Vaccine certificates are likely to be granted to people without a person needing any actual proof they've been vaccinated.
And the certificates themselves could be ripe for misuse, because there is no identification needed for the proposed system, and people did not have to provide ID when getting their innoculation.
Covid-19 Response Minister Chris Hipkins said venues could ask for ID alongside a vaccine passport to mitigate the risk.
A source inside the Ministry of Health told RNZ the vaccine certificate app being developed has a number of flaws.
The key issue is that a person with a certificate will have offered no proof they have actually been given the Pfizer vaccine.
"As proof of vaccination becomes increasingly mandated, anti-vaxxers will come under increasing pressure obtain vaccine certificates in order to keep their jobs, to travel and to participate in public events," they said.
"This will provide motivation for fraud - an anti-vaxxer could easily book a vaccine appointment and pay someone to receive it on their behalf, for example."
They said there is no evidence fraud is happening, but there is also nothing to stop it.
"As the system currently operates, there is no capability to detect, monitor or prevent such abuse, and there is no way to prove that you have actually had a vaccine.
"It's a problem that can't be retrospectively fixed."
Ministry of Health national digital services group manager Michael Dreyer said no decisions have been made about domestic use of a vaccine certificate.
"The government is still considering advice around the use of vaccination certificates domestically as a way to enable large events to go ahead. However, no decisions have been made at this stage."
Asked if a person can prove, without a doubt, they have been vaccinated before receiving a certificate, Dreyer said it is something they are working on.
He said all Covid vaccinations are noted in the national Covid-19 Immunisation Register, but the Ministry of Health source told RNZ there is no guarantee that register is accurate.
"When you turn up to get a Covid vaccination you are not asked for proof of identity, or even to show the text message with your booking reference - you are simply asked to verbally state your name and date of birth," they said.
"By virtue of turning up at your designated appointment time it is assumed that you are the person for whom the booking was made."
Dreyer said information for vaccination certificates will be drawn from the Covid-19 Immunisation Register.
Chris Hipkins said it will be left to venues to enforce any rules that are put in place.
"The vaccine certificate will have a person's name on it, the ability to check that against the database to make sure it's an authentic vaccine certificate using QR code technology," Hipkins said.
"The person checking it will be able to scan the QR code and check the name against the name that's on the database for that QR code, if that makes sense?"
There will not be any proof of identity function to the vaccine certificate, but Hipkins has a work around.
"It would be wise of course to check that the name that someone is presenting with, is actually their name.
"They may ask for some other identification for that purpose."
That process still would not prove, without a doubt, that the person actually received a vaccine.
The My Covid Record vaccine certificate is expected to be available by November.
