Fake RT-PCR reports: Why QR code verification cannot to be trusted

Recently, over 100 tourists were caught with fake RT-PCR test reports in Uttarakhand while news reports reveal that many were denied entry in Kerala, Mumbai and other regions for carrying fake Covid test reports. With some states enforcing strict RT-PCR test requirements for entry, citizens across the country are now resorting to editing old RT-PCR test reports or creating entirely new ones on their laptops.
In order to curtail fake RT-PCR reports, the government recently made it mandatory that all test reports must come with a QR code so that the test results can be verified electronically. But with countless free PDF editors and QR code generators available online, a fake report can be created in minutes. And if someone doesn’t know how to create one, any roadside cyber cafe can help make one for as little as Rs 200.
Why QR code verification is failing
A QR code can only successfully validate a test result if there’s a centralised mechanism to store all test reports in the first place. This is exactly what happens with vaccine certificates. The QR code placed on the vaccine certificate can be easily verified and the authenticity of the certificate can be checked by simply visiting “https://verify.cowin.gov.in” website. This website reveals whether or not the vaccine certificate is original or not.
On the other hand, there is no centralised website for checking the authenticity of RT-PCR tests. In most RT-PCR test results, if you scan the QR code on the report, it simply opens the digital copy of the same report. Just opening the digital PDF copy of the physical paper report on a web URL doesn’t verify the authenticity of the RT-PCR report at all. You can find numerous QR code generators that can do the same in minutes. What is required is that the QR code be provided and linked to the servers of Indian Council of Medical Research (ICMR). Also, there should be a website for the end users as well to check the authenticity of their tests.
Another aspect to consider is that very few officials at airports are actually scanning the QR code on the RT-PCR test reports. This is because the airline staff or airport authorities need to use their own mobile or a smartphone that has a reliable internet connection to scan it. It is hard to make out the authenticity of PDF reports by simply looking at it. Not to forget, with QR code generators, even scanning the QR code on test reports, will not be of much help.
The verification system has loopholes and some people seem to have figured this out. In order to save money, they are resorting to creating PDFs files of RT-PCR tests without any consideration for the disease. For the records, producing fake RT-PCR reports is a punishable crime.
Can SRF ID scanning help detect fake RT-PCR reports
The only way to create a centralised website for checking the authenticity of RT-PCR test reports is by relying on the Specimen Referral Form (SRF) ID. The SRF ID is unique and is fed to the servers of ICMR by every test lab across the country. A Covid test report without the SRF ID is invalid. All ICMR approved testing labs have to provide the SRF Id on the report. This ID reveals the personal details of the person along with the sample collection and reporting dates and times. There’s no way to tamper with the SRF ID, as this ID is only generated when a test is actually taken. It is due to this SRF ID that the patient gets the test result on their registered phone number. Now, in order to make scrutiny of RT-PCR test results more effective, verifying the SRF ID should be made mandatory and for that there has to be a public website first.
National Health Authority chief RS Sharma recently said that RT-PCR test reports will be linked to the CoWin system in the near future. Now, this is required to be rolled out very soon as the SRF IDs will be linked to the CoWin and ICMR platforms and it would be possible to easily verify whether or not someone has actually taken the RT-PCR test by simply entering the phone number.