Portpass verified a fake vaccine record, then broke down before a Flames game

A Calgary app for storing and sharing COVID-19 vaccination records and test results with venues and employers.

That a private app, not a government system, could become Alberta's de facto vaccine passport — with 'AI and blockchain' making its records trusted and tamper-proof.

Calgary founder and CEO Zakir Hussein built Portpass as a private proof-of-vaccination app while the province still had no digital pass, and Calgary Sports and Entertainment Corporation recommended it for Flames and Stampeders games.

Local web developer Conrad Yeung uploaded a random mayoral candidate's photo as his driver's licence, then a fake vaccination record with an actor's name — Portpass verified it as legitimate. Yeung found no security-certificate validation, a publicly reachable backend, data hosted in an Amazon data centre in Ohio despite the site claiming data stayed in Canada, and no evidence of the advertised AI and blockchain. The app's named partner, the Canadian Digital Health Network, linked back to Portpass itself and served 404 pages. When CBC called Hussein, he hung up mid-interview and did not return follow-ups.

The core verification feature did not verify: forged IDs and fabricated records passed as legitimate.

Its security claims — Canadian data residency, AI and blockchain checks — were contradicted by what was actually hosted and shipped.

The app's credibility leaned on a named health-network partner whose own website pointed back to Portpass and served dead links.

The CEO abandoned a recorded interview when confronted with the findings, and the company went silent as the app failed publicly.

It bet its distribution on a venue operator's endorsement without the reliability to survive a single game-day load.

Claiming technologies you have not shipped — AI, blockchain, local data residency — collapses the moment one curious user looks under the hood; a distribution partner's logo is not diligence.

Within hours of CBC's call, users saw a grey screen reading 'undefined undefined' instead of a name. Less than two hours before the Flames pre-season game on 26 September 2021, the company tweeted it was having 'technical difficulties' and told ticket holders to bring printed records; fans reported being stuck outside the Saddledome. Yeung said he then received a call from someone claiming to be a police officer about his 'spam tweets', quoting a badge number Calgary police said did not exist. Portpass did not respond to further requests for comment.