Scammers Are Selling Fake COVID-19 Vaccination Cards Online

Criminals are looking to cash in on the U.S. immunization push against COVID-19 by selling forgeries of government-issued "vaccination record cards" that show people have been inoculated.

Hundreds of fraudsters are selling blank or forged versions of the cards over ecommerce sites including eBay, Etsy and Shopify, while also running advertisements for the fakes on Facebook, according to Saoud Khalifah, CEO of Fakespot, which uses artificial intelligence to detect online retail scams. And with names such as blankcovidcard.com, such sellers are hardly discreet.

"In January we started noticing Shopify stores selling fake vaccination cards, and that was really interesting because it introduced a new dynamic to society where people can counterfeit immunity and interplace it with a fake card," Khalifah told CBS MoneyWatch. "It's a new concept we haven't seen before."

Fakespot has identified hundreds of different sellers that have cropped up since the beginning of the year, and the firm estimates they've hawked thousands of false records over the past three months. Online retail sites have banned some bad actors, who then often reappear and sell fake cards under different names, according to Khalifah. 

The low-tech vaccine records are easy to replicate. The 4-by-3-inch, double-sided paper cards bear the logo of the federal Centers for Disease Control and Prevention in black and white, along with a cardholder's name and birthdate. They also note the drugmaker, lot number, and date and location for the administered vaccine. The information is annotated either in pen or on a printed sticker.

One seller, whose Shopify store is now defunct, was selling a pack of four blank vaccination cards for $80.

Prosecutors call for action

Shopify, a platform that allows retailers to create ecommerce sites, said it has acted swiftly against users of its technology who are trying to sell fraudulent vaccine cards. Hawking bogus cards violates the company's policies, the company told CBS MoneyWatch, noting that it has been monitoring its platform for such schemes since February.

The National Association of Attorneys General last week called on eBay, Shopify and Twitter to stop people from selling or advertising fake CDC vaccine cards on their platforms. To date, Shopify has terminated three stores it found to be selling fake or blank vaccination cards, or fraudulent vaccine stamps.

"If our search identifies a potentially prohibited product, our team swiftly reviews the store and product and takes appropriate action," Vivek Narayanadas, Shopify's vice president of legal, wrote in a letter to the National Association of Attorneys General. 

"All stores that we identified for violating our policies were actioned swiftly," Narayanadas said in a statement to CBS MoneyWatch. 

Etsy also confirmed that the sale of phony vaccine cards violates the site's rules and that it is removing any posts advertising the fake records. EBay said it blocks or quickly removes items on its marketplace that make false health claims, "including vaccine ID cards or any similar items that could be used to falsely represent a person has received the vaccine."

A Twitter spokesperson said it has ramped up efforts to block misinformation and has deleted tweets and accounts that violate its policies on misleading information. Facebook did not immediately reply to a request for comment. 

Khalifah of Fakespot suspects some purchasers of the fake cards are "anti-vaxxers" who don't plan on becoming vaccinated but want whatever access a card can afford them.

For example, airlines and the travel industry are weighing whether to require proof of vaccination for travel. Some countries, including Mexico, require visitors to submit negative COVID-19 tests for entry. Proof of vaccination could be next, according to some experts. 

Individuals who aren't yet eligible for the vaccine, or who can't book an appointment, can also falsify a blank card to make it appear as if they've received one dose of the vaccine and are due for a second, allowing them to cut lines.

"You can buy little booklets with fake stamps so you can bypass the whole system the government has created," Khalifah said. 

Tools designed to digitize paper records aim to combat this kind of fraud by verifying and storing individuals' records in secure, online vaults. 

"That would make the counterfeiting of physical papers difficult to conduct, but there will still be hackers who can hijack other people's identities, so it won't be bulletproof," Khalifah said. 

Red flags

VaxYes, a tool that turns the paper cards into digital vaccine certificates, put individuals through multiple rounds of security checks to ensure that their records are authentic. The company also uses artificial intelligence and trained medical professionals to scan the cards for any irregularities indicating they might be falsified.

"We're getting thousands of cards and by now everyone is familiar with them, so we're asking if there are anomalies compared to other cards," VaxYes CEO Mohamad Gaber told CBS MoneyWatch. 

Gaber said that less than 2% of the cards VaxYes has reviewed have been "questionable" or outright inauthentic. Cards that fail to note a vaccine's lot number or bearing handwritten lot numbers rather than printed stickers raise red flags. 

"A lot of people have generated these cards because they are very simple to recreate. We've seen a number of versions of cards people have downloaded and filled out, unauthorized," he said. 

Against the law

Selling fake vaccination cards violates federal laws that prohibit the unauthorized use of an official government agency's seal, including the one used by the CDC, the FBI said in a statement last month. 

The FBI also warned people against participating in related scams that could constitute a crime. "If you did not receive the vaccine, do not buy fake vaccine cards, do not make your own vaccine cards and do not fill-in blank vaccination record cards with false information," the Bureau said. "By misrepresenting yourself as vaccinated when entering schools, mass transit, workplaces, gyms or places of worship, you put yourself and others around you at risk of contracting COVID-19."

Making fraudulent use of an official U.S. government seal is a felony that carries a maximum penalty of five years in prison. Individuals who forge a vaccination cards to travel, return to work or attend events can also be charged criminally for knowingly putting other people at risk of getting COVID-19. 

"If I have never been vaccinated and am at high risk for transmitting COVID-19 and I'm in a public place, and it turns out I'm 'patient zero' and I got other people sick — or someone died — I could be charged with some kind of criminally negligent or reckless homicide," said Randy Zelin, a criminal defense attorney at Wilk Auslander. "I would have closed my eyes to the high probability that I could kill someone, and I went ahead and did it anyway."

First published on April 9, 2021 / 4:07 PM

© 2021 CBS Interactive Inc. All Rights Reserved.