Fake Covid-19 vaccine cards are presenting a fresh quandary for enforcement efforts: Unlike most consumer fraud, neither the buyer nor seller is taking advantage of the other.
From August to September, the number of sellers on the darknet offering forged vaccination records or test results went from about 1,000 to 10,000, according to cybersecurity firm Check Point Research. The rise in sellers coincides with an uptick in mandates for consumers around the U.S. to show proof of vaccination before entering certain venues.
The issue poses a novel challenge for both federal agencies and businesses because fake vaccine cards aren’t like typical consumer protection matters, where consumers are the ones to report the fraud, said Josh Stein, North Carolina’s attorney general.
“It’s hard to know how extensive a problem this is because this is an instance where you have an illegal transaction where the seller and buyer are complicit,” Stein said. “In this instance, the buyer is part of the problem because they’re not getting a real vaccine.”
Buyers of fake vaccine cards aren’t “coming clean,” he said.
The FBI, Federal Trade Commission, Justice Department, Health and Human Services, and state agencies are all policing the creation and sale of such records. But no coherent approach has emerged to deter their use, or to provide guidance to businesses responsible for checking proof of vaccination.
And because buyers can prolong an illegal scheme unless someone tips off the government to the fraud, businesses are on their own to check these cards. They’re trying to minimize legal risk by not collecting personal health data, but the lack of verification technology means they’re unable to properly detect fraud.
“They’re really trying to walk the line and balance public safety, safety of their environment, the law if required,” said Cynthia Cole, a partner at Baker Botts LLP in Palo Alto and San Francisco. “But they’re also frankly not wanting to get their hands too dirty in the sense that they have all this extra info they don’t need and don’t want.”
Almost 80% of the adult U.S. population has received at least one Covid vaccine dose, according to data from the Centers for Disease Control and Prevention.
Still, reports about potentially fraudulent vaccine cards have increased “exponentially” lately as proof of vaccination is requested more often, according to Matthew Charette, special agent in charge at the HHS Office of Inspector General. Charette said the office gets tips from a hotline and from regional offices across the U.S.
Los Angeles and New York City are among several major cities with Covid-19 vaccine mandates in place for consumers. L.A. requires proof of vaccination or a negative test from guests attending large events such as outdoor concerts and ballgames. It will also require proof of vaccination to enter restaurants, shopping malls, and other indoor venues under an ordinance that takes effect Nov. 4. New York City has a vaccine mandate for patrons of restaurants, gyms, clubs, and other businesses.
The HHS watchdog is in regular communication with the Justice Department, the FBI, and other partners to track Covid-related fraud. Since the beginning of the pandemic, the HHS-OIG has opened approximately 400 formal investigations into Covid schemes.
Anyone who makes, buys, or sells a fake vaccine card or fills in cards with false information could be fined or face prison time, according to a warning from the FBI. The warning indicated that the unauthorized use of a government agency’s seal on such cards is punishable under a section of U.S. criminal code.
So far, enforcement cases have focused on sellers of fake vaccination records, rather than buyers. People who knowingly purchase fraudulent vaccination cards could be considered part of a conspiracy with sellers of such cards, meaning both the buyer and seller face potential charges.
In one case, a California-licensed naturopathic doctor was arrested for allegedly selling counterfeit Covid-19 vaccination cards, along with so-called immunization pellets that she falsely claimed would provide lifelong immunity to the virus.
A high-profile case involves San Jose Sharks ice hockey player Evander Kane, who allegedly submitted a fake vaccine card earlier this month to his team and the National Hockey League. The NHL, which doesn’t have a vaccine mandate but imposes fewer restrictions on vaccinated players, said Kane violated Covid-19 protocol and handed him a 21-game suspension without pay.
The FTC has warned consumers against buying fake Covid-19 vaccine cards or negative test results. It says offers like these could turn out to be scams that seek personal information to commit identity fraud.
The commission said it hasn’t received many fraud complaints related to vaccine cards or test results. Fraudulent vaccine cards could potentially run afoul of the FTC Act’s prohibition against unfair and deceptive business practices.
VIDEO: President Biden’s vaccine mandate rule for companies, the likely legal challenges and what to expect next.
Limited Legal Risk
Though federal agencies are handling the oversight, enforcement isn’t trickling down to the local businesses that are checking vaccination proof by choice or due to public safety measures mandated by local law.
Owners of bars, clubs, and restaurants, and organizers of conventions and professional gatherings will need to train their staff to meet their obligations under local or state ordinances requiring proof of vaccination for entry, restaurant and entertainment industry lawyers say.
But venues and their owner and managers will likely face little legal risk related to counterfeit vaccination cards since there is no formal fraud detection procedure or guidance to follow.
Without a credible system, restaurants and bars will check vaccination cards in the same way that they check driver’s licenses or other ID cards to verify that customers are old enough to drink, said Travis Gemoets, a partner at Jeffer Mangels Butler & Mitchell LLP in Los Angeles.
The task could also be more complicated in jurisdictions allowing the use of a recent negative Covid-19 test as an alternative to proof of vaccination.
“Servers and bartenders aren’t required to be forensic document examiners,” he said. “I think if a card presented by a customer appears to be valid, that’s going to be good enough to protect the business, just like with driver’s licenses.”
Making sure a vaccine card wasn’t purchased on eBay is “almost certainly beyond the scope of duty of any restaurant or bar,” said Nathan J. Breen, a partner at Howe & Hutton Ltd. in Chicago.
“You can’t hold these establishments responsible for the wrongful or potentially criminal actions of third parties,” he said. “I don’t think that’s going to happen.”
Consumer-facing businesses are shying away from collecting Covid-19 information for the most part, attorneys say. Some are checking vaccine cards or negative test results at the door, but they’re generally not requiring consumers to upload those to an online portal for verification.
Retailers and restaurants don’t want to collect that sort of information online because bad actors could breach it or it could be mishandled by employees, said Cole, the Baker Botts attorney. Breaches of that information could potentially implicate state data breach notification statutes or the California Consumer Privacy Act, she added.
With no federal database or registry for companies to vet vaccination cards against, requiring that information to be digitally uploaded or for consumers to show an uploaded record—instead of a paper copy checked at the door—likely would be unfeasible for the average business, said Tom Zych, a partner at Thompson Hine LLP in Cleveland.
“Most businesses are doing the best they can, but they’re not in the position to actively detect fraud,” he said. “Businesses aren’t law enforcement—they’re trying to avoid injecting themselves into that role.”
To contact the reporters on this story: