedures.

CheckFile's AI-generation signal detection adds a dedicated layer for synthetic certificate images and PDFs, complementing your existing occupational health and HR controls — it does not replace clinic verification and will not catch every forgery alone. For related patterns, see our analysis of fake medical prescriptions and reimbursement fraud and our broader guide to AI document fraud detection techniques. For sector-specific requirements, see our industry verification guide.

Healthcare HR and occupational health teams evaluating a document verification workflow can review CheckFile's medical sector solution, explore our HR solutions, check our security practices, review pricing, or get in touch to discuss onboarding volumes and retention requirements across provinces.