Two men who created fraudulent Covid 19 vaccination records during the pandemic, and sold them online, have been sentenced.

Waqas Hanif, 28, and Touqir Nasir, 31, both from Luton in Bedfordshire, were charged as part of a joint National Crime Agency and NHS England investigation.

Touqir Nasar (L); Waqas Hanif (R)

Hanif was arrested by NCA officers in January 2022, while Nasir attended a voluntary interview in March 2023.

The investigation focused on the creation of more than 2,000 fraudulent records between June and October 2021 at the Kingsway Health Centre in Luton, where Hanif worked as a vaccination programme care co-ordinator. It also led to the seizure of £136,405 in cash from a local safe deposit box that Hanif had rented.

During the pandemic, unvaccinated individuals paid for official vaccine passport records which were obtained from social media platforms, including Telegram, illegally. Hanif charged clients between £80 to £150 per two ‘doses’ of vaccine.

It is suspected that organised criminals recruited, or worked in partnership with, non-clinical staff to produce the fraudulent records. This enabled unvaccinated people to avoid complying with restrictions adhered to by others during the pandemic, such as travel or gathering in large groups.

A total of 2,663 suspicious entries were recorded and linked to the Kingsway Health Centre, of which 1,875 were linked to five IP addresses connected to Hanif’s home address.

Investigators established that Hanif had site administrator rights to Pinnacle, the NHS system used to generate and record vaccinations.

NCA officers who arrested Hanif at his home address also found his NHS ID card, £7,000 in cash, NHS documents and an application form for Luton Safe Deposit Centre.

Examination of the deposit centre’s CCTV showed Hanif accessing a safe deposit box on a number of occasions. He could be seen carrying it from the locker to the viewing room and then returning it.

The application form showed it was the largest safety deposit box available and was rented on 14 August 2021, during the period that suspicious vaccination records were generated.

Hanif’s fingerprints were found on some of the banknotes and around 250 images were discovered on his mobile phone. These contained photos or screenshots showing personal details, including names and addresses, of around 340 patients.

During interview, Hanif admitted creating the false vaccination records but said that he did so under duress from local criminals who paid for the certificates.

Further investigation showed that Nasir had opened a bank account during the period that fraudulent records were created under the identity of Adam Parker, the name he had changed to under deed poll.

More than £56,000 was deposited into this account, mostly consisting of small deposits of between £100 and £400 which were suspected to be payments for records. Reviews of NHS systems showed that some of the names making deposits had had false vaccine records generated for them.

The bank statements also showed a transfer of £1,000 had been made to Hanif, which Hanif indicated during interview with NCA investigators was payment for the records that Nasir had created.

Hanif pleaded guilty to charges under the Computer Misuse Act, Fraud Act and the Proceeds of Crime Act (POCA) at Luton Crown Court on 4 March 2025, with Nasir pleading guilty to a Fraud Act offence at the same court on 4 December 2025.

Nasir additionally pleaded guilty to an offence under POCA on 26 February this year, to which he provided a basis of plea which was subject to a Newton Hearing on 3 June.

At the same court today (3 September), Hanif was sentenced to three years in prison, and Nasir to ten months suspended for one year. Nasir will also be subject to a curfew for six months.

Deputy Director Paul Foster, Head of the NCA’s National Cyber Crime Unit, said:

“These men cynically abused our healthcare system for financial gain, at a time when the country was going through the turmoil and pain of the Covid 19 pandemic.

“Although receiving the vaccine is a matter of personal choice, such exploitation of our healthcare system to allow unvaccinated individuals to bypass restrictions that are in place to protect the British public is illegal.

“Working closely with the NHS England Counter Fraud Team, this investigation has helped to secure the safety of our communities by preventing organised criminals from further undermining the national pandemic response and benefitting financially from the damaging service they provided.”

3 September 2026