Swapna Gopinath was surprised when she received a message that said it was time for her second dose of the COVID-19 vaccine. She had not taken her first dose yet. She remembered getting another message several weeks earlier about getting the first dose. But she brushed it off as some goof-up by the website for vaccination. It was when she later tried to register on the Co-WIN portal for vaccination that she realised it was a serious problem. Someone else was already registered on the website using her number and that person received both doses of the vaccine too.
Swapna, who is over 45 years old, is not alone in her predicament. Thiyagarajan from Poonamallee in Chennai also faced a similar problem when he tried to register on Co-WIN. Both tried to reach out to the authorities concerned but to no avail. “I could not register at first and I wondered if someone else was using my Aadhaar details, because I got a message from the Aadhaar site too, sending me an OTP,” Swapna, a professor in Pune, who is originally from Kerala, said in a Facebook post on June 3.
She tried to register a complaint on the government website but the mail kept bouncing back. She tweeted, tagging the authorities. Yet, there was no response. When nothing else worked, she used her daughter’s number to register as her family member and get the first dose. “Later, when I tried again, using my number I found that the other person who got vaccinated was now added as my family member!”
In Thiyagarajan's case, a message came on his phone towards the end of May, addressing him as Dilliraj. The message told him that his first dose of Covaxin has been administered. This was of course news to him. He also downloaded the certificate from Co-WIN portal, which said that the vaccination took place at RK Nagar UCHC.
"I called up a number of helpline numbers to report the matter, the Chennai Corporation, COVID portal number 1075, the Thiruvallur district disaster management team number, Amma call centre 1100 and so on. No one gave a proper answer and they told me to call some other department and this went on,” Thiyagarajan says.
One person even told him not to worry because he could register up to four persons using one number. "But that's my contact number and why should someone else misuse it?" Thiyagarajan asks.
But what perplexes him more is how someone else could get the OTP that would be sent to his number. It is not clear if the mix-up happens with the phone number or the Aadhaar card.
Swapna says, “The issue is not that I can’t get vaccinated. I could use my daughter’s number for now. But this is a case of identity theft and we don’t know who can be held responsible for it.”
The Co-WIN platform allows the registration of up to four persons with one mobile number. For example, if a frontline worker did not have a mobile number, he/she would use the number of another worker. "This is to enable vaccination among families where no member owns a mobile phone,” said RS Sharma, CEO of National Health Authority CEO, who also heads the Empowered Group on Vaccine Administration (EGVAC). He was responding to an article by MediaNama (a publication that provides information and analysis on India’s technology policy), which reported on such “ghost registrations,” where the real owner of the mobile number was oblivious of the vaccine registration by another person.
When MediaNama contacted the technical team of Co-WIN portal about the issue, they were told that such complaints do occur and that sometimes two people get the same number by default. So registration could happen in someone else's name. However, it was not explained what number they were referring to as the call was immediately disconnected.
However, such registrations have been rampant during on-site registration for vaccines during the drives for healthcare and frontline workers, as well as those above 45 years of age. While the details of the healthcare and frontline workers were furnished on Co-WIN 1.0 via Excel sheets, citizens above 45 years orally gave their details to the vaccinator and staff at the registration counter, which were then keyed in on Co-WIN 2.0 portal.
“That’s what happens when you go for spot registration. Co-WIN only verifies your identification data and not your phone number at spot-registrations. So, barring the identity card details, all details are keyed in without verification,” data privacy expert Anivar Aravind told TNM.
The system of verification through OTPs began only on April 28 this year (for the 18-44 age group).
“The staff verify the ID card and then type the other details as you tell them – your name, guardian’s name and so on. These can get mixed up sometimes, or typed wrongly. Sometimes, when a person goes for the second dose, they wouldn’t have any data of the person’s first dose, since many vaccination centres also face connectivity troubles and data loss. So, as of now, there is no solution to remove the wrong vaccination record against your phone number,” explained Anivar.
According to Anivar, there is currently no solution to this issue. Besides, there is no complaint channel or call centre that solves this issue,” he said.
EGVAC chief RS Sharma said that the Co-WIN portal has security features to ensure a mobile number is not used by another person for registration without consent.
IT expert Hrishikesh Bhaskaran imputed the errors to technical glitches on the Co-WIN portal. "It doesn't seem like these are fraudulent entries. It could be errors during the database recreation and data migration. It's not clear where the error occurs,” he said. The only solution, he said, is to get added as the family member of someone else.
Hrishikesh believes that this could have been better handled if the whole process was decentralised and the states were given control. "We are a country that's done mass vaccination drives before. It should happen at the ward or panchayat level," he said.