A Facebook page promoting health and beauty products features an intriguing photo: A stack of blank Covid-19 vaccination cards, with the logo for the Centers for Disease Control at the top. “Get your vaccine card at very affordable price,” a nearby caption says. From my personal Facebook account, I clicked on a button offering more information. Details promptly appeared in the Facebook messaging window: One vaccine card costs $100. For bulk orders, the price drops to $90. Once you provide the necessary personal details and pay with bitcoin, it takes 24 hours to process the order, which is then shipped overnight.
The FBI says it’s illegal to buy a fake vaccine card, so I didn’t place an order and I can’t confirm whether the site is a legitimate purveyor of fake cards. It’s very clear, however, that there’s a booming cottage industry in bogus documentation relating to Covid-19. As municipalities like New York City and a growing list of employers require proof of vaccination, black-market alternatives are inevitably springing up for those unwilling to get a proper vaccination. “This development has led to dramatic increases in activity in English-language illicit communities from threat actors looking to sell, buy, or produce proof of vaccination certificates,” cybersecurity firm Flashpoint reported in a recent analysis.
Fake vaccine documentation has been circulating since the vaccines themselves became available late last year. They’ve popped up on Amazon, eBay, Etsy, and other popular sites, which typically take the pages down once they’re discovered. Authorities have arrested some people allegedly selling fake cards. Police in Hawaii nabbed a Florida couple accused of using four fake cards, including cards for two young kids below the vaccination age. Memphis seems to be a hotbed for fake cards. Customs officials recently seized more than 300,000 fake cards sent to the U.S. from China.
Bitcoin needed
I wanted to see what it takes for an ordinary person to get a fake card. It’s not necessary to go on the dark web, where organized criminal gangs ply their trade. It does seem necessary to have some bitcoin, which sellers want in order to limit law enforcement’s ability to track them.
Like other mainstream websites, Facebook (FB) says it takes down scammer accounts as it finds them and aggressively polices efforts to undermine public health related to Covid. Its guidelines prohibit the sale of any medical information, whether fake or genuine. Yahoo Finance is not identifying any services we found offering fake vaccine cards.
But they’re not hard to find. The messaging app Telegram seems to be one place where vaccine card merchants can operate with relative impunity. Several Facebook accounts that appear to be offering fake cards refer visitors to Telegram accounts.
While I’ve had a Facebook account for years, I didn’t have a Telegram account until I wanted to look for fake vaccine cards on the app. I created an account and contacted one seller whose account name I found on Facebook. This time, I identified myself as a Yahoo Finance reporter and asked if I could interview the seller, on some kind of anonymous basis, about the business of selling fake cards. The response: “Yeah sir if you willing to make a purchase.”
Buy in bulk
I wasn't going to make a purchase and potentially break the law. But I asked for information. The price for one card was $150. I could get up to 50 cards for $100 apiece, and for more than 50 the unit price would fall to $80. “We got bulk for everyone,” the seller told me. Payment would have to be in bitcoin.
Telegram did not respond to a request for comment. Telegram is an encrypted messaging app founded by two Russian brothers who moved their operation to Germany. It's similar to Whatsapp, owned by Facebook, except with more of an outlaw reputation. Researchers have found terrorist propaganda, cybercrime and other illicit activity on the app, which has taken off lately and now has more than 500 million global users.
Some fake vaccine cards have their own websites. One such card appears to be a prank, with a photo of a card with "Whiskey - Jack Daniels" written in the box where the type of vaccine and lot number would ordinarily go. In the column labeled "Healthcare Professional or Clinic Site," it says "Applebee's." The price is $7.99 and the site takes credit cards. Since I didn't order a card, I don't know if a prank card arrives, or a blank CDC knockoff for fraudulent purposes. I sent an email to an address listed on the site, and an unnamed responder told me the card arrives in prank form, rather than blank: "It's not a vaccine card."
The CDC's white, paper Covid vaccine cards are easy to replicate and not meant to be fraud-proof. “All you have to do is scan one of the forms,” says cyberthreat analyst Ilya Volovik of Gemini Advisory. “We’ve seen cybercriminals post electronic versions of the CDC card. The template is out there.” This activity tends to take place on the dark web, which is more of a business-to-business platform for criminals. The cost of the template is $100 to $150, and anybody who buys it can then print as many blank cards as they want, using paper stock similar in thickness to the CDC cards. This is one way fraudsters selling fake cards in physical locations can build inventory.
Gemini provided this screenshot of one seller offering a CDC vaccine-card template on the dark web:
Europe has instituted digital QR codes on vaccine cards that link to government websites showing an individual’s proof of vaccination. That offers a degree of security unavailable in the United States, except in states or cities that have rolled out digital proof of vaccination, such as New York’s Excelsior Pass. But there are even fake versions of those QR codes for sale, which mimic what the real codes are supposed to do. The Facebook card seller I communicated with offered a card with a European-style QR code for $150, $50 more than the plain U.S.-style card.
Some fake-card offers are probably scams within scams, in which a buyer sends in bitcoin and never gets anything in return. “Of course you can get ripped off,” says Volovik. “You’re not going to go the police.” It’s also possible law enforcement could be running a sting. If you get the real vaccine, by contrast, there are no legal concerns. Plus, it’s free.
Rick Newman is the author of four books, including "Rebounders: How Winners Pivot from Setback to Success.” Follow him on Twitter: @rickjnewman. You can also send confidential tips, and click here to get Rick’s stories by email.
Read more:
Get the latest financial and business news from Yahoo Finance