/ Scams

Scam alert: fake NHS COVID-19 vaccine text

A dangerous fake NHS text has been circulating, telling people they’re eligible to apply for the COVID-19 vaccine. Here’s what it looks like.

A member got in touch with us today when they received a text message purporting to be from the NHS.

It confusingly stated that “we have identified that your are eligible to apply for your vaccine” and advised him to follow a link to get more information and ‘apply’:

This URL takes you through to an extremely convincing fake NHS website that asks for your personal details, but the member became suspicious when it asked for his bank/card details in order to ‘check his identity’.

It was then that he began spotting spelling mistakes on the site and in the SMS itself, which we’ve warned many times before are classic signs of a phishing scam.

We found that the fake site was also registered just two days ago – another reason to be suspicious, and one that demonstrates the importance of reporting these scams as soon as you receive them.

As of 26 January, variants of this scam are now also being reported:

Remain vigilant of coronavirus scams

We know that criminals will use the confusion and urgency around the pandemic as a way to target potential victims – we’ve covered five similar attempts here on Which? Conversation already:

Council tax reduction phishing email

Fake NHS contact tracing text

HMRC Government grant phishing email

Microsoft ‘covid relief fund’ phishing email

COVID-19 vitamin pill cold calls

With the recent approval of multiple vaccines in the UK, these types of scam attempts are likely to continue as fraudsters look to take advantage of the rollout to so many people.

Our advice

If you think you may have handed over your card details to scammers, let your bank know what’s happened immediately.

You can then attempt to recover any money lost by following our guide here.

Have you received this fake NHS vaccine text or any other type of scam relating to the vaccine?

Let us know in the comments if you have, and please do share this warning with friends and family so we can prevent anyone from falling victim.


Update 7/1/2021: Cold calls

Cold calls regarding the vaccine are also beginning to take place – we’ve already had reports of scammers asking people to pay for it over the phone:

If you receive one of these calls, hang up.

The NHS will contact you when it is your turn to receive the vaccine, likely by letter from your GP or from the NHS itself. However, if you’re aged 70 or over or you’ve previously received a letter saying you’re high-risk, you no longer need to wait to be contacted and can book your appointment online.

Read more about the COVID-19 vaccine rollout, and what it means for you

Comments
Lisa Jayne Corkhill says:
19 January 2021

We both received text messages today which looked dodgy about Covid vaccines from a telephone number 07800 007 150.

Dear patient
We understand that people are keen to know when they will receive their Covid vaccine. Each of us will receive an invite when it is our turn.
You may receive a letter inviting you to arrange an appointment at a mass vaccination centre. Please do not contact us about this. We have put some advice on our website for you. Please click here – https://bit.ly/3p73iBK. Many thanks

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

Hi, if you hover over the NHS address you will see that the email comes from a dot jp site (Japan). When you get an email you are not expecting just hover over the senders address and it will show the true address. Hope that helps.

Alison Hudson says:
25 January 2021

I have just had an email from noreply@nhs.gov.uk with the subject: ‘Book an appointment using the NHS e-Referral Service – NHSVaccination’

The body of the message says:
NHS Test and Trace
This is a public health message from NHS

As part of the government’s coordinated response to Coronavirus, NHS is performing selections for coronavirus vaccination on the basis of family genetics and medical history.

You have been selected to receive a coronavirus vaccination

Use this service to confirm/reject your coronavirus (COVID-19) Vaccination:
>> NHS – Accept invitation
>> NHS – Decline invitation

It then goes on to say:
You can only use this service if I have received an email/SMS regarding this invitation. You can not use this service for anyone other than yourself.
You are also free to reject this invitation, your appointment will be issued to the next person in line in that case.

If I forward the email, the From address then says:
From: “noreply@nhs.gov.uk on behalf of NHS digital ”

No idea if this is a scam or not, but I’m not pressing either response just in case.
Have sent it on to Action Fraud as well.

Alison says:
26 January 2021

I also received this same e-mail today. At first I started to fill it out but when I got to it asking for bank/card details, I realised it was a scam so deleted all information i had typed and reported it.

I got this same email today and it directed me to echosofttech.com. Fortunately it did warn me saying ‘deceptive site ahead’. So, this is a scam people please ignore this email.

Janine Payne says:
26 January 2021

I got the same today

Mo Butt says:
29 January 2021

This is definitely a scam, just had the same middle of night. was cautious but half asleep when I opened it on phone, curious to know if it was real but as I’ve been waiting 10 months shielding! Opened link with trepidation, NHS site link looked real for a few seconds but definitely fake, none of the buttons at the bottom I.e contact us, about us, our polices etc etc none of them work, next page asked for card details! I forwarded it to
NATIONAL CYBER SECURITY CENTRE
Suspicious Email Reporting Service (SERS) at report@phishing.gov.uk.

…then went back to sleep

I just recieved the same email. But my phone security warned me after I cautiously clicked accept. Looking again googled scam. It had many errors. The most obvious one. Appointment 8.30 am yesterdays date. Im going to spread the word and share on social media.

Corinne says:
2 February 2021

I have just received the same email aswell it actually looks real

Davina Browning says:
2 February 2021

I have had the same email as you. I had it today. The funny thing is that I have already had my 1st vaccine so they messed up there lol

Rebecca Wright says:
25 January 2021

Hi I received an email just now saying that I had been ‘selected to receive a vaccination on the grounds of genetic and family history’. It’s to an Emile address I don’t use for anything other than competition entries and such like. My GP and anything financial is separate account. Bright yellow email has test and trace at top and says nhs.gov.uk. I think it’s usually just .nhs.uk right? Has buttons to click to accept or reject offer which it says to do within 12 hours! Scam – deleted. Watch out!

I’ve just had that today too. Thought it was probably a scam but did click on the accept button to see what happened next. It was blocked by McAfee so definitely a scam. Deleted now.

Melissa Jane Roberts says:
25 January 2021

Me, too. Put a question regarding it out on our group app to see what others thought. Difficult to find out on the net..until I eventually, found this site. I didn`t go for the accept or decline but will now report it as phishing and tell my friends.

A Good Samaritan says:
28 January 2021

If you think something is a scam, please do not click just to find out what happens! 🙂

I had the same email today.
I’ve reported it.

received email from noreply@nhs.gov.uk to accept or decline invitation for covid vaccination.
upon checking message source it has come from japan! it is quite convincing and you have to look really close for the ‘tell-tale’ signs.

Juliette Cozens says:
25 January 2021

I received the following by email today, my husband realised it was a scam when he checked on the sender address (xxxxxxx)

IMPORTANT – Public Health Message| Decide whether if you want to be vaccinated – Message on 12-January-21 14:57:11 BST – Your NHS.CO.UK order #203-9320557-23482748 has been dispatched
Coronavirus (COVID-19) vaccination – NHS
Dear …
The NHS is performing selections for coronavirus vaccination on the basis of family genetics and medical history.

You have been selected to receive a coronavirus vaccination.

[Moderator: we’ve edited this comment to remove a personal email address. Please do not post personal contact details or other personally identifiable information – this is for everyone’s privacy. For more information see the Community guidelines]

s taylor says:
25 January 2021

just received a scam vaccine email from supposedly the NHS, looked authentic but no name on it and url was in japan!! Asked me to click a link for YES and another for NO; i did neither.
[edited]

[Moderator: we’ve edited this comment to remove personally identifiable information, as this is not allowed in the Community guidelines. Please don’t post people’s names, addresses, or other personally identifiable information – even if you suspect it is made up. This is to protect everyone’s privacy.]

Catherine M says:
26 January 2021

I have had two messages purporting to be from the NHS from two different mobile numbers 07951 349839 and 07553 477575 yesterday evening. They both had the same message. “NHS: We have identified that you are eligible to apply for the COVID-19 vaccine. For more information and to apply, follower here: https://c19-application.com” Today I also had one from my bank supposedly to set up a direct debit which I didn’t authorise.

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

Gordon H says:
28 January 2021

Just received a scam email. On digging deeper it appears to emanate from: xxxxxxxxx
Police Scotland informed.

[Moderator: we’ve edited this comment to remove personally identifiable information, as this is not allowed in the Community guidelines. Please don’t post people’s names, addresses, or other personally identifiable information – even if you suspect it is made up. This is to protect everyone’s privacy.]

L. Miller says:
28 January 2021

Just received this email from: NHS Notifications > NHS – Accept invitation
• >> NHS – Decline invitation

It then goes on to say:
You can only use this service if you have received an email or SMS regarding this invitation. You can not use this service for anyone other than yourself.

You are also free to reject this invitation, your appointment will be issued to the next person in line in that case.

I have just received this email:

“From: NHS Notifications
Sent: 28 January 2021 13:03

Subject: Book an appointment using the NHS e-Referral Service � NHSVaccination No.8232′ 23987 2021-01-28

As part of the government’s coordinated response to Coronavirus, NHS is performing selections for coronavirus vaccination on the basis of family genetics and medical history.
You have been selected to receive a Coronavirus Vaccination
• Use this service to confirm/reject your coronavirus (COVID-19) Vaccination:
• >> NHS – Accept invitation
• >> NHS – Decline invitation

It then goes on to say:
You can only use this service if you have received an email or SMS regarding this invitation. You can not use this service for anyone other than yourself.

You are also free to reject this invitation, your appointment will be issued to the next person in line in that case.”

I don’t think the NHS would email from Hotmail, see above redbeard48

S Lewis says:
28 January 2021

Today, the 28th January, I’ve received a similar email to another poster…

The body of the message says:
NHS Test and Trace
This is a public health message from NHS

As part of the government’s coordinated response to Coronavirus, NHS is performing selections for coronavirus vaccination on the basis of family genetics and medical history.

You have been selected to receive a coronavirus vaccination

Use this service to confirm/reject your coronavirus (COVID-19) Vaccination:
>> NHS – Accept invitation
>> NHS – Decline invitation

It then goes on to say:
You can only use this service if I have received an email/SMS regarding this invitation. You can not use this service for anyone other than yourself.
You are also free to reject this invitation, your appointment will be issued to the next person in line in that case.

….. reading this email on my phone it is not possible to see who exactly the email is from, which is the danger, but on my laptop I can see it is from xxxxxxxx, bit of a giveaway. I’ve reported the scam to Action Fraud

[Moderator: we’ve edited this comment to remove personally identifiable information, as this is not allowed in the Community guidelines. Please don’t post people’s names, addresses, or other personally identifiable information – even if you suspect it is made up. This is to protect everyone’s privacy.]

David Hildrow says:
28 January 2021

Received this today from ‘NHS NOTIFICATION’ actual email was xxxxxxxx

The link takes you to a page where you have to pay for a selected date/vaccine

‘’As part of the government’s coordinated response to Coronavirus, NHS is performing selections for coronavirus vaccination on the basis of family genetics and medical history.

You have been selected to receive a Coronavirus Vaccination

Use this service to confirm/reject your coronavirus (COVID-19) Vaccination:
>> NHS – Accept invitation
>> NHS – Decline invitation
It then goes on to say:

You can only use this service if you have received an email or SMS regarding this invitation. You can not use this service for anyone other than yourself.

You are also free to reject this invitation, your appointment will be issued to the next person in line in that case.’

[Moderator: we’ve edited this comment to remove personally identifiable information, as this is not allowed in the Community guidelines. Please don’t post people’s names, addresses, or other personally identifiable information – even if you suspect it is made up. This is to protect everyone’s privacy.]

I received the exact same email as Alison Hudson above. Email subject: NHS Notifications.
It was on my phone so I was about to tap the ‘accept’ button because it looks so genuine, but was distracted by a call. Went to find the email today but it had gone into my junk mail. Hovered over it and it’s someone’s hotmail address. If not for that, I never would have suspected it was fake and would have clicked through- I am youngish/usually vigilant about scam emails, feel very worried about the more vulnerable that these emails will be targeting.

Family member received a genuine text message to book Covid-19 vaccination today, with link to a pre-populated website.

Branded NHS, it correctly identified our GP surgery and the patient’s name. The only information requested was Date of Birth, as is normal before administering any medication to confirm patient’s identity.

Was then given a date 7 days in advance and a choice of 10 minute time slots to attend the expected vaccination centre.

No form to fill in, no requirement to provide name, address, telephone number, NI number, bank details (how would the NHS be able to use that for verification???), inside leg measurement, dog’s name … .

Confirm selected date and time. Done! Further text confirming appointment received immediately.

A number of friends have been contacted by text message and invited to book online. Knowing the potential for fraud, I wonder if it would be best to send a simple text without a link inviting patients to book online via whichever service their surgery uses (I used SystmOnline and now use Patient Access). Obviously this would not help where patients are not registered to use these services.

I think that is the problem, especially with the current cohort of over 70s and above.

We also need to consider accessibility. Whilst it may be within someone’s power to click on a link, expecting them be able to accurately read and transpose information into a web browser is fraught with risk from similarly-spelt fake URLs.

A family member received an NHS letter yesterday telling them to now book a COVID vaccination appointment via a website given or via 119. Delayed doing it until today when their health centre sent a text message with a different link that asked them to book at their local centre – some 3 miles away. All very quick, efficient.
But will the EC have taken their dose away?

Catherine Davies says:
1 February 2021

Had the exact same email, when it came to payment I soon realised it’s another scam, this makes me so angry
Here’s what my email looked like:
Had an verification number at the top with date followed by this text:

NHS

NHS is performing selections for coronavirus vaccination on the basis of family genetics and medical history.

You have been selected to receive a coronavirus vaccination

Use this service to confirm/reject your (COVID-19) Vaccination:

>> NHS – Accept invitation

>> NHS – Decline invitation

You can only use this service if you have received an email or SMS regarding this invitation. You can not use this service for anyone other than yourself.

You are also free to reject this invitation, your appointment will be issued to the next person in line in that case.

My email address is being used by the scammers to send those similar “NHS” emails. I see the ones that have bounced and a few rude replies. They use other peoples email address to send the bulk scamming messages.

Indeed they do.

And that is why it is wrong for people to be posting details above, giving the “sender’s” email address, which is quite possibly real. Then other scammers come along, harvest these email addresses from Which? webpages and send out yet more garbage.

Agreed, Em. The moderators should not be approving those links that show personal e-mail addresses.
I have asked them to act and remove e-mail addresses that have been used without permission for fraudulent purposes.

It seems that criminals are selling counterfeit NHS ‘negative test result’ certificates stating that the bearer is fit to fly. This is worrying if travellers with such a document are not intercepted because it could mean that the person who bought one is in fact infected with Covid-19 and could transmit the virus. See BBC News item – https://www.bbc.co.uk/news/av/uk-55890168

I do not know what official document the NHS issues to people who have tested negative but the specimen of the fake one shown in the BBC’s video looked convincing and might fool the clerk at the check-in desk at a foreign airport – or even in the UK if they don’t know what an authentic NHS document looks like.

But why bother with a fake certificate, if you can buy the real thing with a home-use test kit?

Just make sure you swab the dog, or granny who has had the vaccine already. Good to go!

The only solutions I can see is to test people when they arrive at the airport and not let them board until their test proves negative or to ban air travel. Are there any alternatives?

On close inspection of the examples of the fake texts, at the top left corner the website that they have been sent from is not secure, because there is the ‘warning,’ symbol, which is the triangle and exclamation mark inside of the triangle next to the URL. Whereas secure websites have the padlock symbol next to the URL.

As stated above when the time comes for people to be vaccinated they will receive a formal letter from their GP or the NHS, which is usually the case anyway, as they know most people are likely to feel assured a formal letter is ‘legit,’ as opposed to a text.
Furthermore, people know which month they are likely to be informed of their vaccination, even before receiving a letter, just by reading the news, regardless of whether they can afford to pay for it or not. I’m under 50 years old, and people in my age group or younger are at the bottom of the list, and won’t be vaccinated until later in the year, likely to be in the summer, so, if I was to receive a text before then, I would know it was a scam.

It makes me angry that we already have enough to contend with, as this pandemic is still going on, yet these scammers are exploiting and adding to these worries. They need stopping.

Thanks for that. I have only seen one scam text and it does not show this warning, but hopefully this might help others.

Text messages do not show or use these warnings, only websites accessed over a web browser, like Chrome, Internet Explorer, Edge, etc. However it is important to understand the difference between a secure website, as indicated by a padlock in the URL bar, and a safe website.

In the context of a web page, the padlock indicates that the web browser has connected to a web server using HTTPS protocols and the transaction is secured in two ways:

1) The data flowing between the you website is being encrypted, such that it cannot be intercepted and read by a third party. This provides some protection against information like a password or personal details being captured.

2) The encryption is managed using a digital certificate known as an SSL Certificate. An SSL Certificate can be issued by about 100 organisations throughout the world and is based on a chain of trust. Rather like an “old boy’s” network. If you trust “A”, and “A” trusts “B”, then you can trust “C”, if “B” has issued them with a digital certificate confirming who they purport to be.

Clearly, this chain of trust is vulnerable, but it works as a technical solution to overcome many simple hacking techniques. However, it does not ensure that the website you have connected to is safe or trustworthy.

Treat it as you would any other certificate. It might provide a degree of confidence or reassurance, but you still need to be on your guard.

Thanks Em.

A practical example of what I mean is the padlock in the top of this webpage.

Can I be certain that this is website conversation.which.co.uk that I am posting to? Well Amazon says so.

Do I trust Amazon? Draw your own conclusions on that!

Does it really matter in this context? Probably not.

Can I be sure that my bank details won’t be intercepted by a third party if I post them here? Probably.

Is it safe to post by bank details here? No way!

Sally says:
4 February 2021

I had the fake nhs email today asking if I wanted vaccination ,realised it was a scam because it looked fake and when I pressed yes they said there was a charge. Checked where it had come from and definitely not from NHS.