Back when COVID had started and the first vaccinations had been applied, there was the fun challenge of proving one’s vaccination status. It ended up working based on a digital signature provided as QR Code on a piece of paper. Needing it every day, paper didn’t quite have the necessary durability, the digital versions only helped people with smart phones, so I created a plastic card alternative.
My vaccination card was a simple credit card sized plastic card, printed in an Evolis Pebble printer I had bought on eBay. The design was made in such a way that it looked convincing. In addition it came with a simple website as reference: https://vaccard.eu/ .
Fake?
From my perspective, up to now, the card was never fake, as it didn’t copy anything existing. It was simply not an official document. On the front the card showed the first and last name, date of birth, and the vaccination date of the last injection. The backside showed a QR code, the date, the used medication, the certificate issuer and the certificates fingerprint. The QR code had exactly the same content as the original code from the original vaccination confirmation. I later added a field for a vaccination counter.
As such it had the same function as the printed piece of paper. And from my perspective probably even the same validity, as it was just as much original as a copy from the multi-functional printer behind me. In addition, a few companies started selling similar cards a little later, or at least I wasn’t aware of them when I started printing, so I guess it was a legit approach.
Verification Process
When verifying the proof of vaccination, one was supposed to use a specific app, scan the QR code and check the name against the piece of paper and preferably also valid id, to make sure person/face and name match. All this took a bit of time, which Security or the “normal” employees at cinemas or other places often didn’t have. Some literally stared at the QR code for a few seconds and then let one in.
Misuse/Scam Potential
That said the cards obviously had a notable potential for misuse. Printing a picture on the card, with a name that that matches the proof/certificate and, problem solved. Having a picture ID available often convinces the people that checking a further, state issued, picture ID isn’t necessary.
Acceptance
While only having printed maybe 30-40 cards for people I personally know, they were always accepted. Both as being so convincing, that the QR code wasn’t even scanned and simply looked at, scanned and compared to the name on the app.
Design Thoughts
The card had to look convincing enough, as said not to bluff one’s way through, but to actually make it convincing enough to be usable:
- National symbols are often interpreted as coming from an official source, as such the circle of stars creates a reference to the European union
- “The real thing” always has a complex design, making alterations impossible, as such the waves in the background offer the same feeling. Due to a bug in the printer driver, the partial transparency actually ended up in a slight rainbow effect on the lines, which made it look even more like a security aspect
- Watermarks are always a welcome aspect, not being able to create any, the yellow checkmark in the blue box at least looked a little bit like one.
- Fonts in general: Simple and clean often look convincing as is
- The Checksum and Serial number could actually have verified on the applicable website. I hadn’t expected anybody to ever try, but it yet again gave the feeling of being real
Honestly, I guess I overdid it a little, but it worked….
And now?
Fun project, especially during a lockdown. It helped a few people I know who didn’t have a smart phone and this way could carry a proof of vaccination with their purse. So, yes, that’s what small hacks are for.