Scam alert: Why posting your COVID vaccine card may lead to fraud

CHICAGO (WGN) -- First, you land the appointment, then you get the vaccine. But could your vaccine card be another opportunity for fraud? 

Bill Kresse, assistant professor of accounting at Governors State University, says sharing your COVID-19 vaccination card online and through social media could become a breeding ground for fraud.

Bad guys are stealing the information they contain from social media. And worse, experts say, there is no reliable place to report it. 

"This card is worthless because it’s so easy to forge," said Kresse, known as "Professor Fraud."

Each vaccination card bears your name and date of birth. Kresse said that's a great starting point for criminals trying to steal your identity.

"With that piece of information, you actually can go into the dark web, social media and get the other pieces you need, including your social security number," he said. "You’re handing over, potentially, to identity thieves one of the access numbers on your tumbler lock that can access your identity."

Next, Kresse says, once the bad guys see on social media that you have received your first shot, they may try to trip you before you get your second one. How? Scammers are phishing for their next victim by posing as someone rescheduling your second shot or confirming it. 

"We’re gonna need your social security number to confirm your next appointment, and now you’ve handed them your social security number," Kresse explained.

He cautioned against providing such information.

Lastly, Kresse said the white cards with black ink are nothing more than a sticker with your name and birthday. The cards are easily replaceable, meaning anyone can find a sample card on the internet, print it, and fill it out themselves.

False cards could aid those looking to skip 14-day quarantines after they’ve traveled.

"Guess what? I don’t have to do the 14-day quarantine. I have the card," Kresse said. "But you don’t have the vaccination."

Kresse said even the military is not quick to accept the vaccination card because it lacks numbers, codes and identifiers unique to you. It also lacks an embossed seal unique to the state or federal government.

For vaccination cards, not even a signature is required. 

Furthermore, the vaccine information isn’t checked against any stored data by a hospital, doctor’s office, pharmacy or agency. Kresse said this overly simplified verification isn’t enough. 

"In the 1970s, Illinois driver licenses were a cardboard card and the only safety feature was that the typewriter ribbon was a blue ink ribbon," he said, "which was also commercially available. We don’t want people duplicating phony cards, traveling, getting access to theaters, arenas or airplanes when they shouldn’t be there."

Because this is all so new, Kresse said, there's no sure way to prosecute the bad guys. It's only when someone fraudulently uses a vaccine card to board a plane or enter a venue that fraudsters could be charged with trespassing for not having permission to be there.

"It’s like going to a concert without a ticket," Kresse said.

Kresse said he fears this is just the beginning. Phony test kit results and black market vaccines could become an issue. According to Kresse, nothing is off the table when it comes to pulling one over on the public — especially during a crisis. 

Anyone looking to report that their vaccine card has been used fraudulently should file a complaint with the Federal Trade Commission and the Illinois Attorney General’s Office. One of the agencies may begin to look into the claims, but neither agency has begun to do so, however.

"I think the good folks at the CDC are doing a heck of a job," he said. "But their job doesn’t include thinking like a fraudster."

The vaccine cards were designed to remind recipients which vaccine they received and the date they received it. This information is also a reminder as to when to get the second dose if one is required.

While the two-dose Pfizer vaccine requires three weeks between shots, the two-shot Moderna vaccine requires four weeks. The Johnson & Johnson vaccine requires only one dose.

The CDC says there is no national organization, including the CDC itself, that maintains vaccination records.

If you lose your vaccination card or want any of your vaccination records, the CDC advises that you contact the facility that administered the vaccine or your local or state immunization information program.