Fraudsters are upping their claims when it comes to trying to sell fake COVID-19 vaccination cards online as they try to cash in on vaccine hesitancy.
The News4 Washington I-Team found ads on various platforms claiming sellers can not only provide buyers a paper card, but also promise to get them registered in a health department database.
Showing a vaccine card is now a necessity in many places, from dining out to attending a concert.
"Criminals will always exploit crisis, and in this case, they're playing on fear and misinformation to try to lure consumers to buy these cards," said Tom Galvin, executive director of Digital Citizens Alliance.
Galvin says blank Centers for Disease Control and Prevention cards have been for sale for months on foreign websites, the dark web and encrypted apps like Telegram. But now prices have shot up to hundreds of dollars per card because the newer posts are making claims about getting people registered in electronic databases, run by each state, and ultimately reported to the CDC. Those sites generally restrict access to medical professionals or pharmacists who actually give the shots.
Get Tri-state area news delivered to your inbox. Sign up for NBC New York's News Headlines newsletter.
Eric Feinberg has spent hundreds of hours tracking those posts for the nonprofit Coalition for a Safer Web.
"I found a tremendous amount of these registered cards being offered for sale on Facebook and Instagram," Feinberg told the I-Team.
NBCWashingtonHe showed the I-Team how he contacted the sellers, then texted back and forth over WhatsApp and Telegram. He specifically asked about getting cards registered in Washington, D.C., Maryland and Virginia.
"They seem to be very accommodating and say, ‘Yes, we can,’ including when I give them specific addresses of Walgreens and CVS stores located in the District," Feinberg said.
The nonprofits wanted to try to buy a card to test whether a registration showed up, but opted not to, since just possessing a false card is illegal. So, the I-Team couldn't do it either.
But the experts said three things could be happening.
First, "The individuals who will buy these cards are being played,” Galvin said.
In addition to $200 cost, the sellers ask for the buyer's name, address, date of birth and other personal information, which could be misused later to steal their identity.
Second, Feinberg said some people who administer vaccines and access those systems could be on the take.
"Maybe in the times we live in ... What's a pharmacy tech make? $18, $20 an hour?" said Feinberg. "To pay someone off or have someone on the inside, yeah, why not?”
Plus, he noticed some of the sellers typed the dollar sign to the right of the number — an indication they may be located overseas.
Finally, could the databases be hacked to actually enter a fake vaccine card buyer's information?
"Being hacked by an outside entity is definitely something we worry about and protect against every day,” said Christy Gray, director of immunizations for the Virginia Department of Health.
Gray said VDH routinely audits its records for vulnerabilities and also tracks which records a user enters or views.
She said a sample database the I-Team showed her from one seller's texts does not look legitimate.
"The information that is stored is on hundreds of tables. It's not just one row with information. So, it is an extensively complex system," Gray said.
For real vaccine providers, she said the states also track lot numbers for the vials, the number of doses ordered and how many get registered in the system.
"What they were saying they can promise, it seemed very far-fetched," said Gray. "We are definitely investigating as we see these things come up."
Gray noted there have not been any instances of false registrations detected in Virginia thus far.
D.C. Attorney General Karl Racine also found the sellers' claims dubious but said law enforcement has been cracking down on phony cards, going after both buyers and sellers.
"Inside fraud that may be occurring is going to be caught, and I encourage anyone with any evidence of that kind of wrongdoing to report it, " said Racine.
Racine subpoenaed Facebook this summer, demanding its internal research on vaccine misinformation. At the time, Facebook said it had removed more than 18 million fake or harmful posts on Facebook and Instagram.
The I-Team reached out to Facebook and Telegram to ask about specific posts from sellers and additional steps the platforms had taken to remove these kinds of items, but the platforms did not respond.
"I don't deny that it's difficult for the platforms to keep up with the lies and the hate and the fraud and all the misdeeds on the internet," said Racine. "We've just not seen enough of a concerted, intentional effort."
Some of the posts the researchers flagged have since been removed from Facebook and Instagram. But there are plenty of other sellers still pedaling fear and lies about the vaccine to sell fake cards.
The I-Team found some sellers portraying photos of real vaccination cards as fakes that they'd sold. One even belonged to Chad Brown, the health commissioner in Licking County, Ohio.
"I am fully vaccinated and I am proud to be so, and trying to get as many people vaccinated as we can," Brown told the I-Team.
Brown was stunned when the I-Team showed him his own vaccine card posted by one of the sellers. The picture was stolen from local newspaper coverage of Brown getting vaccinated last December.
"We're trying to deal with this misinformation from all angles on a daily basis," Brown said. "Definitely, it's frustrating to see that occurring."
Another vaccine card posted on the same seller's profile shows a man in a uniform with a badge and purports to be that of a "police deputy" who purchased a fake card.
The I-Team found the photo was actually taken from a media event in Norwood, Massachusetts, showing now-retired Fire Chief George Morrice getting vaccinated.
News4 tried contacting Morrice but did not hear back. A town spokesperson provided video showing Morrice being vaccinated and proudly displaying his card.
Digital Citizens Alliance and Coalition For a Safer Web published a report Wednesday detailing the findings of their research and calling on the social media platforms to do a better job of policing their sites for vaccine misinformation.
"It's very dangerous," said Feinberg. "It puts all of us at risk."
Reported by Jodie Fleischer, produced by Rick Yarborough, and shot and edited by Jeff Piper and Steve Jones.
