Vaccine Site Uses Credit History to Verify Patients’ Identities

When retired web developer Catherine Kunicki tried to sign up for her first dose of the Covid-19 vaccine in downtown Brooklyn, the AdvantageCare Physicians website rejected her. She received an error message that her identity couldn't be verified through Experian, a credit monitoring company. 

She said she's felt "horrified" at the amount of info needed from vaccination scheduling sites before users can even see when there are open slots. 

"This one wins, though," she said. 

When Motherboard tested the AdvantageCare Physicians website (as a hypothetical 65+ Brooklyn resident), we confirmed that it is using Experian to verify patients’ identities. The website claims that AdvantageCare Physicians does not get information about a patient’s credit score. But Experian is a credit reporting company and big data company, and the tool the vaccine scheduling website is using verifies identities by using information that shows up in people’s Experian credit histories. 

This is a problem for a lot of reasons. One-in-five Americans is “credit invisible” or has poor credit, according to a report from the nonprofit Corporation for Enterprise Development. Black Americans are more likely to have poor credit; they are also disproportionately affected by COVID-19. Still, this Experian tool and tools like it—collectively called remote identity proofing—are used for all sorts of things they shouldn’t be: “The remote identity proofing (RIDP) process confirms an applicant’s identity based on their credit information,” the Corporation for Enterprise Development report states. “This process has a success rate of only 78 percent, and applicants with little or no credit history and the millions of victims of identity theft cannot complete an RIDP.”

Motherboard attempted to make a hypothetical vaccine appointment with AdvantageCare Physicians. Experian said it was unable to verify our identity because “[we] don't have enough credit history," "there is a block or hold on your credit information," or "you did not correctly answer enough of the credit-based questions." We tried a second time, using real biographical information but a fake date of birth that said we are 98 years old and had no problem getting our identity verified and moving forward in the appointment-making process.

Earlier this week, as vaccination eligibility expanded to those 65 and older in New York—as well as several types of frontline workers, including healthcare personnel and grocery store employees—Motherboard tested the online vaccination signup process and found at least five different sites run by private companies, all requiring their own signup process. This is confusing enough; throwing an alert from a credit monitoring company into the mix makes it worse. 

The AdvantageCare Physicians site says that from here, you can request an activation code by filling out the same information in a new form and sending it to them. This process takes up to three business days. Three days is a long time when vaccine slots are filling up within minutes. 

Another error message Motherboard received is more intrusive: To verify you're really you, you have to select from a list of things that could identify you, such as credit cards you've owned.

According to the Experian website, the Precise ID software that AdvantageCare Physicians is using protects against fraud, including "synthetic identity fraud," where a user would fake some parts of their information to create a new identity. That's what we did in testing, but it's not what Kunicki did, and she got the error.

The fine-print on the errors we got says that answering the questions won't impact your credit score, but to users trying to sign up to get vaccinated, there's no way to tell whether the site is actually weighing your score against how or when you'll get a vaccine. Of course, this would be illegal, and anyone in one of the eligible high-risk categories (over 65, frontline workers) can get the vaccine regardless of things like income or credit score. But none of that is clear to the user.

Experian offers authentication services to private clients, which enables those clients to "validate customer information against reliable databases." Kwame Patterson, director of public relations for EmblemHealth, which owns AdvantageCare Physicians, told me that there isn't actually a credit check happening through this process, but an identity check. 

"There is absolutely no assessment of credit or any other form of financial-based information required from AdvantageCare Physicians or Experian in the sign-up process. The only check occurring is that a patient or prospective patient is who they say they are." It's also checking for bots that could access and manipulate patient information, Patterson said. None of that addresses the many problems with this type of credit history-based identity verification, however.

As for the three day wait, Patterson said that the verification process "can happen quicker" than three days, depending on the volume of registrations: "We have been able to review and validate registrations within this timeframe. New patients can also call our practice to schedule an appointment. They only have to wait for online verification if they prefer to use the online scheduler."

Even though AdvantageCare Physicians isn't checking credit scores through this process, the insinuation that you need a credit history to be verified could deter a lot of people from following through and getting the vaccine.

Kunicki said she gave up attempting to get through the site for the day. "So, even though (or maybe because) I am immune compromised and 67 years old, I’m going to stay home and wait until this is easier or one of my physicians or pharmacies has a vaccine available and I am notified," she told me—adding that she might try one more time to get in and find slots at midnight when the days reset, or in the morning.