'Ripe for fraud': Coronavirus vaccination cards support burgeoning scams
By DAN DIAMOND | The Washington Post | Published: April 18, 2021
Stars and Stripes is making stories on the coronavirus pandemic available free of charge. See more staff and wire stories here. Sign up for our daily coronavirus newsletter here. Please support our journalism with a subscription.
One listing offered eBay customers an "Authentic CDC Vaccination Record Card" for $10.99. Another promised the same but for $9.49. A third was more oblique, offering a "Clear Pouch For CDC Vaccination Record Card" for $8.99, but customers instead received a blank vaccination card (and no pouch).
All three listings were posted by the same eBay user, who goes by "asianjackson" — using an account registered to a man who works as a pharmacist in the Chicago area — and all were illegal, federal regulators say. The account sold more than 100 blank vaccination cards in the past two weeks, according to The Washington Post's review of purchases linked to it.
The listings are a "perfect example" of burgeoning scams involving coronavirus vaccination cards that could undermine people's safety, as well as the success of the nation's largest mass vaccination effort, said North Carolina Attorney General Josh Stein. Individuals might use them to misrepresent their vaccination status at school, work or in various living and travel situations, potentially exposing others to risk.
Stein, who led a recent effort with 47 colleagues demanding that eBay and other e-commerce platforms crack down on the scams, pointed to the FBI's warning that anyone who makes or buys a fake vaccine card is breaking the law, and said he would consider prosecution, too.
"This is a concern that is national and bipartisan," Stein added, saying the spread of fake vaccination cards "will extend the pandemic, resulting in more people sick and more people dead."
At least 129.5 million Americans have gotten at least one or both doses of a coronavirus vaccine and have received a free proof-of-vaccination card with the logo of the Centers for Disease Control and Prevention, as officials push to inoculate the nation. But that vaccination drive has pitted people like asianjackson, selling blank or fake credentials, against law enforcement officials rushing to stop them — and warning that the full scope of the problem is impossible to grasp.
The clash has escalated as businesses and universities say they'll require proof of vaccination before allowing Americans to board cruises, enter some stores and even return to college classes, prompting some vaccine-hesitant people to search for false IDs or make their own. And the showdown is unfolding amid a bitter national debate about whether Americans should have digital "vaccine passports" instead of paper cards, and whether the government should be involved in credentialing such efforts.
For months, officials have been a step behind the scammers, who have openly discussed strategies to fake the cards on social media, sold them on sites such as eBay and pulled blank photos off state websites. Federal officials' decision to use paper cards that can be easily photocopied or even printed off a template, rather than a digital tracking system, worsened those risks.
"This is exactly the scenario that you want to guard against. It undermines the entire effort by having falsified cards out there," said Jennifer Kates, who oversees global health policy for the Kaiser Family Foundation and reviewed asianjackson's eBay listings. "It certainly bolsters the argument for a digitized mechanism — which isn't a tamper-proof system, but certainly a more secure one."
"Paper anything is ripe for fraud," said Nenette Day, an assistant special agent in charge at the Department of Health and Human Services' inspector general's office who oversees whistleblower tips. Day said she has reviewed dozens of reported vaccination-card scams that range from Americans stealing blank cards to sharing tips on how to fake a card on social media. She described the trend as among the most frustrating chapters in a 20-year career that included responding to the 9/11 terrorist attacks as an FBI agent.
"I feel like nobody has taken this to its natural conclusion," Day said, hypothesizing about a scenario where an unvaccinated person could illegally create a vaccination card and pretend to be immunized, using that to enter a high-risk environment such as a nursing home, then unknowingly spread the virus, potentially resulting in someone's death. "It disturbs me, having been in law enforcement this long, this flippant attitude that people have."
While e-commerce platforms cracked down on listings after recent news reports, there are already signs that the supply of the cards is bouncing back, said Saoud Khalifah, chief executive of Fakespot, a company that specializes in rooting out online fraud and that began tracking fake vaccine cards in February.
"We've seen ads on Facebook and TikTok and other social platforms being used to target these anti-vaxxers," Khalifah said. "There's demand from people who don't want to get vaccinated, but also people who think they can use the cards to skip the line (and) say, 'Hey, I got dose one, can I get dose two?' "
Some federal officials involved in the vaccine drive said that last summer, they had initially discussed using digital systems to track the vaccine push and to help Americans manage getting shots. CDC officials believed they could harness the nation's dozens of immunization information systems, which track shots administered by providers within a specific geographic area.
"IT/data infrastructure supports entire distribution, ordering, tracking process from end-to-end," according to a July slide deck about the CDC's planned vaccine rollout that was obtained by The Washington Post. The slide deck made no mention of using paper cards.
A CDC letter sent the following week, also obtained by The Post, similarly touted using IT systems to manage the vaccine rollout, including "record-keeping for the vaccine recipient," with no mention of paper cards.
Pamela Schweitzer, a retired assistant surgeon general who helped with the coronavirus response last year, said that she and her colleagues were aware in June that the CDC was focusing on a "comprehensive IT infrastructure" to help Americans track their vaccinations before opting for paper cards as a fallback later in the year.
A former administration official closely involved in the vaccine effort who spoke on the condition of anonymity to discuss private conversations confirmed initial plans for "a digital system with digital reminders about when to get your shot, like, 'Your library book is due in five days.' " But technical setbacks and time pressure forced the administration to rely instead on paper cards, which the CDC had positioned as a "fail-safe," the official said.
"If there had been a vaccine during the 1918 flu pandemic, you could probably have used the same exact card — just with different logos at the top," the official said, adding that the paper cards, which are passed around in health settings and potentially handled by sick patients, were not ideal for curbing safety risks. "It's a hard, tactile object in the middle of the pandemic. It's a pretty gross thing to have."
Paul Mango, a former Trump administration official who helped oversee Operation Warp Speed, the administration's vaccine accelerator, acknowledged that "there were many complexities, technical and otherwise, associated with digital vaccination tracking, so for exigency purposes, we fell back on vaccination cards."
While state and local immunization registries do store individual coronavirus vaccination data, officials said there's no current system that would allow businesses, schools and other organizations to easily check the databases to see if a visitor was presenting a falsified paper card.
HHS did not respond to questions about health officials' decision to opt for paper cards and whether that increased the risk of scams. An HHS spokesperson pointed to an October playbook that instructed accredited vaccinators to provide "a completed COVID-19 vaccination record card to every vaccine recipient/parent/legal representative."
Private-sector organizations, including pharmacies such as Walmart and Walgreens, have recently mounted a push for using digital "vaccine passports" for Americans to prove they've gotten shots, arguing such systems would better track vaccinations and protect against fraud. But federal officials have struggled to corral the initiatives and adopt a standardized approach, particularly as the issue has become politicized in recent weeks.
Even as public health officials warn about the risk of fraud, some states have inadvertently boosted it. The Post identified several states, including Tennessee and Texas, that posted blank card templates to their health department websites among their coronavirus-related resources. Some social media users have boasted that they had printed the documents to produce their own fake cards.
Day, the official at the HHS's inspector general's office, recounted an explosion of whistleblower tips related to vaccination card scams in the past month. "On any given day, it's 40 to 50 percent of our covid-related complaints," she said.
One report was about a woman who worked in a vaccination clinic and gave a blank card to her boyfriend. The boyfriend then detailed on social media how he had filled in the card himself and bragged about the accomplishment, Day said.
Schweitzer, who has volunteered at multiple vaccination clinics across Arizona, compared the abundance of blank vaccination cards at those sites to doctors not protecting their prescription pads.
"There's limited control over these cards," she said. "They're all over the place. It's pretty easy to get a stack."
Asianjackson — the eBay account maintained by a man who works at a Chicago-area location of a national pharmacy chain — sold at least 110 blank vaccination cards through eBay, including 50 cards alone on April 11, according to a Post review. The Post obtained one of those cards, which was identical to the CDC vaccination cards dispensed by pharmacies, and sent from a Zip code in the greater Chicago area.
Law enforcement officials said they are alarmed by the possibility that eBay users such as asianjackson are taking blank cards from pharmacies or other health-care facilities where they work.
"That's very troubling," said Stein, the North Carolina attorney general. "That's an instance where it's an actually authentic card but illegally acquired and sold."
When contacted by The Post through the full name offered on the eBaysales receipt, the man who uses the "asianjackson" account confirmed he lives in the Chicago area and works in a pharmacy, and listed other items sold through the account, such as empty boxes from luxury-goods retailers like Hermès and Chanel. But he claimed he had not used eBay this month and had no knowledge of any vaccination card sales.
"I need to get that straightened out with eBay," the man said, claiming he had stopped using the service after his password was unexpectedly changed about two weeks ago. The Post is not identifying him because he disputes he sold the cards.
After The Post brought the listings to eBay's attention on Thursday, the company removed them. "Our team has reviewed and taken appropriate action," said eBay spokesperson Parmita Choudhury, who declined to disclose additional details about the account.
Pharmacies insist they have protections in place to track the blank cards they receive and would know if any cards were wrongly removed.
"Our pharmacies receive a limited number of CDC dose cards as part of the CDC immunization supply kits shipped to the stores that are receiving and administering coronavirus vaccines," Walgreens spokesperson Erin Loverher said in a statement.
"We store and monitor the vaccination cards in our pharmacies and each vaccine card is a 1:1 match for the vaccine doses in a pharmacy's inventory, so we would know if any are missing," said Mike DeAngelis, a CVS spokesperson.
Still, scammers have had a field day, getting plenty of help from the public, not just in making fake cards but also in committing identity theft: Many Americans put pictures of their vaccination cards online, sharing information such as the day of their shot, their birthdays and other identifying details. The trend, intended to boost vaccine acceptance, has alarmed regulators. "While the #COVID19 vaccine helps protect against the virus, posting your vaccine card online opens you up to another type of plague — scammers who would use the document to steal your identity," Ashley Moody, Florida's attorney general, wrote on Twitter in February.
Day agreed that those pictures have helped scammers get the details right, including vaccine manufacturer and lot information. "They can fill out their cards, which would have at least some level of legitimacy, because they had the right numbers and letters for the lot numbers," she said.
Khalifah, the Fakespot CEO, said regulators face persistent challenges because of how easy the cards are to exploit.
"Let's speak bluntly about this. We're talking about paper and stamps — technology that's been around for a while," Khalifah said, adding that some people selling cards online are involved in other long-running scams. "There's overlap with these stores and others selling fake Gucci bags. They'll leverage fake reviews, fake upvotes. There's a lot of fraud."
Officials said it's impossible to get a true picture on the number of Americans who have faked vaccine cards themselves or have bought them online. "It's not the kind of thing that the person buying is going to report. In some ways, they're complicit," Stein said.
"Anything that's going to delay the end of this pandemic is incredibly unfortunate and counterproductive," he added. "These vaccine cards will do just that."