People in the UK are required to prove their vaccination status in order to access some places and to avoid self-isolation after travelling abroad.
But posts on the social media site are offering unvaccinated people certification to get around the rules.
Facebook said it would remove the content “whenever we find it”.
NHS Covid passes were introduced in England in some settings as part of the UK government’s Plan B measures in the wake of the Omicron coronavirus variant spreading rapidly.
“We were finding passes, certificates, cards, vaccine cards, even down to choice of what vaccine you wanted recording on the card,” said Jonathan Benton who runs cyber investigation firm Intelligent Sanctuary.
Mr Benton, a former senior detective, said a range of passes were available for sale, ranging from some which are legitimate cards, but fraudulently filled in, to complete forgeries.
Covid certificates have been found for sale alongside drugs, weapons and stolen goods on the dark web, with sellers claiming to provide documentation from many countries including the US and the EU.
In one post, one seller claimed to be able to provide certificates from 22 countries including Portugal, France, Greece, Spain, Australia, Latvia, Morocco and the UK.
They were not only offering paper certificates, but purported to be able to provide apps with QR codes because they said they worked with people inside health authorities, who would able to add information to the database.
“Sadly I would say [that claim] is probably highly credible,” saiAnother post reported by the BBCd Mr Benton, who previously worked for the National Crime Agency.
Mr Benton said it was difficult to know who is behind such sales, but he and his team believed organised crime groups were involved, with more criminals moving to online spaces.
“If I’m committing organised, violent crime, out there on the street, and there’s a risk of me getting caught and then going to prison for 10 years versus being behind the screen of a laptop having a number of people committing fraud, I’m going to naturally migrate to that place,” he said.
Meanwhile, on Facebook, the BBC found several examples of posts or comments claiming to be selling Covid vaccination certificates for people who had not been jabbed.
The posts advertised that passes would help people keep their jobs, attend events or travel more easily.
And while some posts were taken down within a few days by Facebook, the BBC reported 10 posts and comments. The majority were taken down within 24 hours, but more posts and comments have appeared again on the same pages.
The BBC found several Facebook posts linked to channels on the messaging app Telegram which offered to sell Covid certificates to unvaccinated people.
‘Impossible to stop’
Analysis by the BBC and security organisation Checkpoint found that over a seven-month period between December 2020 and July 2021, Telegram channels offering Covid passes for unvaccinated people in multiple languages grew from below 10 to more than 1,000.
One Telegram channel claiming to offer NHS and EU digital Covid passports has amassed more than 180,000 subscribers since 14 December.
The BBC has contacted Telegram for comment.
For Mr Benton, the task of catching fraudsters is a difficult one, and counterfeiting is “impossible” to stop.
“If you look at the sites that we are looking at, where you’ve got passes or QR passes for sale. On those same websites they are selling illegal drugs, firearms, a number of illicit materials.
“Frankly law enforcement are struggling to keep on top of it and understand who is behind selling these goods. I can’t see how they can possibly police it.”
The problem of forged Covid passes is not new or unique to the UK, with fraudsters also advertising fake Covid certificates in the US.
For $100 (£70), one vendor said they could deliver a “registered” card, with either the logo of the US Centers for Diseases Control and Prevention (CDC) or the NHS.
It is difficult to know how many fake passes are in circulation, but according to one Border Force union, some have been used to try to get into the UK.
Lucy Moreton of the Immigration Services Union said fake passes had been available ever since official vaccination documentation was introduced.
“When border force were checking, we were seeing a significant minority. We would get a number of them every single day and we’ve no reason to believe that’s changed,” she added.
‘Stronger action needed’
Earlier this year, Border Force was directed to stop checking people’s Covid documentation and airlines have been doing so instead.
“Because Border Force no longer check routinely, we don’t know how prevalent these are and how much this is actually being used and being missed by the airlines who are understandably not forgery experts,” said Ms Moreton.
She said spotting fakes was “no different from spotting an email scam”, but added there was “no model” for extensive checks and that border queues would “become really unmanageable”.
The Labour Party said the UK needed “much stronger action” against this type of online crime and called on the Home Office to “urgently make sure the border Covid system isn’t full of gaps because of fake documents”.
The government has not yet responded to the BBC’s request for comment.
A statement from Meta, which owns Faceook, said it prohibited anyone from buying, selling, or trading fake, or even genuine, medical documents on its platforms.
“We’ll continue to identify and remove this content whenever we find it, and will disable accounts, pages or groups that repeatedly break our rules,” the company added.
