One of the biggest things that COVID-19 took away from people around the world was sharing. Sharing a meal, sharing a hug, sharing a space, sharing a memory—all of that and more was taken away by the pandemic. Now as we emerge from the grips of COVID-19, naturally people want to begin sharing all of those things and more once again. But as people do start sharing, there is one thing that people should be sure to keep to themselves: their COVID-19 vaccination record card. Although it is tempting to send it in an email or post it on social media, doing so brings with it serious risks of identity theft that people should avoid.
The white cards—a familiar sight to anyone who has gotten their shot—contain a lot of information for a small piece of paper. A quick glance shows an individual’s full name, date of birth, location where they received their shot, the date of their vaccination, which shot they received, and the dose number. Depending on the person, it could potentially include even more information.
Posting a photo of the card or sharing it via any other medium puts all of that information into the public domain, making it accessible to virtually everyone on the planet. with a full name and date of birth, it becomes easy for a cybercriminal to get access to personal, financial, and medical accounts that hold someone’s most sensitive information. Using the location of the vaccination site, it could also become easier to pinpoint where a person lives. In potentially the worst-case scenario, the information could be used in a phishing attack to pretend to be a healthcare provider or pharmacy, entrapping someone into sharing more information.
The risk is so significant that, in February, the Federal Trade Commission published a statement warning people of the risks related to sharing their vaccination cards, and why they should make every effort to leave them off screens.
“Your vaccination card has information on it including your full name, date of birth, where you got your vaccine, and the dates you got it. When you post it to Facebook, Instagram, or to some other social media platform, you may be handing valuable information over to someone who could use it for identity theft,” said the statement.
“Think of it this way — identity theft works like a puzzle, made up of pieces of personal information. You don’t want to give identity thieves the pieces they need to finish the picture. One of those pieces is your date of birth.” It continued, “For example, just by knowing your date and place of birth, scammers sometimes can guess most of the digits of your Social Security number. Once identity thieves have the pieces they need, they can use the information to open new accounts in your name, claim your tax refund for themselves, and engage in other identity theft.”
Even with the warnings from a federal agency, the rebuttal that comes to mind is a common one: full names are online, birthdays are on Facebook, and locations are tagged on social media as well—why does it matter if they are shared again?
The answer: because it is all in one place. When all of the information is in the same image attackers don’t have to go looking for it across the internet—a small hurdle but nevertheless an effective one. Putting everything in one photo makes someone a target and increases the likelihood of cybertheft.
Across the country there have already been stories of vaccine card-related fraud and crime. In California a man was arrested for a fake card scheme, and a similar case occurred in New York, to name a few. There have also been reports of people seeking vaccine numbers and other information to use on their own fraudulent cards.
But for as risky as posting a vaccine card is, the solution could not be simpler. Don’t post a vaccine card online, and if you have, take it down. Furthermore, always be vigilant with emails claiming to be related to COVID-19 or from a healthcare provider. Phishing scams have risen exponentially, and using a careful eye with emails, text messages, and other communications, is the best safeguard.
So as the world continues to make steps to return to normal, enjoy sharing the experiences that COVID-19 took away. Just be sure that it does not include a picture of a vaccination card.
