The Dutch Ministry of Health, Welfare and Sport (VWS) is investigating a valid QR code in the name of Adolf Hitler, which they believe cybercriminals created in order to prove their ability to create fraudulent Covid Safe Tickets (CSTs).
The creator of the code claims to sell fake ones and has shown evidence that he can make them for both France and Poland, according to an investigation by RTL Nieuws.
These codes would then work anywhere in the EU.
Dutch authorities released an update to the Dutch app CoronaScanner, which allows them to block the fake QR code.
They’re not yet certain how the fake QR codes were made. The code was originally circulated on a well-known hacker forum, with a poster offering to make fakes in any name for €300.
One possible scenario, according to RTL, is that a rogue employee in France or Poland is behind the creation of fake CSTs, as the hacker said that they can only produce QR codes that appear to be issued by either of those two countries.
Fake CSTs have been circulating in Belgium, as well, with offers to purchase them appearing on social media.
Creating or buying fake CSTs is illegal. The consequences in the event of an established offence include a visit to the criminal court, where the person could be fined €2,500 or even receive a prison sentence.
