Online markets move to block fake vaccination cards, but work remains

Fake vaccination cards have popped up on online marketplaces thanks to opportunistic fraudsters, bare-bones documentation, and populations eager to bypass COVID restrictions.

Ever since the beginning of the coronavirus pandemic, there has been debate about how to best document vaccination status for individuals who have been vaccinated. In the United States, most vaccinated individuals receive a 4x3 inch card that detailed the following: name, date of birth, patient number, vaccine manufacturer and lot number, date of vaccination(s) and the name of healthcare professional or clinic site.

These vaccination cards, which are basically a small white piece of cardstock, are currently the only widely recognized method to document immunization. The Federal Trade Commission has indicated that those simple cards — which can be easily replicated by fraudsters — were never designed to prove someone’s vaccination status long term, indicating that perhaps they were rapidly produced to meet an immediate documentation need.

The rise of fake vaccination cards

Several states, territories, and cities in the United States now require proof of vaccination in order to get into restaurants, gyms, and entertainment venues. There are even workplaces that are setting vaccine mandates for personnel in order to return to their offices. Additionally, it may become a requirement to show proof of vaccination in order to travel or take a cruise.

With this additional pressure to provide proof of vaccination, some persons have resorted to obtaining blank or counterfeit vaccination cards and filling them with false information. In response, online marketplaces, social media platforms and government officials have taken steps to warn the public and prevent the sale of counterfeit COVID-19 cards:

• In March 2021, the FBI and Department of Health and Human Services warned people against buying, manufacturing, or otherwise counterfeiting ID cards, saying: “by misrepresenting yourself as vaccinated … you put yourself and others around you at risk of contracting COVID-19. Additionally, the unauthorized use of an official government agency's seal … may be punishable under [federal law].” The FBI also warned against posting photos of legitimate vaccination cards to social media.
• NPR recently noted that trust and safety teams at online marketplaces like Etsy and Amazon have been toiling to identify and remove vendors using their platform to sell these fake products. An Amazon spokesperson said in an email to NPR, “We do not allow the products in question in our store. We have proactive measures in place to prevent prohibited products from being listed and we continuously monitor our store by removing the items and taking action against the bad actors involved in bypassing Amazon’s controls.”
• U.S. Customs and Border Protection officers have intercepted numerous shipments of fake vaccine cards from China, reportedly finding more than 120 shipments and thousands of cards this fiscal year at the Port of Memphis alone. Signs indicating counterfeiting included poor quality printing, misspellings and typos.

Cat and mouse: fake vaccination cards still found online

As in any game of cat and mouse, challenges will continue to persist, despite the focused efforts of federal law enforcement and trust and safety teams at online marketplaces and social media platforms.

Learn more about improving online investigations for law enforcement and trust and safety purposes >

Hunting for fake vaccination cards with Silo for Research

In search of examples of fake vaccine cards, we opened a session in the Silo for Research platform and visited a marketplace used by vendors in China to sell their goods worldwide: Alibaba.com. In the Silo session, we selected our default location of the United States. With a simple search for “vaccine card” and narrowing the category to filter results, we quickly found multiple listings for counterfeit vaccine cards:

Fake vaccination cards for sale on Alibaba

However, when attempting to view more information on these listing, we received an error that the item was restricted from being shipped to the United States, indicating possible actions by the marketplace to block potential sales:

Additional details blocked due to regional egress

To gather additional information, we used the Silo for Research platform to manipulate our online appearance and selected an internet point-of-presence in the Asia region. With this, we were able to view additional information and gather relevant details, as we “blended in” with the internet users in that region.

One interesting attribute to note: The photos used in the product appeared to have redacted specific words from the images. In this example, the listing redacted “COVID-19 Vaccination” from the header of the card in product images, leaving it labeled only as a “Record Card.”  This may be an attempt to evade the watchful eye of trust and safety teams, who may rely in part on optical character recognition (OCR) or machine learning to flag specific accounts or products based on text in images.

Fake vaccination card listings have altered images to prevent auto-image search and blocking

To see how we used Silo for Research to quickly find this information, view this video of the investigation:

Demand for fake vaccination cards persists

Recent and upcoming restrictions by private businesses, governments and other venues are likely to increase pressure to present documentation of vaccination, which could lead to additional attempts to obtain counterfeit vaccination documentation:

• The Associated Press reported worry among education officials. As students head back to school, fake vaccination cards may become attractive to a group of people who already know the value of fake identification: college students. There are many colleges and universities across the country that are requiring proof of vaccination before students can be allowed to live in student housing. Some campuses also will require students self-report that they are vaccinated, or be subject to weekly COVID tests.
• Another example where individuals may need to present a vaccination card is at sporting events. In Los Angeles, California, where COVID-19 cases have remained low, there are some new rules that are going into effect for sporting events. Dodger Stadium is offering a fully vaccinated section where there will be no social distancing, only the wearing of face masks. But ticket holders over the age of 16 will have to show their vaccination card, and those under 16 will have to show proof of a negative test result within the past 72 hours.
• In New York, the state has recently launched its Excelsior Pass, which is a free voluntary application that verifies if an individual has been fully vaccinated or has recently tested negative. The Excelsior Pass works just like a mobile airline boarding pass and there have been plans for this application and its companion application reader at venues like Madison Square Garden, Times Union Center and the Empire State Building. The state of New York has indicated that it is modeling for the rest of the country how new, technology-enabled approaches can help safely reinvigorate economies while protecting public health.

“By misrepresenting yourself as vaccinated … you put yourself and others around you at risk of contracting COVID-19. Additionally, the unauthorized use of an official government agency's seal … may be punishable under [federal law].”

HHS-OIG and FBI joint public service announcement

Enabling access for investigators

Overall, the sale of these fake vaccination cards over the past few months is starting to make headlines, especially with the recent uptick in COVID cases and the need to prove who have and have not been vaccinated.

Investigators in law enforcement, trust and safety teams and other organizations face challenges to collect the information needed in an efficient, secure manner without prematurely tipping off the target of the investigation. As the examples in this blog and the accompanying video show, investigators may face challenges collecting content, such as the geographic block noted above.

This is where Silo for Research comes into play. As a managed attribution and browser isolation tool for online investigations, Silo for Research allows investigators to completely customize how they appear to sites they interact with online. It allows investigators to manipulate their internet location as well as device details, including language, time zone, keyboard settings, browser type, operating system, location, IP address and more.

Being able to manipulate all of these attributes ensures your online research is not attributed back to your organization and improves the security of your online investigations. Silo for Research is built on a cloud-based web isolation platform that executes all web-native code remotely, so that it never reaches the endpoint, keeping your device and network safe from malware. This means that all evidence can be safely collected, stored, translated and shared through one solution.

In the example above, investigators could conceal their true identity and ensure access to needed content -- all while protecting the integrity of the investigation and lowering cyber risk to their organization.

To learn more about how Silo for Research can help online marketplaces tackle problematic content, or other online investigations, visit our website or request a demo.