Some states put templates online, spurring pro-Trump and anti-vaccination forums to start spreading tips for how to create fake cards.
Specific directions showing how to forge Covid-19 vaccination cards have proliferated on conspiracy, pro-Trump and anti-vaccination forums throughout the internet in recent weeks, as users have exploited a largely makeshift verification system.
The cards, distributed by the Centers for Disease Control and Prevention, have been handed out to the more than 140 million Americans who have already received at least one dose of a Covid-19 vaccination. The Biden administration has declared it wouldn't create a federal vaccination database, citing privacy concerns, paving the way for the cards to become the country’s default national way to verify if someone has been vaccinated.
And while one state — New York — has embraced a vaccination verification app, there is scant evidence that others are close behind.
While much of the country is in the early stages of deciding how to ask employees, students and travelers to prove they've been vaccinated, most of those entities that have already established a plan rely on those cards. The Silicon Valley company Salesforce announced earlier this month that employees returning to work in person will need to show their cards, and United Airlines said it will require the same of its employees.
Seven universities that already have plans in place to ask students to be vaccinated before attending this fall — American University, Bowdoin College, the University of Colorado Boulder, Fairleigh Dickinson University, Fort Lewis College, Rutgers University and Wesleyan University — all said the verification process would consist of asking students to upload their CDC cards, at least if they're coming from out of state.
But since the cards are marked by hand, don't contain much information, are printed on easily obtainable heavy white paper and are impossible to quickly verify, it leaves an opportunity for the anti-vaccine community to beat the system by sharing directions on how to forge them.
"It's a cardboard paper card," said Alyssa Miller, a cybersecurity expert who specializes in protecting large organizations. "There's absolutely nothing about it that would prevent you from reproducing it."
"How are you going to make someone at the opposite end, the ones who are supposed to be verifying these, to look at one and determine if it's legitimate or if it's fake?" she said.
In March, the FBI released a public warning that creating or buying a fake vaccine card is illegal.
On conspiracy and anti-government forums throughout the web, users have linked to card templates that were left visible on the websites of state governments, including high-resolution PDFs from the websites of both the Wyoming and Missouri health departments.
The CDC has since delivered guidance to states to pull the templates from their sites, citing “misuse” by the anti-vaccine community, according to state officials.
"CDC has consistently advised states not to post the vaccine card template publicly," CDC spokesperson Kate Grusich said in a statement.
The instructions for how to create forged cards have appeared in high-ranking comments and posts on pro-Trump forums, like TheDonald.win, which was rebranded to Patriots.Win after its userbase urged one another to storm the Capitol in the days before the Jan. 6 riot.
On the extremist forum 4chan, users were told to download a template from Wyoming’s Department of Health website, then given specific directions for the thickness of cardstock needed to replicate the cards. The directions note that some vaccination centers affix stick-on labels on cards to denote the date, so the recommended resolution for the printed labels is also provided.
Versions of the instructions, which have also been posted to gun forums and QAnon forums, remind users to write the date in a blue ballpoint pen, and not to be too neat with their handwriting, emulating a rushed or tired nurse. Some instructions provide potential batch numbers of the Pfizer or Moderna shots that align with dates they were distributed.
The posts usually link to templates that were publicly available and posted on the back end of the websites of several states.
A spokesperson for the Missouri Department of Health and Senior Services said they received a call from the CDC "about a month ago" saying "it would be best for states to no longer have that material available online as some were using the card/file for fraudulent use."
"Initially, it was included on our vaccinators' resources web page because there were times when providers would not receive enough cards with the vaccines, especially when additional doses were being drawn before larger ancillary kits were made available," a Missouri Health Department spokesperson said.
Wyoming’s Health Department also confirmed its template was removed April 1, citing "misuse."
"The initial goal for posting the document was to make things a little easier for community providers," a department spokesperson said.
Despite how easy the cards are to forge, digital privacy advocates say that a paper-based system is still preferable to a central online database or smartphone app. More programs like New York's Excelsior program — so far the only statewide smartphone app that functions as a vaccine passport — would create more ways for individuals' data to be monitored, said Hayley Tsukayama, a legislative activist at the Electronic Frontier Foundation, a digital rights nonprofit.
"Setting up massive systems for tracking folks, collecting their information, and then with no kind of exit plan, how is that data going to be treated?" she said.
"We have an analog system that works for the purposes of what we're doing. You know sometimes when you're looking at smart technology, and you're like, 'Does that really need to be smart? Was that a thing that I needed in my life?'" she said. "I think this is a good example of that."
One alternative is allowing vaccine distributors, such as state governments and pharmacies, to print official cards with more built-in safeguards, more akin to a driver's license. But that requires longer-term planning for a vaccine response that's largely created in real time, said Eva Velasquez, the president of the Identity Theft Resource Center, a victim advocacy organization.
"Paper is always going to be less of a risk for unintended compromise of anything digital," she said.
"If [the CDC card] is just a short-term solution for how we temporarily navigate the world and get back to resuming our normal, then it is probably adequate. But there's a lot of unknowns. We don't know how long this is going to last."
Still, the templates now proliferate online. Some users have created archives of the documents using instant archival services like archive.is, which users now link to directly, along with the forgery instructions.
Polling has shown vaccine hesitancy is most prevalent among Republican men, with one Monmouth University poll from April 14 showing 43 percent of Republicans saying they would never receive the shot.
On pro-Trump forums like Patriots.Win where the forgeries run rampant, conspiracy theories about the vaccine and government control are the norm, not the exception.
“If they actually go the route of trying to make this ‘mandatory,’ this will become one of the most forged documents in history,” reads the top comment on one of the posts directing users to forge cards.
Kevin Collier is a reporter covering cybersecurity, privacy and technology policy for NBC News.
Ben Collins covers disinformation, extremism and the internet for NBC News.
