Fake IDs Are Common. Will Fake Vaccination Cards Be Next?

As more colleges require that students get vaccinated against Covid-19, a new challenge has emerged: how to ensure that they follow through.

A professor at the University of North Carolina at Chapel Hill reported this month on Twitter that he’d had conversations with students who knew how to obtain fake vaccination cards and were aware of peers who’d submitted them to the institution. Federal authorities seized thousands of fake vaccination records in Memphis, and a homeopathic doctor in California faces federal charges for selling them to patients.

In March the FBI issued a notice that making or buying fake vaccination cards was illegal. But for college students, many of whom may already hold fake ID cards to gain access to alcohol, falsifying a vaccination card might not be a stretch, some fear.

No specific reports of fake vaccination records have emerged publicly on college campuses.

The Chronicle asked the 19 state flagship universities that require students to be vaccinated whether they had identified any falsified vaccination cards; of the nine that answered, none had found fakes.

For its part, UNC has “no evidence that indicates students are misrepresenting their vaccination status,” Joanne Peters Denny, a university spokeswoman, said in an email to The Chronicle. “Based on our random weekly spot checks, we are finding our students are honestly reporting their vaccination status.”

Still, many colleges are staying vigilant, taking a two-pronged approach to verify students’ vaccination cards: both examining the images of the cards that students provide, and then asking them to affirm the authenticity of those images. Attestation forms, as they’re called, allow colleges to impose consequences if a student’s vaccination card is found to be fraudulent, often through disciplinary procedures normally used for offenses like academic dishonesty.

There’s no national health-records database, which would make verification simpler. Some institutions told The Chronicle they’d been granted access to state vaccination registries, against which they could check students’ records. Others said they were reviewing documents manually.

Then there are vaccine-verification apps that can perform a cursory check of a vaccination card, said Lucia Mullen, a senior analyst at the Johns Hopkins Center for Health Security. Such apps could lighten the administrative burden on college officials, but Mullen said she wasn’t aware of any institutions using them yet.

Key criteria to examine include whether the name on the card matches that of the user uploading it and whether the listed vaccination dates are the appropriate length apart, Mullen said, though it’s still possible to produce a fake that passes both of those tests.

Neither human review nor computer-assisted processes are foolproof, and attestation policies won’t deter all would-be wrongdoers, administrators told The Chronicle. But, Mullen said, “we want to make sure that we’re not having perfect be the enemy of good. So we do have to start somewhere, understanding that there are going to be some gaps.”

“It may not be enough, but if it’s all we have,” she said, “we shouldn’t not use it.”

‘Difficult to Detect’

Administering regular screening tests and tracking Covid clusters could offer a trial-by-fire way to verify vaccination information, Mullen said. “If a university has on paper a very, very high vaccine coverage rate, but they seem to be having a large outbreak, then clearly something’s not matching up there.” Though breakthrough cases — in which fully vaccinated people contract Covid, particularly its more-transmissible Delta variant — could account for an outbreak, Mullen said, another possibility could be “a large underground ring of fraudulent vaccine cards.”

The University of Hawaii-Manoa is among those institutions reviewing students’ vaccination records manually. Jodi Ito, the campus’s chief information-security officer for the University of Hawaii system, said that task is split among staff members from across the university. Even Ito’s boss,Manoa’s vice president for information technology and chief information officer, pitches in.

Students upload a photo of their vaccine card to the same online portal they use to complete daily health screenings. They also fill out a form, inputting the type of vaccine they received, along with the dates and lot numbers of their shots. Staff members compare the two, looking for discrepancies in vaccination dates, lot numbers and more. “If we look at enough of these cards, we get a sense of what is a valid card versus not a valid card,” Ito said. Still, she admits, “if the replica is good, it would be very difficult to detect.”

Ito said that if the vaccination-card images aren’t blurry and all the information matches, she can validate three or four students’ records each minute. (She recalls tallying how many records she could process in an hour.) But anomalies can slow that significantly. Sometimes, there are errors that are attributable to the health provider administering the vaccination. “The cards themselves are not foolproof, because there’s a human writing on that card,” Ito said. And international students’ vaccination cards, of course, look different than the Centers for Disease Control and Prevention’s.

Ito and her staff reserve the right to reject records they find problematic, even retroactively. They might ask a student to bring her card in for an in-person visual inspection, or submit extra verification material. So far, though, Manoa has not identified any fake cards.

At the University of New Mexico, too, staff members are reviewing each student’s vaccination information. The provost’s office is leading that effort, with help from human-resources employees, said Kevin Stevenson, executive director of human resources services. The training process for those reviewers was relatively straightforward; Stevenson said the university had created a training document that covers what the cards look like and how they typically refer to manufacturers, among other things. The university may also bring on student employees to help with the influx of documents being submitted.

In addition to vaccination cards, New Mexico accepts copies of online records from the state’s health department.

New Mexico was the only institution in The Chronicle‘s review that differentiates on its vaccination dashboard between documents that have been submitted for review and those that have been verified. (For example, at publication time, the dashboard reflected that 6,368 students on its main campus had been verified as fully vaccinated; 1,860 students’ documentation had not yet been vetted.) It also logs the number of people who self-reported being fully vaccinated in a spring survey but have not yet submitted documentation.

Those distinctions, Stevenson said, were born of a desire for transparency. “If we’re going to say we have X number or Y percent of confirmed vaccinations, we want to be able to say, Yes, we actually confirmed that that’s real.”

The task is an easier one for institutions with access to a state vaccination registry, like the University of Illinois at Urbana-Champaign, the University of Massachusetts at Amherst, and the University of Delaware. At Delaware, students who were immunized in another state are contacted for more information. “We have found that many students are actually supplying a surplus of information, such as documents showing their confirmed appointments for immunization at pharmacies,” Andrea Boyle Tippett, director of external relations, said in an email.

Delaware hasn’t encountered any fraudulent cards, but the dean of students’ office did reach out to a student whose mother posted on Facebook that she opposed the vaccine and planned to falsify her daughter’s vaccination card. The student said she didn’t share her mother’s views and had scheduled a vaccine appointment.

Officials at the University of California at Berkeley said they, too, could access state registries to confirm students’ vaccination information, though they’re not doing so for every student. The campus does check records to aid in contact tracing or if a student is infected, and may also do so if campus or local case counts rise.

Operating on Honesty

Experts say the number of students who submit fake vaccination cards is likely to be low, meaning it wouldn’t have a significant impact on campus immunity levels. Even on campuses that mandate vaccination, religious and medical exemptions mean the vaccination rate will never reach 100 percent, said Michael Huey, who just finished a stint as the interim chief executive officer at the American College Health Association.

Of course, Huey said, there is still a moral imperative for students whose institutions mandate vaccination to follow suit. “Colleges and universities, and their students and faculty and staff, operate on an assumption of honesty and mutual respect,” he told The Chronicle. Dishonesty in meeting a university requirement, he added, would constitute a violation of the institution’s ethical code.

The need to verify vaccination records could also subtract from time campus health officials spend on other pandemic-related activities.

“There are really important things to do that wouldn’t be playing detective with vaccination records,” Huey said. “Our people need to focus on those things and trust students to have that same integrity that we’ve always expected of them.”