A fake text message purporting to be from the NHS has been circulating, demanding that you ‘order a PCR testing kit’. Here’s what it looks like.
23/02/22: ‘close contact’ test kits
Fake texts claiming that you’ve ‘been in contact with someone who has recently tested positive’ are continuing.
These texts take you through to convincing clones of the NHS site. Following the instructions will eventually lead to a page requesting your bank card details in order to pay a ‘delivery fee’.
As explained below, the NHS would not contact you in this way or ask for your bank details. If you need to get a PCR test, visit the official GOV.UK site.
If you think you may have given sensitive information to fraudsters, let your bank know what’s happened immediately.
16/09/21: fake PCR texts
Many of us have been ‘pinged’ by the NHS Covid-19 app at some point over the summer, so you might just be inclined to believe another communication stating that ‘you have been in contact with someone who has COVID-19’.
But what the app wouldn’t tell you to do, of course, is order a PCR testing kit from a dubious website linked to in a text message out of the blue from an unrecognised number.
This is yet another example of fraudsters seeking to panic you into following a URL leading to a fake website, known as ‘smishing‘.
These links often lead to convincing cloned sites attempting to get you to enter all manner of personal information, and often bank details.
Reporting fake texts and websites
While the NHS does contact people via text in some cases, it would only ask you to order a test via the official GOV.UK site (https://www.gov.uk/get-coronavirus-test), while contact tracing only takes place in England via https://contact-tracing.phe.gov.uk/
Here’s how you can tell the difference between genuine NHS texts and those impersonating them.
We reported the site in the text to the National Cyber Security Centre via report@phishing.gov.uk.
We also showed a copy to the Department of Health and Social Care (DHSC). A spokesperson said:
Whilst it is possible for criminals to fake official phone numbers, they cannot fake official website addresses. We would encourage anyone with concerns about a phone call, text message or email they have received, in relation to test and trace, to check the website address being provided to you carefully. If possible, type the official address, which will be https://contact-tracing.phe.gov.uk followed by the unique characters given to you, directly into your browser.
To check what is and isn’t going to be asked, visit the NHS.UK site here. If you think you have been sent a scam message, please report it to Action Fraud. If people receive an email which they’re not quite sure about, they can forward it to the National Cyber Security Centre’s Suspicious Email Reporting Service (SERS) via report@phishing.gov.uk
To report a spam text forward the message to Ofcom’s spam texting service on 7726.
Fortunately, the site now appears to have been removed.
Guide: how to get your money back after a scam
Have you received smishing attempts like this recently? If so, what did they say? Have you encountered other types of scams using the NHS’s name and/or logo?
If so, let us know in the comments.
Loading ...
