/ Scams

Scam alert: fake NHS COVID-19 vaccine text

A dangerous fake NHS text has been circulating, telling people they’re eligible to apply for the COVID-19 vaccine. Here’s what it looks like.

A member got in touch with us today when they received a text message purporting to be from the NHS.

It confusingly stated that “we have identified that your are eligible to apply for your vaccine” and advised him to follow a link to get more information and ‘apply’:

This URL takes you through to an extremely convincing fake NHS website that asks for your personal details, but the member became suspicious when it asked for his bank/card details in order to ‘check his identity’.

It was then that he began spotting spelling mistakes on the site and in the SMS itself, which we’ve warned many times before are classic signs of a phishing scam.

We found that the fake site was also registered just two days ago – another reason to be suspicious, and one that demonstrates the importance of reporting these scams as soon as you receive them.

As of 26 January, variants of this scam are now also being reported:

Remain vigilant of coronavirus scams

We know that criminals will use the confusion and urgency around the pandemic as a way to target potential victims – we’ve covered five similar attempts here on Which? Conversation already:

Council tax reduction phishing email

Fake NHS contact tracing text

HMRC Government grant phishing email

Microsoft ‘covid relief fund’ phishing email

COVID-19 vitamin pill cold calls

With the recent approval of multiple vaccines in the UK, these types of scam attempts are likely to continue as fraudsters look to take advantage of the rollout to so many people.

Our advice

If you think you may have handed over your card details to scammers, let your bank know what’s happened immediately.

You can then attempt to recover any money lost by following our guide here.

Have you received this fake NHS vaccine text or any other type of scam relating to the vaccine?

Let us know in the comments if you have, and please do share this warning with friends and family so we can prevent anyone from falling victim.

Update 7/1/2021: Cold calls

Cold calls regarding the vaccine are also beginning to take place – we’ve already had reports of scammers asking people to pay for it over the phone:

If you receive one of these calls, hang up.

The NHS will contact you when it is your turn to receive the vaccine, likely by letter from your GP or from the NHS itself. However, if you’re aged 70 or over or you’ve previously received a letter saying you’re high-risk, you no longer need to wait to be contacted and can book your appointment online.

Read more about the COVID-19 vaccine rollout, and what it means for you

Pete H says:
1 January 2021

A neighbour of my mother-in-law received this scam message or a variation of it that purported to come from their local doctor’s surgery, but because she had already received the vaccine did not need to respond to it (luckily), and knowing that mother-in-law was still waiting to hear, kindly wrote out the link on a piece of paper for her.
Typing in the link takes you to a genuine government page, but for visas, so it is the changed link behind the URL that is the issue.
We informed m-i-l that it was probably a scam and she has passed the message on to her neighbour. She also contacted her doctor’s surgery and informed them and they have reported it onwards.

Sally says:
4 January 2021

I received it. It looks incredibly authentic, I went through until it asked for my bank details and then realised my mistake. Deleted it from my phone but I have them my name, address and dob. I am being extremely vigilant now but it caught me. I work for the NHS so should have known better.

We must all be much more careful in reacting to messages via e-mail and social media. It’s good to know that banks are responding helpfully to customers’ losses, but the refunds are coming out of customers’ deposits, higher interest rates and increased charges for services. Nothing coming out of the blue on the internet that requests personal details or a specific urgent response should be trusted. No bank will ask for such a reaction on-line. Always check the origin of any demand, be cautious, and don’t panic. If we’re not careful, banks will start closing the door on refunds where the bank has no liability.

If we’re not careful, banks will start closing the door on refunds where the bank has no liability.
As the refunds come out of customers’ (and my) money, I do not want the banks to make refunds where they have no liability and have not been negligent. I’d prefer it if the account facilities offered to people were tailored to their abilities; for example by limiting the amount of any instant transfer, requiring a second authorisation for those less capable, using an approved list of payees, and, more importantly, helping to educated customers in the dangers of going into unfamiliar territory.

We have to be responsible for our own actions and only blame someone else when they have acted improperly. Otherwise many will take a less careful approach knowing that if it all goes wrong we’ll bail them out.

Fred says:
10 January 2021

I most certainly do hope the banks close the door on refunds where they have no liability for the reason you yourself have given ” the refunds are coming out of customers’ deposits, higher interest rates and increased charges for services”.

The card and cheque I sent my daughter has finally arrived, 2 weeks after it was posted, but some good may have been derived from this. as Wavechange highlights a very important point. Fraudsters are able to open accounts using very convincing fraudulent ID which absolves banks from any liability and unsuspecting customers deprived of their savings.

Glad your post turned up Beryl, I am still waiting for mine to turn up.

Debbie says:
9 January 2021

It’s much safer to send money by direct bank transfer from your account to hers or, if that’s not possible, by using something like PayPal. Any physical service is open to abuse by the unscrupulous and, sadly, that seems to be even more prevalent now.

Original comment in wrong place. Moved to below.
Beryl, I’m glad to hear your card and cheque finally arrived. I have had some late post as well.
As far as I know nothing you had sent would have been of much help to someone stealing your identity to open a fake account. But perhaps someone could put me right?

Consumers are protected against losses in various ways. If your bank goes bust you are generously protected by the Financial Services Compensation Scheme, at least up to £85k. That compensation would come from the banking industry. I suppose I could ask why my bank should contribute, but if it was my bank that failed I would be very grateful.

I do believe that consumers deserve to be protected against banks providing accounts and card services to fraudsters. Achieving a fair balance for customers should involve looking at the specific circumstances and determining who is at fault and if necessary how the blame should be shared. Rather than the present voluntary code for compensation that most banks are signed up to I would prefer to see legislation that makes the process transparent.

In the same way that we both believe that online marketplaces must be made, via legislation, culpable for dangerous and counterfeit products sold by their traders, perhaps the same should apply elsewhere, Malcolm. We have discussed making social media platforms responsible for the actions of their advertisers, not only to vet what they offer for sale but to reimburse customers who have been victims of clever scams. There is little that a defrauded customer can do to recover their money from a fraudster that has been provided with and account and card services by a bank that has not made use of due diligence, so maybe the banking sector needs to protect consumers money in the same way that the FSCS does. Please don’t think that I am in favour of compensating everyone who loses money due to their own stupidity because I am not.

There has been a discussion about the responsibility of social media towards their subscribers, and the concept of freedom of expression. I use social media very little, just a look at what friends post on Facebook, the Which? and Which? Gardening groups. I think one salient point that social media can be heavily criticised for is when it targets particular posts at people in response to their perceived preferences.

In the case of banks repaying customers who have been scammed, the missing step is to properly examine the level of responsibility – or irresponsibility – each party has displayed. At present the odds are heavily weighted in favour of the customer, it seems to me, who is deemed to be blameless unless they have shown a huge lack of responsible behaviour. That is probably the easy option, avoids work in examining the circumstances, so just as PPI seemed not to bother looking too hard at claims, just use our customers’ money and pay up. That doesn’t encourage responsible behaviour by customers and could well lead to fraudulent behaviour, all to the detriment of the vast majority of us.

Watch out for a new vaccine scam that was reported by a Which? member today.

An automated call or ‘robocall’ stated that she had been identified for accelerated eligibility of the COVID-19 vaccine. She phoned the number provided and was put through to someone claiming to work for the NHS on behalf of Astra Zeneca.

After confirming some basic details, he then said there would be a nominal charge of £50 the vaccine and the interval between shots would be 12 days.

When she explained that she works for the NHS and knows that 1) the vaccine is only available on the NHS 2) is free and 3) the interval is longer than 12 days, he swiftly ended the call.

Please tell friends and family to treat similar messages and calls with suspicion. We have some advice here: https://www.which.co.uk/news/2020/11/nhs-covid-19-contact-tracing-message-how-can-i-tell-if-its-real-or-a-scam/

The Which? health expert has also written a useful news story about the COVID-19 vaccine – it confirms that the NHS will contact you when it is your turn and this is most likely to come in the form of a letter, either from your GP or the NHS. At present, appointments are only being offered to the public over 80 years old.


Rahana says:
8 January 2021

Was forwarded this on WhatsApp. Was wondering how can a dr give the vaccine privately?? I thought our GP will contact us.

*Covid vaccine for over 70s*

Salam. If you are over 70 and want to have the Covid vaccine, please send a private message with your email address and a contact number to 07405 098203.

You will receive your vaccine this weekend inshaAllah. This is being organised by Dr Muhammad Akunjee.

Words fail me why people do this.
I had to check that my mum hadn’t been scammed as she has an appointment today.

Given the technology why don’t ISP and telephone companies simply block these messages.

Are Which lobbying the government about this?

Has any one else had the emails telling you that there is a BACS payment on the way and if it’s not arrived to contact them or similar Obviously I have not opened it at all but wonder how much this is going on

Mari says:
12 January 2021

I frequently get emails like that but always delete them. However the emails seem to be linked to reputable organisations: The Priory Group and a school group from Kent. I have checked the companies via Companies House and they seem legit so someone must be using their good name.

A.BROWN says:
9 January 2021

All advice given by WHICH and Contributors is helpful, but we still wish to know the following:

Barry Stone says:
9 January 2021

A variation on this theme has been going for a while in which you receive a phone call informing you, you’re eligible for a C-19 jab, so far, so straight forward, the caller sounds (obviously) like a genuine call centre handler “hello ……… I’m calling on behalf of (either your local GP, Hospital or the NHS) to confirm that you are eligible to receive the Covid 19 Vaccination, can you please confirm your Name & Date of Birth,” – some people have complied – “There is a charge for this service, so in order to process the payment, can we please have your bank card details”.

That may not obviously be the verbatim conversation, as that may sound a bit too obvious, but the gist of it is they tell you you’re eligible for a jab, and then try to ask for payment, so naturally MOST people will immediately realise it’s a scam as the NHS is a free service and wouldn’t ask for payment, but not everyone will be aware of that, some may think that because this is a new pandemic that it’s some kind of “Specialist service and therefore legitimate. Please Beware

Chrissy says:
9 January 2021

Just had a text supposed to be from Paypal saying
we have limited your account due to safety concerns. Visit paypal-resolutions28.com before we are forces to close your account.
Luckily I put on laptop and there was a warning of scam

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

The day before yesterday my wife received 3 emails from NHS. The second 2 were urgent reminders about the first. The gist of the messages was that she had been in contact with someone with Covid and had to isolate for a further 7 days. She was given a code number and asked to follow a link. She had to create a password. Once logged in she was asked to provide her NHS number and her address (and nothing more). The phone number given was genuine (I googled it first) but all we got was a recorded message.
On balance we think this is genuine but are at a loss to know how ‘they’ knew it was her and how they got the email address. We think the ‘contact’ must have been at a garden centre – it’s the only place visited in the last 10 days. Her card payment may have provided her name but can ‘they’ use this to find an email address?
The following day we received a further email asking my wife to log in. It then asked about symptoms – she has none – and thanked her for participating. It gave further advice about possible symptoms and what to do if they developed. It all seems OK but we are still at a loss to know how ‘they’ knew it was her and how ‘they’ obtained her email address.

It beats me how anyone can think that, in the middle of an epidemic in the UK, staff of the NHS have the time to contact people by e-mail, text or telephone to offer a vaccination when it has been made abundantly clear that there is a priority order, and that an official letter will be sent from the NHS or GP calling people in for the jab at the appropriate time. It has also been emphasised that the vaccination is free of charge and only available by appointment through the patient’s GP or care arrangements.

Once a vial of Pfizer vaccine is reconstituted it must be used promptly or discarded, so some people have been contacted at short notice. A friend’s wife was one of them.

That’s interesting. I presume the notification is still in official terms making clear that there is no charge. I would have thought there would be a ‘substitutes bench’ lined up to cover for no-shows – other vulnerable people or NHS staff or essential public service workers who can be pre-identified and given a validation code so they know a call-up is genuine.

Since posting above I have another example where no letter was involved. A friend is staying with her mum who is 100 years old. When calling the GP surgery about some blood test results the vaccine was offered over the phone and was given about a week later. There was no letter but mum was given a card showing the date of vaccination and type of vaccine she had been given.

Tim Grundey says:
13 January 2021

There are “substitutes” to cover for no shows, my nephew works in a hospital & he was asked if he wanted the Pfizer vaccine rather than waste it even though he would not be considered in priority list.

It’s good to know this is happening, Tim. A friend in his 70s told me that one of his younger relatives had received a phone call from his GP surgery and offered the vaccine if he could get to the surgery by closing time. He was there within ten minutes and learned that there were two no shows that day.

I also heard of a friend in her 80s who had to cancel her appointment because a coronavirus test proved positive, although she had no symptoms before or after the test. Hopefully she will have another chance of being vaccinated.

Joan Jelinek says:
9 January 2021

Regarding shopping on line versus in person, in normal times I prefer to order heavy, awkward and repeat items on line and do some personal shopping in addition. I’ve found my health improved over lockdown because I was no longer carrying a heavy backpack.

Jean Swinton’ says:
10 January 2021

There are 2 new scams on my phone. Telephone will be cancelled by BT if don’t reply Am not with BT so is nonsense. Dangerous one yesterday that Amazon had had an order for my account for over £1000 and I had to reply. No name was mentioned. I don’t think Amazon would do that would they? Surely I’d be notify by name? Very worried that these scams can’t be corrected by phone companies somehow.

Paul Alexander says:
13 January 2021

Re Covid 19 jab scam text.
Hi, everyone. i got a very convincing text today – again saying i had been identified as priority and to apply. It was very convincing …. until it asked for bank card details ( as verification???!!) and then we spotted numerous spelling mistakes such as ” owenership”.
Its time war was declared on these people who do these malicious things. Does reporting them ever do any good? Do they ever get prosecuted?
We were not fooled but sadly, some people maybe with sight impairments or confusion may look at the site, with a really accurate NHS logo and, in fear or desperation will follow the instructions.

Lets all help stop this now by passing on the information

Wendy says:
15 January 2021

Received this text
NHS: We have identified that your are eligible to apply for your vaccine. For more information and to apply, follow here: nhs-vaccinationupdate.com

Thankfully stopped when they asked for my bank details.

Wendy – When the vaccine is available for you, you will get a letter on NHS headed notepaper with details on how to proceed.

Any text or e-mail messages purporting to offer Covid-19 vaccinations should be ignored and deleted.

The NHS will not charge for the vaccinations.

The shameless way in which criminals will try to exploit any situation, however critical, for their personal advantage is a dreadful commentary on how society has changed in this country. It would be interesting to know how the perpetrators are hiding the money they drain out of people’s accounts. Of course, some of the people behind these scams might not be habitual criminals but have turned to crime and bought into a scam in a desperate attempt to make a bit of money; nevertheless, it is reprehensible and society should totally disown it.

I am not so sure that society has changed, just the methods by which criminals can practice their craft. We gave to try and keep up but the dangers technology can bring seems to defeat many people who gave not grown up with it .

Yes – but isn’t crime becoming more personal against individuals rather than institutional against banks or wages deliveries? Isn’t it a more callous form of crime?

Scamming is a mind game rather than a technological achievement and it seems that it preys heavily on people’s vulnerability, especially the way they have been indoctrinated into trusting social media to bring them good things. So many of these low level scams start with an advert on Facebook [etc] offering something normally expensive for a small price and then supplying something tawdry which is impossible to return. As ever, education is the key to this problem but social media has a lot to answer for in beguiling people into wanting things and copying their friends and influencers. It’s a mental spider’s web.

Individuals have always been conned and cheated. I was simply suggesting that technology has made this possible on a (much) bigger scale. Many people’s inadequate understanding of technology, the speed things work, the convincing way stuff can be published, and falsely using trusted names to reassure people, for example all contribute to the problem. Scamming is a good example.

Just received a text which then asked for my bank details once I had begun to sign up. The website looks extremely professional apart from one or two spelling mistakes

I have received a Text msg from NHS-noreply saying my practice is inviting me to book an appointment for a COVID-19 vaccination. they say it will take place at the local centre which i know is being set up as a vaccination centre. this text has come (supposedly) from the same address that I normally receive text msgs from my local GP. It gives a link to a web site that i have tried to find using a PC with no luck so i think t is a scam. I am trying to report the text msg as a scam but cannot find any contact details on government websites. does anyone know how to report and indeed how to prevent them using my normal means of receiving details from the NHS.