Luton NHS worker jailed for creating thousands of fake Covid vaccine records
More than 2,000 fraudulent vaccination records were created at a Luton health centre during the pandemic
A Luton man who created fraudulent Covid vaccination records during the pandemic and sold them online has been jailed.
Waqas Hanif, 28-year-old, worked as a vaccination programme care co-ordinator at the Kingsway Health Centre in Luton.
He was sentenced alongside Touqir Nasir, 31-year-old, also from Luton, as part of a joint National Crime Agency and NHS England investigation.
At Luton Crown Court today, Hanif was jailed for three years, while Nasir was given a 10-month sentence suspended for one year and will be subject to a six-month curfew.
How the fraud worked
The investigation focused on the creation of more than 2,000 fraudulent records between June and October 2021 at the Kingsway Health Centre, where Hanif worked.
Investigators established that Hanif had site administrator rights to Pinnacle, the NHS system used to generate and record vaccinations.
During the pandemic, unvaccinated people paid for official vaccine passport records that were obtained illegally through social media platforms, including Telegram.
Hanif charged clients between £80 and £150 per two 'doses' of vaccine.
A total of 2,663 suspicious entries were recorded and linked to the Kingsway Health Centre, of which 1,875 were linked to five IP addresses connected to Hanif's home address.
The NCA said it is suspected organised criminals recruited, or worked in partnership with, non-clinical staff to produce the fraudulent records.
This enabled unvaccinated people to avoid complying with restrictions adhered to by others during the pandemic, such as travel or gathering in large groups.
What investigators found
The investigation led to the seizure of £136,405 in cash from a local safe deposit box that Hanif had rented.
NCA officers who arrested Hanif at his home also found his NHS ID card, £7,000 in cash, NHS documents and an application form for Luton Safe Deposit Centre.
Examination of the deposit centre's CCTV showed Hanif accessing a safe deposit box on a number of occasions.
The application form showed it was the largest safety deposit box available and was rented on 14th August 2021, during the period that suspicious vaccination records were generated.
Hanif's fingerprints were found on some of the banknotes, and around 250 images were discovered on his mobile phone.
These contained photos or screenshots showing personal details, including names and addresses, of around 340 patients.
During interview, Hanif admitted creating the false vaccination records but said he did so under duress from local criminals who paid for the certificates.
The second man
Further investigation showed that Nasir had opened a bank account during the period the fraudulent records were created, under the identity of Adam Parker, the name he had changed to under deed poll.
More than £56,000 was deposited into this account, mostly consisting of small deposits of between £100 and £400, which were suspected to be payments for records.
Reviews of NHS systems showed that some of the names making deposits had had false vaccine records generated for them.
The bank statements also showed a transfer of £1,000 had been made to Hanif, which he indicated during interview was payment for the records Nasir had created.
The charges
Hanif pleaded guilty to charges under the Computer Misuse Act, Fraud Act and the Proceeds of Crime Act at Luton Crown Court on 4th March 2025.
Nasir pleaded guilty to a Fraud Act offence at the same court on 4th December 2025, and to an offence under the Proceeds of Crime Act on 26th February this year.
Deputy Director Paul Foster, Head of the NCA's National Cyber Crime Unit, said: "These men cynically abused our healthcare system for financial gain, at a time when the country was going through the turmoil and pain of the Covid 19 pandemic.
"Although receiving the vaccine is a matter of personal choice, such exploitation of our healthcare system to allow unvaccinated individuals to bypass restrictions that are in place to protect the British public is illegal.
"Working closely with the NHS England Counter Fraud Team, this investigation has helped to secure the safety of our communities by preventing organised criminals from further undermining the national pandemic response and benefitting financially from the damaging service they provided."