/ Scams

Scam alert: fake NHS Covid-19 PCR test text

A fake text message purporting to be from the NHS has been circulating, demanding that you ‘order a PCR testing kit’. Here’s what it looks like.

Many of us have been ‘pinged’ by the NHS Covid-19 app at some point over the summer, so you might just be inclined to believe another communication stating that ‘you have been in contact with someone who has COVID-19’.

But what the app wouldn’t tell you to do, of course, is order a PCR testing kit from a dubious website linked to in a text message out of the blue from an unrecognised number.

This is yet another example of fraudsters seeking to panic you into following a URL leading to a fake website, known as ‘smishing‘.

These links often lead to convincing cloned sites attempting to get you to enter all manner of personal information, and often bank details.

Reporting fake texts and websites

While the NHS does contact people via text in some cases, it would only ask you to order a test via the official GOV.UK site (https://www.gov.uk/get-coronavirus-test), while contact tracing only takes place in England via https://contact-tracing.phe.gov.uk/

Here’s how you can tell the difference between genuine NHS texts and those impersonating them.

We reported the site in the text to the National Cyber Security Centre via report@phishing.gov.uk.

We also showed a copy to the Department of Health and Social Care (DHSC). A spokesperson said:

Whilst it is possible for criminals to fake official phone numbers, they cannot fake official website addresses. We would encourage anyone with concerns about a phone call, text message or email they have received, in relation to test and trace, to check the website address being provided to you carefully. If possible, type the official address, which will be https://contact-tracing.phe.gov.uk followed by the unique characters given to you, directly into your browser.

To check what is and isn’t going to be asked, visit the NHS.UK site here. If you think you have been sent a scam message, please report it to Action Fraud.  If people receive an email which they’re not quite sure about, they can forward it to the National Cyber Security Centre’s Suspicious Email Reporting Service (SERS) via report@phishing.gov.uk

To report a spam text forward the message to Ofcom’s spam texting service on 7726.

Fortunately, the site now appears to have been removed.

Guide: how to spot a scam

Guide: how to get your money back after a scam

Have you received smishing attempts like this recently? If so, what did they say? Have you encountered other types of scams using the NHS’s name and/or logo?

If so, let us know in the comments.

Comments

I had a phone call supposed to be from the NHS regarding my covid vaccinations, everything that they were saying was true right down to were I had my covid injections and most of my details.
the scam fell apart when they went on to discuss insurance. I hung up and blocked the number.
this week however they called again ,this time it was a man who said that he was from the NHS, I told him that he was not and that he was a liar and then I hung up and blocked his number.
Honestly these people will do anything to trick you into sharing or confirming your details in an effort to scam you and sell you something you don’t need or want.

Yes I’ve had the same persistent calls from scammers who have my Talk Talk account details. Have had to close down my land line to stop the calls. Marion

Received email on Saturday 18/09/21 at 14.00 hours saying it was from NHS offering covid passports to enable foreign travel if you followed a link. This produced a NHS form requesting personal details and was a quite believable document. Being suspicious I phoned 101 and was eventually connected to Action Fraud telephone line; a recorded message said they were not available at weekends – try later! What a waste of time! I hope your efforts to prevent fraud will be more effective.

I had an NHS email today. All I had to do, was click here, to start with, yyeeaahhrriigghhtt. The NHS address was such a jumble of letters and numbers, it must be a scam. Then I looked at the Unsubcribe button, and it too had a huge jumble of letters and numbers as the address it was going to. Not NHS.gov or anything normal. Delete. But at a glance, it looked real.

Pamela Bray says:
19 September 2021

I received this email which I believe is a scam:

“We are happy to introduce Digital Coronavirus Passports(HSPS)

Dear NHS member,

Starting today you can apply for a Digital Passport.

Your account ID is xxxxxxxx Please make a note of this ID. You need it to sign in to NHS Digital Passport

The Coronavirus Digital Passport is documentation proving that you have been vaccinated against COVID-19 or you recently recovered from COVID-19

Please click on the link below to apply for your Digital Passport now

Get Digital Passport →

After 72 hours the link will not work.

We will ask you a few personal information about yourself and show you how to get your copy .

The passport will allow you to travel safetly and freely around the world without having to self-isolate.”

Joyce Gregory says:
20 September 2021

I had a text message today saying NHS. We noticed you haven’t applied for your Covid Pass. Follow the link to complete…

I have not even started to apply for whatever this means so have not taken this further. Not sure whether this is a scam but not inclined to do anything about it!

This is a scam. You don’t “apply” for a Covid Pass. Certainly not before you need one for access to a venue that requires one or for travel; they expire after 30 days.

The easiest way is by installing the NHS App on your smartphone and register. Make it more secure by using your fingerprint to authenticate. Then access the pass whenever you need to show it by following “Get your NHS Covid Pass” – for free!

Nichola Whelton says:
27 September 2021

I had a text from the NHS declaring the negative result of my latest covid test, but my date of birth and test date were both wrong. I posted my test box on the 24th September and according to the text, my swab sample got tested on the 21st!! 119 test dept. said it might just be a typo or an I.T. error as spam NHS texts include a link to a website and mine didn’t.

01371829310 covid scam they know you name and info but want to know about life insurance

How on earth do these idiots get our details? It must be one of two things, either people are using far too weak passwords on their online accounts or else the encryption being used on the accounts is far too weak, or both. So always use complex passwords with no real words or names and no well known and/or easily guessed number combinations but just a random jumble of upper and lower case letters, as well as nonsense numbers and symbols, although be careful with symbols as some are not accepted on some sites. And another possible security weakness here is the use of “password managers” or people storing their passwords on their hard drives or somewhere online, both VERY inadvisable. And another is NEVER click the “remember me” button on log in screens or the “stay logged in” button and if it’s already ticked as some are including Which? then untick it. Never store your passwords anywhere online, and make sure you have anti key logger software too, it should be included in your security program if it’s anything like half decent. And this situation is all the more reason for the government to enforce compulsory maximum security end to end encryption. Our government have far too much of a loose, slack casual couldn’t care less attitude with online security, just like they have with the so-called “equality” act which is also never properly enforced like it should be. The gdpr is nowhere near enough on it’s own, we need far stricter security measures properly enforced, NOW, not next century!

Chris S says:
26 October 2021

Just received this one. Looks like there’s a new website up…

“NHS: You’ve been in contact with someone who has COVID-19. You must order a PCR-Testing Kit here: https://nhs.uk.order-pcrkit.com (even if you’re vaccinated).”

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

Thanks for sharing Chris, we have passed this one on to our scams team 🙂

Hello just had phishing scam today, same as above, you must order a PCR test kit with all of your banking details ‘Scum bags’ 27/10/21. nhs.uk.pcrkit-package.com dodgy site Have reported this Scam. FROM JC.

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

We have received the same text as Chris S today (26th October) at 12.13. I reported it to the National Cyber Security centre before checking out here. Fortunately we knew that you don’t have to order PCR tests as you can just go to a walk in testing centre.

Helene Witcher says:
5 January 2022

I received a text at 17.58 today Wednesday 5th, from +44 7519 328622 saying ‘NHS: You have been in contact with someone who has the Omicron Variant. You must order a free PCR testing kit here: https://mypcr-test.com
I clicked the link, filled in all my details until it asked for my credit card details to pay the £3.99 it would cost to send me the kit with a return address sticker. I phoned the number and left a disbelieving message. Yet, still unsure about its reliability, and as a vulnerable person who regularly receives helpful texts from the NHS in Scotland, I worried whether it might be valid. So I went onto the government site and ordered a PCR test (which previous Scottish Govt texts had advised me to do if required). I’m afraid that I don’t know how to ‘forward’ the text to the phishing people. Perhaps you might inform them for me?

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

I had this text
NHS: You have been in contact with someone who has the Omicron Variant. You must order a free PCR testing kit here: https://mypcr-test.com
Started filling in the order but it then asked for £3.99 delivery charge and credit card details. Thought it was a scam so stopped.

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

Nicholas Hall says:
6 January 2022

I had the self-same text as Ena Stansfield, received late last night. Might well have fallen for it then, but my built-in anti-tech bolshie-ness told me to leave it till today. Just as well! I started getting suspicious as (a) I couldn’t think of anyone who I’d been in contact with except in company with my wife, who didn’t get that message; and (b) the “my-pcr-test.com” reference didn’t square with anything from the NHS so I didn’t do the link.
It has now blocked me from opening it in full, as I clicked something called “info” on my phone – it just wanted info from me, i.e. my location, which I didn’t give.

Thank goodness for Which? for confirming my suspicions!

I have sent it with its phone number (+44 7519 328619) to the report@phishing.gov.uk email address.