Feds warn of alarming rise in reports of fake vaccine cards sold and used

A burgeoning online market for counterfeit COVID-19 vaccination cards is setting off alarm bells for federal health officials, who warn that the demand for fake proof of immunity is on the rise.

The Health and Human Services' Office of Inspector General tells ABC News exclusively that they are receiving "increasing reports of individuals creating, purchasing, and using fake COVID-19 vaccination cards," warning that the proliferation of sham cards can leave victims' personal identity vulnerable -- and threaten the nation's hard-fought gains against the virus.

"We are seeing it be widespread, and part of that is because it's being done across social media and e-commerce, where anybody who might run into it could become a participant in it," Miranda Bennett, HHS-OIG special agent in charge of health care fraud, told ABC News of the rise in reports. "It is very concerning."

The illicit niche industry for forged vaccination cards is hitting its stride just as new vaccine requirements are rapidly being implemented at the federal, state and local levels and in both the public and private sectors -- requiring proof of inoculation in order to work at a hospital, teach or attend school, work out at the gym, or eat inside a restaurant. Yet despite the new policies -- and the FDA's full approval this month of Pfizer's COVID-19 vaccine -- some hesitant Americans still refuse to be vaccinated.

For enterprising fraudsters, the fresh demand presents a ripe opportunity -- and experts say it's not just about offering fake paper cards anymore.

"At the end of July, we saw a spike in new services where they're actually offering the hacking of databases, along with the cards themselves," said Saoud Khalifah, executive of Fakespot, a company specializing in targeting online fraud. "These fraudsters know what they're doing -- they see trends, and they jump on them."

And experts say that some of it is happening in plain sight. Rather than remaining relegated to the web's dark recesses, fraudsters are staking out publicly accessible domains. "This is something we've never seen before," Khalifah said.

"We've seen it in the dark web, we've seen it in Mr. Robot," said Khalifah, referencing the popular TV hacker drama. "But we've never seen it broadly offered to the general public like it is right now."

While prices for fake cards typically range from $50 to $200, some cards have been spotted selling for as much as $750. One site selling fakes promises "database registered CDC and NHS COVID vaccine cards," complete with "sophisticated anti-counterfeit technology to ensure authenticity and peace of mind." Another site touts their "access" to different databases to get cards "registered."

Yet another site offers a "special discount on family deals" for the cards.

Experts say they're concerned about scammers who falsely offer to infiltrate databases in order to exploit victims' personal information through identity theft. But if fraudsters can deliver on the promise of successfully inputting inaccurate medical information into protected databases, it's an even larger security concern.

"If they're actually putting in these fraudulent records ... it's a huge problem for society," Khalifah said.

"These scammers are very savvy," said Bennett. "Once you've given that information, it's there and you can't give it back."

HHS officials tell ABC News they have received nearly 200,000 complaints related to COVID-19 fraud since the pandemic began, with calls about fake vaccine cards coming in every day. As many as half of the daily reports coming into the agency's investigative arm are related to COVID-19 vaccine card scams, HHS-OIG says.

Federal law enforcement and health agencies warn that those who falsely purport to be protected from the virus risk exposing themselves and others to the virus. In a joint alert issued this spring, 47 state attorneys general warned the CEOs of Twitter, eBay and Shopify not to harbor these illicit sales on their platforms.

"We're always chasing cybercriminals, who are trying to run away," said Dmitry Galov, a researcher who tracks the sale of fake certificates for the cybersecurity firm Kaspersky. "It's vital to try to be one step ahead."

To combat the COVID-19 scams, HHS-OIG has partnered with agencies across various sectors of government, including the FBI, Medicaid fraud control units, state attorneys general, and international law enforcement, since vaccine card fraud can have international impact.

"In the future, your vaccine card may be required for flying, attending classes, or doing business through your employer," says one website selling fake cards. "The paper cards may be the only ticket to access those platforms."

"Some colleges and universities have announced that they will only start accepting students with proof of a COVID-19 vaccination in the fall for in-person learning," another site says. "We offer the possibility of getting this card as we've come to realize that many Americans do not want to take the vaccine."

The use of fake vaccine cards at colleges and universities has been a special concern for authorities.

At the University of North Carolina Chapel Hill, officials were addressing rumors of easy access to fake cards that spread across campus even before classes began. Benjamin Meier, a UNC global health policy professor, told ABC News that "every single one" of the students he's spoken with "know exactly how to get these fraudulent vaccine cards" -- and that he personally knows "students who have submitted these to the university."

"When people try to fake their vaccination status with a fraudulent vaccine card, they're putting themselves, their loved ones, and their communities at risk," North Carolina Attorney General Josh Stein said in a statement to ABC News.

In response, UNC officials told ABC News that students who provide false information and violate the university honor code may face "disciplinary action -- up to suspension."

"I think the vast majority of students are doing the right thing," UNC rising junior Simon Palmore told ABC News. "But it only takes a few."

To report suspicious activity involving fake vaccination record cards, please contact HHS-OIG at 1-800-HHS-TIPS or www.oig.hhs.gov; the Internet Crime Complaint Center at www.ic3.gov; or the appropriate government agency in your state or jurisdiction.

ABC News' Luke Barr, Alexander Mallin and Eric M. Strauss contributed to this report.