Introduction: The Evolving Role of Airlines in Health Credential Verification

International travel rebounded sharply after the COVID-19 pandemic, thrusting airlines into an unexpected role as frontline gatekeepers for public health compliance. Each country enacted distinct entry rules, often updating them on short notice, forcing carriers to build robust, adaptable verification systems. Today, verifying vaccination status involves a complex mix of digital credentials, dedicated health pass applications, paper documentation, and real-time database checks. The specific methods vary not only by airline but also by the departure and destination countries, creating a multifaceted web of protocols that passengers must navigate. Airlines have invested heavily in technology and staff training to ensure compliance while minimizing delays, but the landscape remains fragmented. This article provides an authoritative breakdown of how airlines currently verify vaccination status across different regions, the technologies underpinning these processes, and the challenges that remain.

Common Verification Methods

Airlines employ a suite of tools to confirm that passengers meet destination health requirements. The choice of method depends on the country's digital infrastructure, the airline's technology partnerships, and the type of certificate presented. The most widely adopted approaches include digital vaccination certificates with scannable QR codes, dedicated health pass applications, and traditional paper records. Each method has distinct strengths and vulnerabilities.

Digital Vaccination Certificates and QR Codes

Digital vaccination certificates are electronic records issued by national health authorities. They typically contain the holder's name, date of birth, vaccine type, dates of doses, and a unique QR code encoding the same information in a machine-readable format. Airlines use scanning devices or mobile apps to read the QR code and cross-check the data against public key registries. This method, known as Public Key Infrastructure (PKI), allows verification without accessing a central database, preserving passenger privacy. The EU Digital COVID Certificate (EUDCC) is the most prominent example, adopted across the European Union and associated countries such as Switzerland, Iceland, and Norway. Scanners validate the digital signature against a public key distributed through a secure gateway, ensuring the certificate is authentic and has not been tampered with. For example, Lufthansa and Air France integrate QR scanning directly into their check-in kiosks, reducing manual inspection time to under three seconds per passenger. However, PKI systems rely on regular updates to certificate revocation lists; expired or revoked certificates may appear valid if an airline’s scanner does not refresh its key store frequently.

Health Pass Applications

Several airlines and third-party companies have developed health pass applications that streamline verification by allowing passengers to upload vaccination records, test results, and travel documents before arriving at the airport. The app generates a travel-ready status that airline staff can confirm at check-in or boarding. Notable examples include the IATA Travel Pass, which connects with government databases to validate certificates against official registries; VeriFLY, used by American Airlines, Delta, and British Airways; and the Clear Health Pass, integrated with Delta’s loyalty program. These applications often incorporate biometrics and secure digital identity features to reduce fraud. For instance, VeriFLY uses liveness detection and facial recognition to ensure the person uploading the documents is the same as the traveler. A 2022 trial by Delta reported that VeriFLY reduced check-in time by 40% for international flights. However, these apps require passengers to have smartphones and internet access, creating equity concerns for less connected travelers.

Paper Documentation and Physical Cards

Despite the push toward digital solutions, paper vaccination cards remain widely accepted, especially in countries like the United States where no national digital certificate exists. Passengers may present the CDC vaccination card or a comparable document issued by another country. Airline staff manually inspect the card for key details: vaccine brand, number of doses, administration dates, and official stamp. However, paper documents are highly vulnerable to forgery. In 2021, U.S. Customs and Border Protection reported seizing thousands of fake CDC cards at airports. Airlines have responded by training agents to identify common forgeries—mismatched fonts, missing holograms, or inconsistent date formats. Some carriers use ultraviolet lights to check for security watermarks. Digital photographs of the card are sometimes accepted, though this introduces additional editing risks. As a result, many airlines require paper document holders to also undergo a secondary verification through a health pass app or a database lookup, slowing the process.

Verification Procedures by Region

The specific verification process an airline uses depends heavily on the regulatory requirements of both departure and arrival countries. Below is a region-by-region breakdown of how airlines confirm vaccination status, including examples of airline-specific implementations.

European Union

The EU Digital COVID Certificate (EUDCC) system sets a high standard for interoperability. Airlines flying into or within the EU must accept certificates bearing the EUDCC QR code. At check-in, staff use an approved app—such as the EU’s reference implementation or a carrier-specific scanner—to read the QR code. The scanner checks three elements: the digital signature (authenticity), the expiration date, and the certificate type (vaccination, test, or recovery). If valid, the passenger is cleared. Most major European airlines have integrated these scanners into their mobile apps and kiosks. For example, Ryanair uses its own mobile app to scan EUDCC codes during mobile check-in, while Air France trains gate agents to use handheld devices. The European Commission provides a secure gateway for national systems to exchange public keys, ensuring that a certificate issued in Italy is instantly verifiable by a Spanish airline. This centralized approach has made verification consistent across 27 member states plus several non-EU countries. One challenge remains: certificates from non-EU countries without bilateral agreements are not automatically accepted, requiring manual validation by staff.

United States

The United States does not have a federal digital vaccine passport. Instead, airlines accepting international flights to the U.S. must verify that adult non-citizen passengers are fully vaccinated—a requirement that remains in effect as of 2025. Carriers primarily rely on the paper CDC vaccination card or a digital copy uploaded to an airline-specific system. Delta Air Lines uses VeriFLY to let passengers upload records before travel; at the airport, agents visually inspect the card and compare it against a photo ID. United Airlines uses a proprietary system integrated with its check-in kiosks that asks passengers to attest to vaccination status and upload documentation. Some airlines also use the IATA Travel Pass to validate foreign certificates against a list of acceptable vaccines maintained by the U.S. Centers for Disease Control and Prevention. Because fraud is a persistent concern, airlines have implemented staff training to detect common forgeries, such as mismatched fonts or missing holograms. However, the lack of a unified digital standard means that verification is less consistent and more labor-intensive than in the EU, often leading to longer check-in queues for U.S.-bound flights.

United Kingdom

The United Kingdom established the NHS COVID Pass, a digital and paper-based certificate containing a QR code. Airlines accepting flights to the UK generally require passengers to present this pass before boarding. The NHS app generates a QR code that airline staff scan using a validation tool provided by the UK government, such as the UK COVID Pass Verifier. For non-UK nationals, the NHS COVID Pass is not available, so airlines must accept vaccination certificates from the passenger’s home country. The UK government publishes a list of approved overseas certificates and their corresponding QR code formats. Airlines cross-reference the passenger’s passport details with the certificate to ensure identity matching. British Airways, for example, uses the IATA Travel Pass to automate this comparison. A notable challenge is that some foreign certificates are paper-based and lack QR codes, forcing staff to manually enter data—a process that increases error rates and wait times.

Canada

Canada requires all travellers aged 12 and older to be fully vaccinated to board a plane. The verification process involves two main steps: first, travellers upload their vaccination details to the ArriveCAN digital platform via website or mobile app within 72 hours of travel. ArriveCAN generates a receipt with a letter code indicating vaccination status (A for fully vaccinated, B for partially vaccinated, etc.). Airlines check this receipt at check-in, along with original vaccination documentation. For travellers from the United States, Canadian carriers accept the CDC card; for other countries, they accept digital certificates meeting Canada’s standards. The Canadian government provides guidance on what constitutes an acceptable certificate, including a list of vaccines approved by Health Canada. Air Canada has integrated ArriveCAN validation into its mobile app, allowing passengers to submit their receipt digitally before arriving at the airport. However, if the receipt is missing or invalid, airline agents must perform manual checks, which can delay boarding.

Australia

Australia maintained strict border policies during the pandemic, requiring airlines to verify vaccination status with high rigor. The Australian government introduced the International COVID-19 Vaccination Certificate (ICVC), which is linked to an individual’s passport and available through the Australian Immunisation Register and the Medicare app. Airlines flying into Australia must scan the ICVC’s QR code using a government-provided validator. For travellers from countries that do not issue ICVCs, airlines accept equivalent certificates meeting Australia’s data standards. The Department of Home Affairs publishes a detailed list of acceptable certificates for each country. Airlines also verify that the vaccine administered is on Australia’s approved list (e.g., Pfizer, Moderna, AstraZeneca). Qantas has implemented a two-stage verification: first, passengers upload certificates to an online portal before departure; at check-in, staff perform a secondary scan using handheld devices. This double-checking reduced false positives but increased processing time per passenger.

Asia-Pacific: Singapore, Japan, South Korea, and China

Asian countries have adopted diverse verification strategies, reflecting different levels of digital infrastructure and privacy norms.

Singapore uses the SafeEntry system and the HealthHub app to generate vaccination certificates accepted for entry. Airlines verifying for Singapore flights accept national certificates from other countries, provided they are in a machine-readable format with a QR code. Singapore Airlines uses a custom system that integrates with the IATA Travel Pass to validate foreign certificates against an internal database of approved vaccines and issuers.

Japan initially relied on paper certificates from the Ministry of Health, Labour, and Welfare, but later introduced a digital vaccine passport loadable into the COCOA contact-tracing app. Airlines flying to Japan typically collect digital copies at check-in and may scan the Japanese digital certificate using airline-provided software. All Nippon Airways (ANA) uses a third-party verification service that cross-references the QR code with a central registry maintained by the Japanese government.

South Korea developed the COOV app, which generates a QR code for vaccination records. Airlines flying to South Korea—such as Korean Air and Asiana Airlines—scan the COOV code using a government-backed validator. For foreign certificates, they rely on the WHO’s interim guidance for acceptable proof, requiring at minimum the traveler’s name, date of birth, vaccine type, and dates of doses.

China has a unique system based on the Health Code (Jiankangma) inside apps like Alipay and WeChat. This code turns green, yellow, or red based on vaccination status, test results, and travel history. While airlines do not directly scan the Chinese Health Code for entry, they often require passengers to provide proof of vaccination via other means before boarding, such as a printed health declaration form. The Chinese government accepts WHO-listed vaccines and requires a cellular-health app integration that can be challenging for foreign travelers. China’s strict approach has led some airlines to add dedicated check-in counters staffed by Mandarin-speaking agents to handle documentation review.

Middle East: United Arab Emirates and Qatar

The Middle East has become a major transit hub, and airlines like Emirates and Qatar Airways have implemented robust verification systems. The UAE requires all passengers to present either a digital vaccination certificate with a QR code or a printed certificate approved by the National Emergency Crisis and Disasters Management Authority. Emirates Airlines uses a proprietary platform called Emirates Trusted Travel, which integrates with the IATA Travel Pass and the ICAO Visible Digital Seal. At Dubai International Airport, self-service kiosks allow passengers to upload their certificates and receive a digital clearance token before reaching the boarding gate. Qatar Airways uses the Qatar Arrivals app to pre-clear passengers, with staff performing final scans at the gate using handheld readers. Both airlines have implemented real-time data sharing with immigration authorities, enabling seamless electronic gates for pre-verified travelers.

Challenges in Vaccination Status Verification

Despite technological advancements, airlines face persistent hurdles in verifying vaccination status accurately and efficiently. These challenges affect operational costs, passenger experience, and public health compliance.

Fraud and Forgery

Fake vaccination cards and fraudulent certificates have been a worldwide problem, particularly with paper-based documentation. High-quality printers and editing software can produce convincing replicas of CDC cards or national health stamps. Even QR codes can be cloned or generated using private keys not in the official registry—though this is rare for well-maintained PKI systems. Airlines invest heavily in training staff to spot red flags such as inconsistent date formats, misspelled vaccine names, and altered security marks. Some use ultraviolet lights to check for watermarks, and others cross-check certificate numbers against a government hotline. According to a 2023 report by INTERPOL, over 10,000 cases of fake vaccine certificates were seized or identified during airport checks in the previous year. Digital signatures and PKI have dramatically reduced QR code forgery, but the system is not flawless: expired or revoked certificates may appear valid if an airline’s scanner does not refresh its revocation list frequently enough. Airlines must contract with national health authorities to receive daily updates, adding ongoing costs.

Inconsistent Standards Across Countries

One of the biggest operational challenges is the lack of a universal vaccination certificate standard. While the EUDCC is widely recognized, many countries have their own formats, data fields, and encryption methods. Airlines must maintain a library of valid certificate schemas and update it as countries modify their systems. For example, a certificate from India may include fields for booster dose and lot number, whereas a certificate from Canada may not. When data fields do not align, staff must make manual judgments, slowing the process. A 2024 study by the International Air Transport Association found that airlines spend an average of 45 seconds per passenger on vaccination checks for flights to non-standardized destinations, compared to 8 seconds for EU-bound flights. The World Health Organization and the International Civil Aviation Organization are working on a global framework—the WHO Smart Vaccination Certificate—but adoption is gradual.

Privacy and Data Security

Health data is highly sensitive, and airlines must comply with regulations like the General Data Protection Regulation (GDPR) in Europe and the Health Insurance Portability and Accountability Act (HIPAA) in the United States. Passengers are often reluctant to upload their full vaccination record to a third-party app. Airlines address this using zero-knowledge proof systems, where only specific attributes (e.g., “vaccinated: yes”; “last dose date”) are revealed, not the underlying data. However, not all apps are equally transparent. The IATA Travel Pass uses a decentralized model, storing data on the passenger’s phone and sharing only a cryptographic proof with the airline. Systems like VeriFLY encrypt records and allow passengers to delete their data after travel. Any data breach could severely damage passenger trust—a 2022 incident involving a third-party health verification provider exposed the details of 50,000 travelers. Airlines now require annual security audits for any health pass vendor they partner with.

Operational Delays and Staff Training

Manual verification of paper documents or incompatible digital certificates can cause significant queues, especially during peak travel periods. Airlines have responded by adding more check-in counters for high-risk routes and training staff to use specialized scanning apps. However, high staff turnover in the post-pandemic airline industry means that training investments must be repeated frequently. Some carriers, such as United Airlines, have introduced automated kiosks that accept document uploads at the airport, reducing reliance on human inspection. Yet even these systems require regular updates to handle new certificate formats from countries like Brazil or Indonesia. Airline operations managers report that vaccination verification adds 10–15 minutes to the check-in process for non-standard routes, which can disrupt connecting flight schedules.

Future Developments in Vaccination Verification

The lessons learned from the pandemic are shaping the next generation of health credential systems, aimed at making verification faster, more secure, and globally interoperable.

WHO Smart Vaccination Certificate (SVC)

The World Health Organization, in collaboration with the European Commission and the International Civil Aviation Organization, is developing a global Smart Vaccination Certificate (SVC) framework. This system builds on the EUDCC architecture but extends coverage to other vaccines—such as yellow fever, polio, and measles—and includes features like multilingual support, offline verification, and biometric integration. The SVC is designed to be interoperable with existing national systems, allowing airlines to use a single validation tool for multiple countries. Pilot programs have launched in several regions, including Africa and Southeast Asia, and the goal is to have a universally accepted digital health credential by 2026. The framework also includes a decentralized identity layer, giving travelers control over their data while enabling airlines to verify credentials without accessing a central database.

IATA Travel Pass and Digital Identity

The International Air Transport Association continues to evolve its Travel Pass platform. Future versions will integrate biometric matching—linking the passenger’s face to their digital health and travel documents—to create a seamless touchless experience. This would allow passengers to walk through the airport without repeatedly presenting documents. IATA is also exploring blockchain-based verification for immutable records, though scalability remains a concern. In 2024, Singapore Airlines began a trial using IATA Travel Pass with biometric e-gates at Changi Airport, reducing boarding time by 30%. Widespread adoption depends on governments agreeing to recognize the IATA Travel Pass and its underlying identity standards. Many nations are resistant to ceding control of entry requirements to private platforms.

Integration with Border Control and Electronic Gates

The ultimate vision is to embed vaccination verification into existing automated border control systems. The EU is developing the Entry/Exit System (EES), which will store travel and biometric data for non-EU nationals. Future iterations may include health credential checks, allowing travelers to clear both immigration and vaccination verification in one step. Similar projects are underway in Singapore, Australia, and the United Arab Emirates. Airlines and airport authorities are investing in common-use scanners that can read multiple credential formats and transmit validation results directly to immigration databases. This integration could reduce the need for separate health checks at check-in, speeding up the overall process.

Conclusion

The methods airlines use to verify vaccination status have become more sophisticated since the start of the pandemic, evolving from simple visual inspections of paper cards to secure digital verifications using public key infrastructure. Yet the landscape remains fragmented, with each country imposing its own requirements and certificate formats. Passengers must stay informed about the specific documentation expected by their airline and destination. For airlines, investing in flexible verification platforms that can handle multiple certificate types and adapt to changing rules is essential. The future lies in standardized, interoperable digital health credentials that enhance security while respecting privacy, making international travel both safer and more convenient for everyone. As the WHO, IATA, and national governments continue to harmonize their systems, the post-pandemic travel experience will increasingly rely on digital trust rather than paper inspections.

For further reading, see the EU Digital COVID Certificate framework on the European Commission website, the IATA Travel Pass information at IATA, and the WHO Smart Vaccination Certificate initiative at WHO.