This is what I want to avoid. They could automate a process, assign a few employees, and burn through about 500 cards a day. In a few weeks they could confidently verify all cards with minimal cost/effort (this is a large company).

My research suggests fake vaccine card is bunk then, because vaccine providers do submit information to a state database, so companies can just check the registers...