Some peddle clumsy knockoffs — cheap paper rectangles that read “COVLID” instead of “COVID” and use mismatched typefaces and bad Spanish translations. Most offer cards that are virtually indistinguishable from the real thing, which pretty much everyone who has one or has seen one agrees isn’t too hard.
Some sellers even promise to input a customer’s fraudulent data into hospital or state databases, backstopping a paper lie with an official digital record.
Hear more from Steve Reilly and Jason Paladino about this story:
“If you don’t want to take the deadly and satanic COVID vaccine but want to travel around the world without a hitch, click on our contact information below,” a Telegram account called “COVID-19 VACCINATION CARDS” teased to potential buyers. A photo of foot-tall stacks of blank vaccination cards illustrates the pitch.
In a video posted to the Telegram group “Covid-19 CDC NHS Passport,” someone flips through a thick stack of blank Centers for Disease Control and Prevention vaccine records like a deck of playing cards. Below the video, a caption read: “Order your vaccine cards and certificate today and stay away from the poisonous vaccine.”
Another Telegram seller, going by the name “Dr Lesley,” promoted their operation by sharing a photo of industrial equipment and stacks of counterfeit vaccination cards.
They’re just a few of thousands of online sellers offering fake vaccine credentials, a Grid investigation found. Vendors advertise their wares openly on Facebook, Twitter and other popular platforms. When we made contact with sellers there, they directed us to other platforms, particularly Telegram, to complete sales. Nearly all requested payment in cryptocurrency and provided detailed instructions on how to do so.
The evidence overwhelmingly suggests that fake CDC vaccination cards are widespread in the United States. An Economist/YouGov poll last October reported 12 percent of American adults under 30 knew someone with a fake vaccine card. TMZ covered fake cards. A fake vaccine card was a punchline for a “Saturday Night Live” sketch.
Each false credential weakens the credibility of every real card, experts and officials say, diminishing the overall reliability of the cards as proof of vaccination. Proof of vaccination is key to the reopening process for workplaces and public venues, but Democratic and Republican politicians have shied away from implementing a national government database to track vaccinations. Despite warnings from within the Biden administration a year ago that the status quo is “chaotic and ineffective,” there are no plans to alter the paper card system.
The fakes aren’t cheap. Fraudulent CDC cards were commonly advertised online at $100 a card early last year, according to Bruce Linder, emerging threats expert with the cybersecurity firm Check Point Software. By September, prices had doubled to $200, he said.
Prices have risen in recent months, as health officials have pushed booster shots to address the spread of the omicron variant and more employers, venues and governments imposed mandates. By this month, most sellers we observed priced fake credentials between $200 and $650.
The services offered by these underground sellers go beyond paper vaccine cards, Grid found. Some sellers also touted hacking skills, offering to register false vaccination data in hospital and government databases for a fee, so a fake paper credential could be digitally “verified” by officials. New York prosecutors last year charged two women in what they said was a vaccination card fraud scheme that had access to the state’s immunization data system. Both women have pleaded not guilty.
Some sellers offered the choice of a fake vaccine card or a fake doctor’s note to claim a medical exemption from vaccine mandates. One seller listed fraudulent negative covid PCR test results. Another claimed access to a nonpublic CDC database of lot numbers and expiration dates of vaccines used for verification, which could enhance the credibility of their forgeries.
Grid could not determine whether these offers were real. But a peek in their bitcoin wallets showed they are definitely big business: A forensic look at one Telegram seller’s bitcoin wallet showed they have received over $90,000 from hundreds of transactions over the last nine months, most of which were for amounts between $100 and $600.
Telegram, the fraudsters’ app of choice
Telegram, a United Arab Emirates-based social media platform that claims 500 million users worldwide, is the most popular platform for selling fake vaccine credentials, Grid found. Telegram notoriously offers little in the way of content moderation and has reportedly become popular with terrorists, criminals and others wishing to avoid regulatory and law enforcement authorities. The app has facilitated illegal drug sales, served as a communications tool for terrorists and enabled other illicit activities. It’s owned by a 37-year-old Russian-born multibillionaire who is now one of the UAE’s wealthiest residents.
There were more than 10,000 vendors on Telegram selling fake vaccine cards on the website as of September last year, according to research by Check Point Software. When Grid checked this month, we found at least 557,000 subscribers to Telegram channels advertising fake credentials for sale, although those numbers are virtually impossible to verify.
“It’s a problem — and it’s a problem across every country we looked at,” said Check Point’s Linder. The group has identified 28 countries for which fake vaccination cards are being sold on the dark web and Telegram.
Telegram did not respond to requests for comment.
Although Telegram has emerged as a popular platform for fraudsters around the world to conduct discreet transactions far from law enforcement’s view, many sellers attract their potential buyers by pitching them with anti-vaccine rhetoric on Facebook and Twitter.
Although those platforms have promised to keep an eye out for such posts and groups, Grid has consistently been able to identify vaccine credential bootleggers on both.
Telegram has been downloaded millions of times from Apple’s App Store and the Google Play Store. Both companies prohibit apps that facilitate criminal activity.
The Google Play Store’s Developer Policy states: “We don’t allow apps that facilitate or promote illegal activities.” In an emailed statement late Monday night, Google Spokesman Dan Jackson said in response to Grid’s questions that the company was “reaching out to Telegram on this.”
Apple’s App Store guidelines state that “apps that solicit, promote, or encourage criminal or clearly reckless behavior will be rejected” and that apps featuring user-generated content must include “a method for filtering objectionable material from being posted to the app.” The D.C.-based Coalition for a Safer Web sued Apple in federal court last year, alleging damages as a result of Apple’s failure to remove Telegram from the app store. Apple has denied the claims and has asked the judge to dismiss the case; the litigation is still ongoing.
“User generated content that promotes the use or distribution of fake vaccine cards is a violation of App Store guidelines, and we are communicating with the developer to ensure this material is removed from the app,” Apple spokesman Peter Ajemian said in response to questions from Grid. Ultimately, Ajemian said, app developers are responsible for moderating their users’ content.
A handful of Telegram accounts that Grid identified to Apple on Friday as examples of fraudulent vaccine card activity had disappeared from Telegram by Monday.
U.S. platforms are falling short
When mass vaccinations began rolling out in the United States last spring, social media companies pledged to eliminate posts that advertised falsified covid vaccination cards. Grid identified dozens of accounts, groups and users marketing fake vaccination cards on Twitter and Facebook that linked to Telegram channels where transactions appear to be conducted.
One Facebook group, titled “USA fake COVID-19 vaccination card for sale,” featured images of vaccine cards strewn on a tabletop alongside a baby it claimed had been disfigured by a vaccination. The Facebook group linked to a Telegram channel called “Covid-19 CDC NHS Passport,” which advertised credentials for sale for $450.
Facebook deactivated more than a dozen groups concerning fake vaccination cards from its platform — including “USA fake COVID-19 vaccination card for sale” — shortly after Grid identified them in an inquiry to the company on Jan. 19.
Other Facebook groups advertising falsified documents until they were deactivated earlier this month had titles that left little doubt as to their intent, including groups named “Buy Valid fake legit covid 19 certificate card — digital certificate” and “COVID-19 vaccination certificate vaccine cards digital passport for sale.”
“We prohibit anyone from buying, selling, or trading fake, or even genuine, medical documents on our platforms — and that includes COVID-19 vaccine certificates,” said Aaron Simpson, a spokesperson for Meta, Facebook’s newly renamed parent company.
Twitter also hosted accounts advertising fake vaccine cards for sale. One Twitter account Grid found, named “Covid-19 Vaccination Cards/Certificates,” had a user bio that read: “Contact me and get your valid Covid-19 Vaccination Certificate without having to take the poisonous vaccine!!”
Twitter also suspended more than 20 accounts identified to the company by Grid this month. The social media giant did not respond as of publication time to questions about the company’s policies and practices, and its failure to remove the accounts earlier.
Law enforcement lags
Fake vaccination cards have reportedly turned up in the hands of professional football and hockey players, radio station employees, hospital staff, fire and sanitation workers, police officers and state troopers, just to name a few examples. Federal authorities have seized thousands of fraudulent vaccination cards across more than a dozen states and made several arrests. But based on the volume of sales indicated by the online activity Grid saw and our conversations with experts, these enforcement efforts appear to be catching a small fraction of the flood of fake credentials being peddled online.
U.S. Customs and Border Patrol seized a total of 22,953 vaccination cards in 2021 and have already seized more than 7,000 in 2022. “If you do not wish to receive a vaccine, that is your decision,” said Michael Niepert, director of CBP’s Memphis Area Port, which has seized thousands of the cards. “But don’t order a counterfeit, waste my officer’s time, break the law and misrepresent yourself.” In Memphis alone, CBP said last August it had seized 121 separate shipments of fake credentials, most containing dozens of cards.
Federal authorities have also made sporadic arrests of people accused of distributing fake vaccination cards, often purchased online from foreign countries.
In one case, 23-year-old Amar Salim Shabazz of Maryland was charged with mail fraud and obstruction of justice in December for allegedly purchasing 600 fake vaccination cards and advertising them for sale on social media.
After the cards were delivered to his address in July, according to a criminal complaint, posts on Shabazz’s Facebook and Instagram accounts pitched: “Who need a vaccination card to bypass the bs they starting to do with our ‘freedom’. DM NOW FOR PRICE ✅💯.” A few weeks later, Shabazz’s Facebook account featured an update: “Only 17 cards left Dm me quick they are going like hot cakes.” An attorney for Shabazz did not respond to requests for comment, and the court docket does not reflect if a plea has been entered.
According to statements by federal authorities in charging documents in the criminal cases, most of the seized shipments of fake vaccine cards “originated from Asia and were commonly found to be falsely described on shipping manifests and other records as containing ‘paper card[s],’ ‘card[s],’ ‘greeting card[s],’ or other terms.”
There are no federal criminal statutes specific to falsifying vaccination cards. Federal authorities have charged people accused of vaccine card fraud with a variety of crimes including wire fraud, mail fraud, fraud with identification documents and other violations. The Department of Justice did not respond to questions from Grid.
The CDC cards are “ridiculous”
Experts say public health authorities struck a difficult bargain when they began tracking covid-19 vaccinations on an improvised, bootstrapped system based on the easily forged paper cards.
“These vaccination cards are ridiculous,” said Noel Brewer, a professor at the University of North Carolina’s Gillings School of Public Health who studies public health behavior. “They take us back 50 years. They’re better than nothing in some literal sense, but they’re not actually a good solution.”
As a result, the United States is one of the world’s few wealthy democracies that has not implemented a national vaccination database and verification system. Proof of vaccination for the approximately 250 million Americans who have received at least one shot is as flimsy as the cardstock it’s printed on.
“There is no overnight solution,” said Sharona Hoffman, professor of law and bioethics at Case Western Reserve University. “It is pretty laughable that the richest country in the world has people walking around with little paper cards.”
White House and Congress are AWOL
From the time vaccines first became widely available in the United States early last year, the Biden administration has signaled that “vaccine passports” or a national credentialing system were non-starters.
On a March 2021 call, officials from the CDC and other federal agencies discussed a national credentialing system to electronically verify Americans’ vaccination status, the New York Times reported on Sunday. A paper prepared for the call reportedly noted the dangers of the present system: “A chaotic and ineffective vaccine credential approach could hamper our pandemic response by undercutting health safety measures, slowing economic recovery and undermining public trust and confidence.”
But Biden and his advisers were concerned Republican politicians who opposed vaccine mandates would make political hay out of a national credential system, the Times found. “The policy is no policy” was the unofficial word from the White House, one official told the paper.
By April, the White House position was firm and made public. “The government is not now, nor will we be supporting a system that requires Americans to carry a credential. There will be no federal vaccinations database and no federal mandate requiring everyone to obtain a single vaccination credential,” White House press secretary Jen Psaki told reporters.
Psaki had said earlier that the private sector was “where the idea originated” for vaccine credentialing “and we expect that’s where it will be concluded.” But that hasn’t happened. One system, called the SMART Health Card, had the support of major U.S. institutions, including the Mayo Clinic, Microsoft, Salesforce and Oracle. Although more than 200 million Americans are potentially eligible to use the electronic credential, so far it has failed to catch on.
Congress has been all but absent on the issue of vaccine credentials and authenticity. Senate Majority Leader Chuck Schumer of New York has pointed to the Justice Department to solve the problem through enforcement. “The Feds have to step up their efforts to ameliorate this problem before it gets worse,” Schumer said in August. “The Department of Justice must ensure that fraud cases are prosecuted to the full extent of the law.” Since then, Schumer does not appear to have revisited the issue. Schumer did not respond to requests for comment.
In October, a bill by Rep. Ruben Gallego, D-Ariz., included a section expressing the “sense of Congress related to the seriousness of presenting, creating, or distributing fraudulent vaccination cards.” It did not propose any change to the system currently in place, and it has not moved since its introduction last year. Gallego did not respond to requests for comment for this story.
Hoffman said while the paper card-based system in place in the United States is not ideal, the increasingly political debate over vaccine mandates means there will not likely be a fix any time soon.
“If there were a priority, it could be done,” she said, “but probably it’s a better priority to actually vaccinate people — and we’re having enough trouble with that.”
This story has been updated.