All it takes to make your own vaccination card is a few minutes of online searching, a printer and some card-stock paper.

That’s not good news for businesses across the U.S. which are – under guidance from the Centers for Disease Control and Prevention – relaxing restrictions and allowing vaccinated people to take off their masks and move about more freely. Where proof of vaccination is required, companies are relying on a program that’s easily circumvented and open to outright fraud, making it little better than the honor system.

Meanwhile, the incentives to appear vaccinated are increasing: United Airlines won’t hire any more non-vaccinated employees after June 15. Bruce Springsteen’s Broadway show will sell tickets to only vaccinated patrons. Several baseball stadiums are selling tickets to “vaccinated only” sections. At Walmart, the nation’s biggest private retailer, workers get a $75 vaccination bonus if they can show an “original, completed vaccine card for visual inspection.”

The problem of how to prove vaccination status is challenging for governments around the world, but it’s particularly acute in the U.S., where there is no nationalized healthcare and a sizable community that is fearful of or opposed to the vaccine. The scramble for fake versions of the paper cards intensified after May 13, when the CDC lifted most of its mask-wearing recommendations for anyone who is fully vaccinated. Google searches for the phrase “Fake COVID vaccine card” spiked within days, reaching peak U.S. popularity on the website that week.

“Where can I get a fake COVID vaccine card will pay top dollar,” asked one Twitter user. “I bought my vax card off Craigslist prefilled out,” declared another. “Where can I get a blank vaccination card?? Hmu if you work at a vaccine site. Lets start a business!” tweeted one user in a now-deleted post.

“At this point it’s very difficult because the legitimate forms are just on a piece of paper,” North Carolina Attorney General Josh Stein, a Democrat, said in an interview. “So it puts businesses that are trying to protect their patrons in a very difficult spot.”

Falsified cards are illegal, according to the Federal Bureau of Investigation, and some people have been arrested for possessing them and selling them. “In general, anyone using emblems, names, and/or seals of federal agencies without authorization is in potential violation of U.S. Code,” said Sutton Roach, a spokesperson for the FBI.

For those looking to buy or make their own cards, however, the process isn’t difficult.

There are free templates on partisan social media, hospital websites and places you’d normally get legal and tax forms. The state of Tennessee offered a version of the official vaccination card on its website, though it has since been removed. “The COVID-19 blank vaccination card templates were provided on the TDH website for providers to access and print off in their offices as needed,” said Bill Christian, a spokesman for the Tennessee Department of Health. “These templates have been removed from the TDH website over concerns they could be copied and used fraudulently.”

Could someone tell if a paper card wasn’t issued by an official medical provider?

“Absolutely not,” said Keri Althoff, associate professor of epidemiology at Johns Hopkins Bloomberg School of Public Health.

Vaccination cards are not new — your parents may have had to show one to get you into school in years past, or you might have a more recent version if you’ve traveled to a country that requires specific vaccines. But using them to get into sporting events, concerts, even gym glasses, is a new phenomenon.

“Were admissions to baseball games or receipt of $75 bonuses part of what CDC had in mind? I doubt they thought about that,” said Dr. Jessica Justman, Associate Professor of Medicine in Epidemiology at Columbia Mailman School of Public Health. “Using the card in those ways invites duplication for fraudulent purposes. It is unfortunately both a sad and predictable turn of events.”

In some cases, employment may hinge on being vaccinated – a Texas judge this month rejected a lawsuit from a group of hospital workers who are being forced to get the vaccine or lose their jobs.

As Wall Street seeks to bring more workers back to the office, private equity firms Carlyle Group Inc. and Warburg Pincus have already told employees they’ll require COVID-19 vaccinations to return. Goldman Sachs Group Inc. asked workers in New York to begin returning, after reporting their vaccination status.

Some states oppose a national program to show vaccination status – the governor of Texas signed an executive order in April prohibiting entities that receive state funds from requiring customers to show proof of vaccine. Other states, including New York and California, have instituted their own voluntary vaccination certificate programs in the absence of a national program.

“Vaccination cards have long been used and provided as a record of an individual’s vaccination history,” Chandra Zeikel, a spokesperson for the CDC’s vaccine task force, said in an email. “Questions regarding vaccine certification should be directed to the White House.”

The White House has dismissed the idea of a federal document certifying vaccination status. “We are not instituting vaccine passports from a federal level,” White House Press Secretary Jen Psaki said last month.

On the matter of counterfeited cards, a White House spokesman referred to an April response from Psaki, who said at the time that the administration was aware of reports of fake cards but deferred to law enforcement agencies to crack down where necessary.

Meanwhile, those tasked with combating fraud have seen a spike in phony cards. What started in early 2020 with the sale of fake COVID-19 test kits, then transitioned to collecting money for a place in the vaccine line, has now landed on the sale of vaccination proof. “Unfortunately we’re seeing an increase,” said Chris Schrank, Assistant Inspector General for Investigations at the Department of Health and Human Services’ Office of Inspector General, which fights fraud in agency programs.

“This is a problem that attorneys general, on a bipartisan basis, are concerned about,” said North Carolina’s Stein. In April, 47 attorneys general warned Twitter, eBay and Shopify to take steps against the sale of fraudulent COVID-19 vaccine certificates on their sites.

“If there’s any culpable party, it’s not the business,” says Nicholas Bagley, a law professor at the University of Michigan. “It’s the person that filled out the fake vaccination card.”There are no available figures on how many bogus cards are out there. While more than half the U.S. population has had at least one shot to avoid the deadly virus, 13% say they refuse to get vaccinated, and another 19% are holding off for now, a May poll by the Kaiser Foundation showed. That’s 105 million people who could be excluded from a return to pre-pandemic life in situations where inoculation is required.

It’s also a burgeoning market for scam artists and illegal activity.

In California, a bar owner was arrested for selling cards with his drinks, and a man who worked at a vaccination center in Los Angeles was arrested for allegedly stealing more than 500 cards that prosecutors said were worth at least $15 apiece. On Long Island, Nassau County police arrested a man after finding brass knuckles, a “controlled substance” and 64 vaccination cards, some of them blank, in his car.

Of course, you don’t need to find the right bar or head to an idling car in a high-crime area to buy your card. On the dark web, messaging apps and some social media sites, chat rooms have popped up with sellers offering to deliver “CDC, NHS and other COVID vaccine cards to those who need the cards but are not willing to take the vaccines.”

Often, these are scams, and law enforcement officials have issued several warnings about buying fake cards. In some cases, sellers seek their payment in cryptocurrency and never deliver the promised goods.

One online vendor’s site was flooded with anti-vaccine content, including memorials to people who allegedly died after getting the vaccine and posts by those who claim to be suffering with serious, vaccine-induced side effects. (The CDC says evidence from 285 million doses administered shows vaccines are safe and effective.)

The seller claimed to be a doctor and said the fake card would be verified in the CDC registry (Spoiler alert: there isn’t one). “Get your cards now and keep your DNA unchanged” is the tag line for the pinned message appearing on the encrypted online channel.

The risks of being in a crowd of “vaccinated” people who may not actually be vaccinated raises the stakes for everyone.

“If someone who is unvaccinated wants to go into the vaccinated crowd, they are lessening their risk,” said Karl Minges, associate professor of public health at University of New Haven. “But ultimately they could be exposing people who were vaccinated in an unfair way. These vaccines are highly efficacious, but they are not 100%.”

In Raleigh, North Carolina, the Players Retreat restaurant will reopen this week for the first time since the pandemic began. It’s checking vaccine cards ahead of time and will only allow vaccinated patrons to dine inside.

Owner Gus Gusler made that decision out of concern for his wife, Doris, who suffers from a severe respiratory condition that makes it unsafe to be in close proximity to unvaccinated people. “I promised our team we wouldn’t go back to work until my wife and I felt comfortable coming in and having a beer at the bar,” Gusler says.

As for anyone who tries to enter under false vaccination pretenses: “I consider that an assault,” Gusler said. But, he adds, “there’s no way to really know for sure.”