The Old Corner Saloon fashions itself as a small-town institution. Sitting on a historic plot of land in California’s Central Valley, the bar offers free pool, weekend karaoke and a regular “Ladies Night” — “the place where old friends return,” its website says.

But lately, state authorities allege, patrons have visited the establishment for a service unmentioned on its social media accounts or in its overwhelmingly positive Google reviews: to buy a fake coronavirus vaccination card.

Agents with the California Department of Alcoholic Beverage Control arrested Old Corner’s owner on Tuesday, charging 59-year-old Todd Anderson with three felony crimes, including identity theft, forging government documents and carrying an unregistered firearm. He was also charged with falsifying medical records, a misdemeanor. Authorities suspect another bar employee in the case, but the investigation is ongoing.

It is the California agency’s first arrest for the sale of fraudulent vaccine cards, said spokesman John Carr. State and federal officials say they aren’t aware of any others elsewhere in the country, either. If it is the first case of its kind nationally, it would represent a watershed moment in the coming fight against the forgeries that security experts have long warned about.

To some, carrying a card to verify you've had a vaccination seems like a foreign concept. But vaccine cards, or yellow cards, have been used for decades. (Allie Caren/The Washington Post)

When the Centers for Disease Control and Prevention debuted the cards, which have been given out to approximately 150 million people, some analysts were aghast at how easily copied the four-by-three-inch paper credentials were. Since then, scams have blossomed online and plagiarism how-to guides have sprouted across the fertile fields of conspiracy-theory forums.

Public health officials worry that the fakes could undermine the inoculation effort and that people could use them to misrepresent their vaccination status at school, work or during travel, potentially posing a risk to others.

“It is disheartening to have members in our community show flagrant disregard for public health in the midst of a pandemic,” Tori Verber Salazar, district attorney of San Joaquin County, said in a statement. “Distributing, falsifying or purchasing fake covid-19 vaccine cards is against the law and endangers yourself and those around you.”

In San Joaquin, east of the San Francisco Bay area, 24 percent of the population is vaccinated, lagging behind the state’s overall share of nearly 33 percent.

Anderson, who posted bail the day after his arrest and will appear in court later this month, could not be reached for comment, and it is unclear whether he has legal representation. A worker answering the bar’s phone hung up when a reporter asked about Anderson’s case.

The Department of Alcoholic Beverage Control, known as ABC, described its investigation in an agency news release. Authorities began investigating Anderson’s alleged operation after ABC received a tip that the bar, in Clements, about 40 miles south of Sacramento, was selling fraudulent cards.

Over a month, undercover agents purchased four fake cards at the business for $20 each. Authorities say Anderson had a loaded and unregistered firearm when they arrested him. They also searched the bar, finding two more completed vaccine card fakes, 30 blank cards and a laminating machine.

Investigators say they do not know how many total cards were sold and tracking them down may prove impossible. ABC plans to file disciplinary action against the bar, which could lead to suspension or revocation of its liquor license, an agency release said.

Experts say there are probably many more of these cases.

When Max Anderson, who is no relation to Todd Anderson, got his initial vaccine dose and received his vaccine card, his first thought was: Really? This is it? No QR code, bar code, watermark, anything that would make it harder to replicate?

As the director of strategy for Concentric, a security and risk management firm, it was natural he would ask these questions. But, he said, he also thought someone in the federal government would have, too.

“It was pretty obvious that document protection wasn’t taken into consideration when these cards were created,” Max Anderson said. “This would have been a pretty easy problem to solve had the right people been consulted or the right time and effort been put forward.”

He estimated that the forgery problem “is more widespread than we even think at this point.”

“You can buy anything on the deep dark Web,” he said. “So I would imagine, if you can buy drugs and weapons, you could quite easily buy a blank vaccination card.”

A former administration official involved with the vaccine effort told The Washington Post last month that plans for a digital system were underway, but that technical setbacks and time pressure forced them to rely instead on paper cards, which the CDC had reserved as a “fail-safe” option. Officials also have had to battle the increasingly politicized environment around the “vaccine passports," which would be available through smartphone applications and allow users to prove they have been vaccinated.

Now, with some businesses and universities planning to require such vaccination verification before allowing people to travel, enter stores or take classes, those who refuse to get a vaccine have gone looking for ways to fake it.

“That hesitancy combined with the fact that if you do have the vaccine you get special privileges, that has created an atmosphere that is ripe for exploitation,” Max Anderson said.

In late March, the FBI issued a public service announcement warning that making or buying fake vaccine cards is illegal and that forgeries “have been advertised on social media websites, as well as e-commerce platforms and blogs.”

On April 1, a group of attorneys general sent a letter to the CEOs of Twitter, Shopify and eBay demanding that they crack down on the scams proliferating on their sites.

That month, agents from California’s ABC would enter the Old Corner Saloon undercover.

The bar’s website describes Todd Anderson as a Minnesota native who has lived in San Joaquin County since 1986. He purchased the place in 2005, and it now sells wine from his own label, Anderson Vineyards. Anderson runs the bar with “the same industrious, inventive and congenial spirit” as the founders of the town of Clements, the site says.

“It’s a clean, safe place to come have fun and it still has the old country saloon atmosphere,” Anderson is quoted as saying. “It’s the finest drinking establishment in the west; that’s my tag line.”

Dan Diamond contributed to this report.