Scammers are selling fake COVID-19 vaccination cards online
Criminals are looking to cash in on the U.S. immunization push against COVID-19 by selling forgeries of government-issued "vaccination record cards" that show people have been inoculated.
Hundreds of fraudsters are selling blank or forged versions of the cards over ecommerce sites including eBay, Etsy and Shopify, while also running advertisements for the fakes on Facebook, according to Saoud Khalifah, CEO of Fakespot, which uses artificial intelligence to detect online retail scams. And with names such as blankcovidcard.com, such sellers are hardly discreet.
"In January we started noticing Shopify stores selling fake vaccination cards, and that was really interesting because it introduced a new dynamic to society where people can counterfeit immunity and interplace it with a fake card," Khalifah told CBS MoneyWatch. "It's a new concept we haven't seen before."
Fakespot has identified hundreds of different sellers that have cropped up since the beginning of the year, and the firm estimates they've hawked thousands of false records over the past three months. Online retail sites have banned some bad actors, who then often reappear and sell fake cards under different names, according to Khalifah.
The Washington Post also recently uncovered an eBay seller who sold more than 100 blank vaccination cards over the course of two weeks, according to the newspaper's review of purchases linked to the account. The account was registered to a man who works as a pharmacist in the Chicago area, WaPo reported.
The low-tech vaccine records are also easy to replicate. The 4-by-3-inch, double-sided paper cards bear the logo of the federal Centers for Disease Control and Prevention in black and white, along with a cardholder's name and birthdate. They also note the drugmaker, lot number, and date and location for the administered vaccine. The information is annotated either in pen or on a printed sticker.
One seller, whose Shopify store is now defunct, was selling a pack of four blank vaccination cards for $80.
Almost 130 million people 18 or older — roughly half of the total U.S. adult population — have received at least one dose of the coronavirus vaccine, according to the Centers for Disease Control and Prevention, and have received authentic vaccination cards.
Prosecutors call for action
Shopify, a platform that allows retailers to create ecommerce sites, said it has acted swiftly against users of its technology who are trying to sell fraudulent vaccine cards. Hawking bogus cards violates the company's policies, the company told CBS MoneyWatch, noting that it has been monitoring its platform for such schemes since February.
The National Association of Attorneys General at the beginning of April called on eBay, Shopify and Twitter to stop people from selling or advertising fake CDC vaccine cards on their platforms. To date, Shopify has terminated three stores it found to be selling fake or blank vaccination cards, or fraudulent vaccine stamps.
"If our search identifies a potentially prohibited product, our team swiftly reviews the store and product and takes appropriate action," Vivek Narayanadas, Shopify's vice president of legal, wrote in a letter to the National Association of Attorneys General.
"All stores that we identified for violating our policies were actioned swiftly," Narayanadas said in a statement to CBS MoneyWatch.
Etsy also confirmed that the sale of phony vaccine cards violates the site's rules and that it is removing any posts advertising the fake records. EBay said it blocks or quickly removes items on its marketplace that make false health claims, "including vaccine ID cards or any similar items that could be used to falsely represent a person has received the vaccine."
A Twitter spokesperson said it has ramped up efforts to block misinformation and has deleted tweets and accounts that violate its policies on misleading information. Facebook did not immediately reply to a request for comment.
A bipartisan group of attorneys general this week called on another online sales platform, OfferUp, to crackdown on the sale of blank or fraudulent COVID-19 vaccine cards, including those bearing the logos of the CDC and the Department of Health and Human Services.
"We are deeply concerned about this use of your platform to spread false and misleading information regarding COVID vaccines," read the NAAG's letter to OfferUp. "The false and deceptive marketing and sales of fake COVID vaccine cards threatens the health of our communities, slows progress in getting our residents protected from the virus, and are a violation of the laws of many states."
North Carolina Attorney General Josh Stein, the group's vice president, told CBS MoneyWatch OfferUp "responded positively" to the demand.
While Stein doesn't know exactly how widespread this kind of fraud is, he and his fellow attorneys general "Are very concerned about the scale of fake vaccination cards for sale on various ecommerce sites," he told CBS MoneyWatch. "So we're writing to them to put them on notice about these product listings, encouraging them to better police their websites and for them to immediately take down any listing of fake vaccination cards."
The threat to public health is most concerning to Stein.
"These cards will result in more people becoming sick by more variants of the virus and more people dying as the pandemic takes longer to get under control," he said. "By not getting the vaccine, it means more people will get infected with variants and that threatens everyone's health."
Unauthorized access
Khalifah of Fakespot suspects some purchasers of the fake cards are "anti-vaxxers" who don't plan on becoming vaccinated but want whatever access a card can afford them.
For example, airlines and the travel industry are weighing whether to require proof of vaccination for travel. Some countries, including Mexico, require visitors to submit negative COVID-19 tests for entry. Proof of vaccination could be next, according to some experts.
Individuals who aren't yet eligible for the vaccine, or who can't book an appointment, can also falsify a blank card to make it appear as if they've received one dose of the vaccine and are due for a second, allowing them to cut lines.
"You can buy little booklets with fake stamps so you can bypass the whole system the government has created," Khalifah said.
Tools designed to digitize paper records aim to combat this kind of fraud by verifying and storing individuals' records in secure, online vaults.
"That would make the counterfeiting of physical papers difficult to conduct, but there will still be hackers who can hijack other people's identities, so it won't be bulletproof," Khalifah said.
Red flags
VaxYes, a tool that turns the paper cards into digital vaccine certificates, put individuals through multiple rounds of security checks to ensure that their records are authentic. The company also uses artificial intelligence and trained medical professionals to scan the cards for any irregularities indicating they might be falsified.
"We're getting thousands of cards and by now everyone is familiar with them, so we're asking if there are anomalies compared to other cards," VaxYes CEO Mohamad Gaber told CBS MoneyWatch.
Gaber said that less than 2% of the cards VaxYes has reviewed have been "questionable" or outright inauthentic. Cards that fail to note a vaccine's lot number or bearing handwritten lot numbers rather than printed stickers raise red flags.
"A lot of people have generated these cards because they are very simple to recreate. We've seen a number of versions of cards people have downloaded and filled out, unauthorized," he said.
Against the law
Selling fake vaccination cards violates federal laws that prohibit the unauthorized use of an official government agency's seal, including the one used by the CDC, the FBI said in a statement last month.
The FBI also warned people against participating in related scams that could constitute a crime. "If you did not receive the vaccine, do not buy fake vaccine cards, do not make your own vaccine cards and do not fill-in blank vaccination record cards with false information," the Bureau said. "By misrepresenting yourself as vaccinated when entering schools, mass transit, workplaces, gyms or places of worship, you put yourself and others around you at risk of contracting COVID-19."
Making fraudulent use of an official U.S. government seal is a felony that carries a maximum penalty of five years in prison. Individuals who forge a vaccination cards to travel, return to work or attend events can also be charged criminally for knowingly putting other people at risk of getting COVID-19.
"If I have never been vaccinated and am at high risk for transmitting COVID-19 and I'm in a public place, and it turns out I'm 'patient zero' and I got other people sick — or someone died — I could be charged with some kind of criminally negligent or reckless homicide," said Randy Zelin, a criminal defense attorney at Wilk Auslander. "I would have closed my eyes to the high probability that I could kill someone, and I went ahead and did it anyway."
Attorney General Stein is instead encouraging Americans to sign up for a COVID-19 vaccination and obtain a genuine record card for free. "That way you don't have to pay for a fake one on the internet," he said.