The French Embassy in Dublin has contacted gardaí after “an upsurge” in cases of unauthorised individuals targeting its visa appointment booking system, Prime Time has learned.
Tens of thousands of migrants legally resident in Ireland must get a visa if they wish to travel to any of the 27 European countries that make up the Schengen Area, including France.
To get a French visa, applicants must attend an in-person appointment at the embassy to present documents such as a passport and bank statement.
The appointments are booked online, but they are extremely difficult to get.
In an effort to secure a visa appointment legitimately, Prime Time checked daily for available appointments for 20 Schengen countries over a period of between two and four weeks, depending on the country.
Despite such sustained effort, we could only find two appointment slots – one for Greece and one for Germany.
The reason that there are so few appointments available to the public is because, apparently using automated systems, online brokers seize slots as soon as embassies release them on their websites.
Those who need these in-person visa appointments are non-EU citizens living here, from 105 nations, including India, China, the Philippines and South Africa.
Those who illicitly access embassy booking systems to capture appointment slots, then resell them, seeking sums mostly ranging from €40 to over €100 per slot. On the other hand, visa appointments booked via the website of an embassy or its agent company are generally free, if you can secure them.
A French Embassy spokesperson told Prime Time that its measures to combat unauthorised access to booking systems have “not been sufficient to stop the phenomenon.” He also noted that the issue is “…a widespread phenomenon worldwide, affecting indiscriminately visa services of all Schengen member countries.”
“We are in contact with An Garda Síochána and we are taking technological [action]… so that the security of our software and online services adequately evolve and adapt in order to counter these activities.”
Dublin City University tutor Lijie Shao refuses to pay shady online brokers to get a visa appointment to visit Europe, partly because of fears that her personal information may be “compromised.”
Ms Shao despairs at the failures of embassy online booking systems, especially the French Embassy’s. She would like to visit her brother, who is living in France, and has recently checked appointments for the months of March and April.
“There are no appointments at all,” she told Prime Time. She also believes that the failures of the Schengen visa system “definitely limits my professional development” because it makes in-person collaboration with colleagues in Europe very difficult.
“Of course, nowadays you can always say, ‘okay, you have a meeting on Zoom’, but it’s never as effective as going to that university and meet that person and sit down and discuss the project properly,” she said.
Because Ms Shao has lived in Ireland for over 10 years, she would qualify for an Irish passport, but her native China does not allow dual citizenship.
“If I apply for Irish passport, that means I have to give up my Chinese citizenship. But I have family in China, so does my husband. So, I do not want to cut off the connection to China.”
Security concerns
RTÉ hired researcher Suhasini Srinivasaragavan to examine the process of getting a visa to a Schengen country. An Indian national, she has the right to live and work here, but to travel to another European country in the Schengen area, she needs a visa.
Every day for a month, she checked for a Schengen visa appointment for Spain, France and the Netherlands. None was available.
After failing to find one legitimately, she went online, where there was no shortage of brokers selling their services.
One of them was John Hoo. He logged on directly to the French Embassy website and was able to book an appointment for her. He charged a fee of €70. His action may be illicit, but the appointment slot was genuine.
Ms Srinivasaragavan attended and paid the embassy a visa processing fee of €80. She received a Schengen visa.
During the booking process, Mr Hoo asked to take control remotely of Ms Srinivasaragavan’s computer.
We showed the footage of the interaction to cyber security expert Paul C Dwyer.
“She’s given him control of the computer so effectively you are letting the guy into your room'” he told Prime Time.
Watching our footage of Mr Hoo using his technique to book a slot on the embassy website, Mr Dwyer said, “…he is exploiting vulnerabilities within that website. So that he can actually select the appointments that he wants. What we’re seeing on the right-hand side is the ‘behind-the-scenes’, the code, if you like. And he can inject different commands in there to make it do what he wants it to do.
John Hoo’s business may be unscrupulous but it’s thriving. Prime Time has evidence that he has been selling visa appointments for over six months. While dealing with Ms Srinivasaragavan, he was booking appointments for at least four other applicants.
Prime Time could clearly see the personal details of those other customers being input on the applications he was making on the embassy website, including email addresses, phone numbers and dates of birth.
“There’s no regard for security or privacy around the other applicants’ details. But what that really indicates to me is how busy this guy is. So, there’s obviously an insatiable demand for what he’s offering,” Mr Dwyer said.
With the difficulty of securing Schengen visa appointments through proper channels, “You have two grim options,” noted Ms Srinivasaragavan.
“One is that you don’t go anywhere, you just stay in Ireland the other is that you risk your personal data by reaching out to… strangers on the internet.”
In response to questions from Prime Time, John Hoo said that “None of our team members engage in hacking or any illegal activities related to visa appointment systems. We do not ask for any information in most cases, and even in rare cases, the data is promptly deleted after the appointment is booked.”
While looking for help to get a visa appointment for the Dutch Embassy, another man offered a different country instead.
Unlike the French Embassy in Dublin, the Finnish and Dutch embassies use a private company, VFS Global, to manage their appointments.
It turns out that the booking system handled by VFS can also be illicitly accessed. In a statement, VFS Global said it had “…put in place strong measures to stop unauthorised agents engaging in this practice and are constantly reviewing and strengthening these measures to combat abuse.”
Mr Dwyer describes it as “a cat-and-mouse game where you continue to update your systems, continue to improve them and the security. They need to manage the risk around using cyber and technology. From that perspective, they’re doing a really poor job… at giving out appointments for visas.”
In a statement to Prime Time, the Embassy of Finland said that “various technical means are used” to combat the possible misuse of appointments “such as single-use passwords (OTP) and CAPTCHA tests.” It also said that “suspicions of misuse of appointments are taken seriously and thoroughly investigated.”
At a time when Ireland is close to full employment, our economy relies heavily on immigrants, including those from outside the EU, who are affected by Schengen visa problems.
The Nursing and Midwifery Board told Prime Time that, last year, more than half (3,272) of all newly registered nurses and midwives were trained in India. And Bus Éireann said that of its almost 2,000 passenger drivers, 9% are from outside the EU. Other sectors such as the meat industry rely heavily on non-EU labour.
Feeling ‘trapped’
Mina Benyamine moved to Cork with his young family over 5 years ago. Mr Benyamine is a microchip designer from Egypt. He was head-hunted from the Netherlands to Ireland, where he is employed on a critical skills visa.
He and his wife Sherry miss the freedom to travel that they previously enjoyed in the Netherlands.
“If you’re somewhere in Holland or Germany, if you live there, you can easily just hop on a train and go somewhere and even come back the same day if you want. But for us, we have to go through a lot just to travel” Sherry said.
Like Lijie, the couple refuse to pay an online stranger to get the four Schengen visa appointments needed for their family to visit mainland Europe. This means that they spend hours on the websites of embassies and legitimate firms handling visa applications, refreshing them in the hope that a visa appointment will eventually turn up. If they do get lucky, it is just one step in the application process.
“Then we have to go to Dublin for the appointment; we present a lot of documents…from bank statements to letters from work; letters from school; to travel insurance, all of that. Just to get a visa just to go on holidays. It’s a lot of money, it’s a lot of time and a lot of work,” Sherry says.
A non-EU citizen living in the Schengen area with a residence permit can travel freely through 27 countries across Europe. They can travel, for example, from Malaga in Spain all the way to Lapland in Finland, a journey of 5,000km without showing a passport.
But in the Republic of Ireland, tens of thousands of Indians, Chinese and other non-EU residents cannot even legally travel from Dublin to Belfast without a special visa. So, while the free travel area for non-EU workers in Europe covers nearly 30 countries, in Ireland, tens of thousands of people living in Ireland can’t even travel freely throughout the island.
At least the UK visa system seems to work better. Appointments to get a UK visa are more readily available. It is more expensive, though – a visa will cost €160, but getting it shouldn’t necessitate hiring a shady online broker and sharing sensitive passport and other details with them.
Until Schengen countries adopt systems that defeat the online visa appointment dealers, making foreign-travel plans will be very cumbersome, especially for families like Mina Benyamine’s.
“We feel that we’re a bit trapped or we don’t have the option of travelling,” Sherry said. “We came here just to enjoy Ireland. We love it so much, but we want to explore as well and that’s really restricting here.”
Paul Murphy, Isabel Perceval and Suhasini Srinivasaragavan’s investigation into illicit visa brokers features on the 21 March edition of Prime Time, on RTÉ One television, and on RTÉ Player.
