/ Scams

Warning: new fake NHS COVID Pass emails and texts

Scammers are hoping to cash in on any confusion around the end of pandemic restrictions – watch out for these fake emails and texts.

08/11/21: Fake texts continue

We’ve been made aware of new fake text messages relating to Covid Passes – this example tells the recipient that theirs is ‘ready to be processed by our team’.

As with other examples we’ve seen, the message attempts to get you to click through on a suspicious link that’s posing as the NHS via a sub domain.

Fortunately this site now appears to have been removed by the host, however it’s an opportunity to remind everyone to be aware of these fake text messages and the tactics they employ. Our advice for spotting and avoiding them can be found below.

08/07/21: Covid Pass scams

The NHS Covid Pass was recently launched so people can show their Covid vaccine or test status, which might be needed to travel and gain entry to some events.

Vaccine passes are completely free. You can download a digital version using the NHS app, or ask for a physical copy to be posted to you.

But fraudsters have been sending out fake NHS branded emails, falsely inviting people to apply – and pay – for a pass. We’ve also seen fake text messages along the same lines. These texts can be especially convincing as the NHS does contact patients using text messages.

Examples of fake NHS Covid Pass messages

Here’s one of the phishing emails we’ve seen:

And here’s a text message that links to a copycat NHS site that aims to steal victims’ personal and banking details:

We know that scammers used similar tactics when the vaccine became available. The NHS Counter Fraud Authority (NHSCFA), which works to fight and prevent fraud affecting the NHS, told us:

Criminals are using the Covid-19 vaccines as a way to target the public by tricking them to hand
over cash or financial details. They are sending convincing-looking text messages letting people
know they are eligible for the vaccine or phoning people directly pretending to be from the NHS, or
local pharmacy.

The NHSCFA have put together guidance and advice to help anyone who may be a
target of these kinds of scams – Covid-19 vaccine fraud (cfa.nhs.uk)

NHS Covid passes are free of charge and can be obtained through the NHS website and app.
Instructions on how to get one are detailed here.

If you believe you are the victim of a fraud relating to the COVID-19 vaccine, please do not report
this to the NHSCFA. Please report it to Action Fraud, forward any suspicious emails to
report@phishing.gov.uk, and forward suspicious texts to 7726.

How to deal with NHS-related phishing

The best way to avoid text message scams is to never follow the links in texts that claim to be from organisations or companies.

Experience: “How I almost fell for the fake vaccine text”

If you get a text purporting to be from the NHS that you’re not sure about, check the details with your GP surgery or NHS service.

Guide: how to spot a text message scam

Guide: how to get your money back after a scam

Phishing emails should be reported to the National Cyber Security Centre on report@phishing.gov.uk

Fake texts (smishing) can be forwarded to 7726 (spells SPAM on the keyboard).

Have you been targeted by these fake NHS messages or similar? Let us know what happened in the comments, and help us spread the word by sharing these warnings with your friends and family.

Comments
MRS JOYCE BOLDERO says:
22 January 2022

Fake text message received today – 22/01/2022 from – +447306592139 – asking us to PAY

Please report this message as suggested in the introduction, Joyce. Just forward it to 7726.

Phil says:
25 January 2022

07768519420 telling me I “still haven’t applied for a Covid Pass” and I could “face a fine” – spam

Phil says:
25 January 2022

07768519420 telling me I “still haven’t applied for a Covid Pass” and I could “face a fine” – spam

Jimbo says:
26 January 2022

Got an email today about this, filled it all in. The last question asked for 49p, didn’t get it.

chantelle says:
30 January 2022

message said ‘NHS: You are now eligible for the Covid Pass, please visit: https://nhs-mycovidpass.com to apply now.’ from xxxxx . when I unfortunately clicked on the link it told me it was unavailable, then I tried to forward it to7726 but it said this needed a payment so i didn’t forward it as i wondered if this was an additional clever link to another way of scamming?

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

Danielle Light says:
11 February 2022

Text saying I have been in contact with a person with covid and need to order a test kit . Checked link, web site doesnt exist.

John Walcroft says:
12 February 2022

John W
Tex sent from Mobile 07759129418 .
NHS: you’ve came in contact with the Omicron Varient.
Apply for test kit:
Ask’s for card details to purchase kit for £1.49.

Lynn Dumbleton Firth says:
22 February 2022

Today my NHS Covid19 app flagged a message re a recent covid19 contact on the 16th Feb 2022. The Covid 19 app flashed a message without the NHS Heading or telling me it knew who I was etc.

It asked for age group (yes or no) answer and then a continue button.

At this stage the app was closed but the covid19 app when closed continued flashing a message.

The app could no longer be accessed as the covid19 app, and refused any other input but for the previous personal information etc.

It seemed to have taken over my covid19 app and refused any other input what ever I did.

I deleted the app and reinstalled it.

Now all ok!

Very concerning as it appered to only target the Official NHS Covid 19 app controls.

The following email arrived today (23.2.22) – a day after I applied for a renewal of my “ordinary”
(10-year) passport, strangely enough! The salutation used my email address, rather than my name or “Dear Sir/Madam”. I’m glad I didn’t click on the hyperlink “CONFIRM INVITATION AN (sic) RECEIVE YOUR GREEN PASSPORT” !!

“From: “NHS COVID-19 Notification”
Date: 23 February 2022 at 09:04
Subject: [COVID-19 Reminder: CoronaVirus New NHS Green Passport Available] New Green Passport [Pass No.F9S6DM4YW674512 ] was issued today and it is valid for 270 days.Accept invitation and claim you Passport Online today issued by National Health Service!

Perhaps it is mere coincidence that my brother received the following email, a day after applying to renew his passport (i.e. what was meant by “passport” before the Covid era!!) He used the Post Office digital Check & Send service. Could there have been a security breach at the Post Office?

The sender was NHS COVID-19 Notification” <health610495.188621159@

The email purportedly offered a Green Passport.

I note that that the addressee wasn't my brother's name or Sir/Madam, but his email address. Also there was an error in the hyperlink, which was worded "CONFIRM INVITATION AN (sic) GET YOUR GREEN PASSPORT".

The instructions were to confirm or reject (!?) by clicking on the link.

Hope this is of help.

I’ve had a few scams one saying I need to have my covid jab and if I miss my appointment the nhs would charge me. Went on the official nhs site spoke to a member of staff and told me to phone the nhs fraud team also sent them a screenshot. They confirmed it was a scam. I knew it was because the time I got this through I’d already had my two single injections and my booster. That made me suspicious and nhs going to fine me if I didn’t turn up.

David Gray says:
13 March 2022

Text and email scams often look genuine but usually require further steps before you actually get scammed. Sometimes emails have a typo or something else that doesn’t look right. These errors are apparently inserted so that the people who click on them are more likely to become successful victims.

Sylvia Louisa Evans says:
14 March 2022

NHS scam. I hope helps other members. I received telephone messages warning of imminent Police visit re my missed appointment aiming to ‘do a welfare check to see if I am all right,’ followed by a ‘reminder team’ banging on my side front door; shouting/shining torch through my letterbox. They left when I said I am ok. The original NHS letter referred to my 2017 medical record before a 2021 blood pressure diagnosis. Today, I had two telephone calls at 08:44 & 14:44 from the same number – different on letterhead. PROOF OF SCAMS: No NHS clinic would risk a patient having a heart attack. No Police force would risk a patient having a heart attack. I did hear other familiar voices in my passage during the ‘welfare check.’

rik says:
27 April 2022

received a text from” NHS-NOREPLY” saying I was a close covid contact and to order a Omicron PCR test. The link takes you to a ordering page to enter your details and pay 99p postage but also appears to be operating inside the main NHS website, all the links accessable from the page are genuine NHS pages.
Website is nhs.test-kits-gb.com/nhs