Each country/union handles it differently, but it would be hard to fake. In general:

For the PCR test, you have to submit the date/time of the test, the result, and who provided the test 72 hours before departure. They could contact the test provider to confirm. People have been denied entry into Canada because they considered their test provider illegitimate.

For injection certification, staff at injection locations (or testing locations) submit information to the government, and the government stores it in a database. The government then provides a document to the injected person , which contains a QR code. If the QR code is scanned, it will connect to wherever that data is stored to provide verification. Within the EU, the home country will just confirm whether it's a pass or fail, in other countries, it may show all the stored data (name, birth date, injection type, date of injection, and anything else).