/ Scams

Scam alert: fake NHS Covid-19 PCR test text

A fake text message purporting to be from the NHS has been circulating, demanding that you ‘order a PCR testing kit’. Here’s what it looks like.

Many of us have been ‘pinged’ by the NHS Covid-19 app at some point over the summer, so you might just be inclined to believe another communication stating that ‘you have been in contact with someone who has COVID-19’.

But what the app wouldn’t tell you to do, of course, is order a PCR testing kit from a dubious website linked to in a text message out of the blue from an unrecognised number.

This is yet another example of fraudsters seeking to panic you into following a URL leading to a fake website, known as ‘smishing‘.

These links often lead to convincing cloned sites attempting to get you to enter all manner of personal information, and often bank details.

Reporting fake texts and websites

While the NHS does contact people via text in some cases, it would only ask you to order a test via the official GOV.UK site (https://www.gov.uk/get-coronavirus-test), while contact tracing only takes place in England via https://contact-tracing.phe.gov.uk/

Here’s how you can tell the difference between genuine NHS texts and those impersonating them.

We reported the site in the text to the National Cyber Security Centre via report@phishing.gov.uk.

We also showed a copy to the Department of Health and Social Care (DHSC). A spokesperson said:

Whilst it is possible for criminals to fake official phone numbers, they cannot fake official website addresses. We would encourage anyone with concerns about a phone call, text message or email they have received, in relation to test and trace, to check the website address being provided to you carefully. If possible, type the official address, which will be https://contact-tracing.phe.gov.uk followed by the unique characters given to you, directly into your browser.

To check what is and isn’t going to be asked, visit the NHS.UK site here. If you think you have been sent a scam message, please report it to Action Fraud.  If people receive an email which they’re not quite sure about, they can forward it to the National Cyber Security Centre’s Suspicious Email Reporting Service (SERS) via report@phishing.gov.uk

To report a spam text forward the message to Ofcom’s spam texting service on 7726.

Fortunately, the site now appears to have been removed.

Guide: how to spot a scam

Guide: how to get your money back after a scam

Have you received smishing attempts like this recently? If so, what did they say? Have you encountered other types of scams using the NHS’s name and/or logo?

If so, let us know in the comments.

Comments

I had a phone call supposed to be from the NHS regarding my covid vaccinations, everything that they were saying was true right down to were I had my covid injections and most of my details.
the scam fell apart when they went on to discuss insurance. I hung up and blocked the number.
this week however they called again ,this time it was a man who said that he was from the NHS, I told him that he was not and that he was a liar and then I hung up and blocked his number.
Honestly these people will do anything to trick you into sharing or confirming your details in an effort to scam you and sell you something you don’t need or want.

Yes I’ve had the same persistent calls from scammers who have my Talk Talk account details. Have had to close down my land line to stop the calls. Marion

Received email on Saturday 18/09/21 at 14.00 hours saying it was from NHS offering covid passports to enable foreign travel if you followed a link. This produced a NHS form requesting personal details and was a quite believable document. Being suspicious I phoned 101 and was eventually connected to Action Fraud telephone line; a recorded message said they were not available at weekends – try later! What a waste of time! I hope your efforts to prevent fraud will be more effective.

I had an NHS email today. All I had to do, was click here, to start with, yyeeaahhrriigghhtt. The NHS address was such a jumble of letters and numbers, it must be a scam. Then I looked at the Unsubcribe button, and it too had a huge jumble of letters and numbers as the address it was going to. Not NHS.gov or anything normal. Delete. But at a glance, it looked real.

Pamela Bray says:
19 September 2021

I received this email which I believe is a scam:

“We are happy to introduce Digital Coronavirus Passports(HSPS)

Dear NHS member,

Starting today you can apply for a Digital Passport.

Your account ID is xxxxxxxx Please make a note of this ID. You need it to sign in to NHS Digital Passport

The Coronavirus Digital Passport is documentation proving that you have been vaccinated against COVID-19 or you recently recovered from COVID-19

Please click on the link below to apply for your Digital Passport now

Get Digital Passport →

After 72 hours the link will not work.

We will ask you a few personal information about yourself and show you how to get your copy .

The passport will allow you to travel safetly and freely around the world without having to self-isolate.”

Joyce Gregory says:
20 September 2021

I had a text message today saying NHS. We noticed you haven’t applied for your Covid Pass. Follow the link to complete…

I have not even started to apply for whatever this means so have not taken this further. Not sure whether this is a scam but not inclined to do anything about it!

This is a scam. You don’t “apply” for a Covid Pass. Certainly not before you need one for access to a venue that requires one or for travel; they expire after 30 days.

The easiest way is by installing the NHS App on your smartphone and register. Make it more secure by using your fingerprint to authenticate. Then access the pass whenever you need to show it by following “Get your NHS Covid Pass” – for free!

Nichola Whelton says:
27 September 2021

I had a text from the NHS declaring the negative result of my latest covid test, but my date of birth and test date were both wrong. I posted my test box on the 24th September and according to the text, my swab sample got tested on the 21st!! 119 test dept. said it might just be a typo or an I.T. error as spam NHS texts include a link to a website and mine didn’t.

01371829310 covid scam they know you name and info but want to know about life insurance

Crusader says:
21 October 2021

How on earth do these idiots get our details? It must be one of two things, either people are using far too weak passwords on their online accounts or else the encryption being used on the accounts is far too weak, or both. So always use complex passwords with no real words or names and no well known and/or easily guessed number combinations but just a random jumble of upper and lower case letters, as well as nonsense numbers and symbols, although be careful with symbols as some are not accepted on some sites. And another possible security weakness here is the use of “password managers” or people storing their passwords on their hard drives or somewhere online, both VERY inadvisable. And another is NEVER click the “remember me” button on log in screens or the “stay logged in” button and if it’s already ticked as some are including Which? then untick it. Never store your passwords anywhere online, and make sure you have anti key logger software too, it should be included in your security program if it’s anything like half decent. And this situation is all the more reason for the government to enforce compulsory maximum security end to end encryption. Our government have far too much of a loose, slack casual couldn’t care less attitude with online security, just like they have with the so-called “equality” act which is also never properly enforced like it should be. The gdpr is nowhere near enough on it’s own, we need far stricter security measures properly enforced, NOW, not next century!