/ Scams

Scam alert: fake NHS COVID-19 vaccine text

A dangerous fake NHS text has been circulating, telling people they’re eligible to apply for the COVID-19 vaccine. Here’s what it looks like.

A member got in touch with us today when they received a text message purporting to be from the NHS.

It confusingly stated that “we have identified that your are eligible to apply for your vaccine” and advised him to follow a link to get more information and ‘apply’:

This URL takes you through to an extremely convincing fake NHS website that asks for your personal details, but the member became suspicious when it asked for his bank/card details in order to ‘check his identity’.

It was then that he began spotting spelling mistakes on the site and in the SMS itself, which we’ve warned many times before are classic signs of a phishing scam.

We found that the fake site was also registered just two days ago – another reason to be suspicious, and one that demonstrates the importance of reporting these scams as soon as you receive them.

As of 26 January, variants of this scam are now also being reported:

Remain vigilant of coronavirus scams

We know that criminals will use the confusion and urgency around the pandemic as a way to target potential victims – we’ve covered five similar attempts here on Which? Conversation already:

Council tax reduction phishing email

Fake NHS contact tracing text

HMRC Government grant phishing email

Microsoft ‘covid relief fund’ phishing email

COVID-19 vitamin pill cold calls

With the recent approval of multiple vaccines in the UK, these types of scam attempts are likely to continue as fraudsters look to take advantage of the rollout to so many people.

Our advice

If you think you may have handed over your card details to scammers, let your bank know what’s happened immediately.

You can then attempt to recover any money lost by following our guide here.

Have you received this fake NHS vaccine text or any other type of scam relating to the vaccine?

Let us know in the comments if you have, and please do share this warning with friends and family so we can prevent anyone from falling victim.


Update 7/1/2021: Cold calls

Cold calls regarding the vaccine are also beginning to take place – we’ve already had reports of scammers asking people to pay for it over the phone:

If you receive one of these calls, hang up.

The NHS will contact you when it is your turn to receive the vaccine, likely by letter from your GP or from the NHS itself. However, if you’re aged 70 or over or you’ve previously received a letter saying you’re high-risk, you no longer need to wait to be contacted and can book your appointment online.

Read more about the COVID-19 vaccine rollout, and what it means for you

Comments

Caller ID +447903594371
Bogus text to my mobile from a scammer 1st Feb 2021.
“You are eligible for a COVID vaccination. If you have not yet had a vaccination and do not have an appointment booked, book here: https:@@bit.ly@3pPPPIt or visit https:@@www.nhs.uk and search ‘coronavirus vaccination'”
[I’ve garbled the links. I wouldn’t touch them with a bargepole]

Do what you like, but those links are genuine enough, assuming I have “cracked” your substitution cypher, so don’t put other people off.

https://bit.ly/3pPPPit (i not l) takes you straight to the NHS coronavirus booking page

https://www.nhs.uk is the NHS home page web page. Searching for “coronavirus vaccination” then takes you to the same page as the

But don’t all rush at once. This is a sweep up call for over 70’s.

[Moderator: the bit.ly link in this comment indeed appears to be a valid link, pointing to: https://www.nhs.uk/conditions/coronavirus-covid-19/coronavirus-vaccination/book-coronavirus-vaccination/. Where possible, please avoid using bit.ly or other link shorteners on Which? Conversation, as this ensures people are more aware of what website they are being directed to]

If you need further assurance, you can read this BBC News article here:

https://www.bbc.co.uk/news/health-55980053

If you click on “A national booking system can be accessed online …” you also end up in the same place on the NHS website.

scott stevens says:
5 February 2021

I have just this minute had an email similar to the above. Looks like “office@nhs.gov.uk” – but then, when I looked at the email on my laptop (and not my phone) saw that it actually had the suffix ‘kahz21@hotmail.com’ – but the email was convincing, and I’ve been online since 1997.

Karen says:
10 February 2021

I too have had that email today. It was in my junk folder and was identified as “posing” so I was lucky stay vigilant people

Just received an email apparently from the NHS re the vaccine. I initially noticed the sender was form an Hotmail account. Then if you proceed they expect a payment of £3 -£5 to book both slots. Gutted as I spent 10 weeks in hospital and 10 days in a coma due to CoVid. Sick vile individuals. Please all take care and dont be duped.

it is my husband’s 60th birthday today and he received an email stating he has been identified as being eligible for a coronavirus vaccine. He stopped short of putting in his bank details. We will not let this ruin his special birthday, but some people have no moral compass. It will bite them back one day. Stay vigilant!

Heres a new one:-
Congratulations! You have been selected as a vaccine research subject! Please complete this short 30-second survey about COVID VACCINES in exchange for one of our consumer offer rewards! (offer promo value up to $90).

Those who complete the survey will get:
• – Choice of up to 10 offer rewards
• – Value up to $90
• – Reduced shipping prices
Get Started Now!
Came through as an email asking to click on the link. This is a scam.

@George-Martin Could you now please update the lead article with the following information to counter all the “FUD” (Fear Uncertainty Doubt) this convo is generating:

People aged 70 or older in England who have not yet had their coronavirus vaccine but would like to are being asked to contact the NHS.

A national booking system can be accessed online or people can call 119 free of change between 7am and 11pm.

I have also posted the links to the NHS national booking system above – still awaiting moderation and the time of posting this comment.

Thanks

Hey George, I did reply on 9 Feb, but that seems to have got lost.

I certainly agree that people need to be made aware of scams going around, but we now have three comments where genuine URLs sent out by NHS GPs and agencies working for them have been flagged up as scams. In the first case, the Which? Moderator confirmed it was a link to a scam website (it’s not). In the above case I had to call it out, and now in a further case below, it’s left unclear – I’ve reported that latest one for reasons I’m not going to set out here.

It hardly surprising that extortionists use the obsession the authorities have with Identity Purity as a reason to ask for credit card details.

There is another scam e mail pretending to be from the NHS and saying that you have been selected for a vaccination on the basis of family genetics and medical history. I was taken in for a minute or so, but realised that my medical history and family genetics would not be known so widely. The e mail had a “Confirm Now” button, but I didn’t click on it so am not sure whether bank details were asked for.
Watch out for this one!
(I did forward it to Which on 29th Jan)
Pam

My partner who is 56m with no underlying health issues, received an email inviting her to make an appointment for a vaccine. Our suspicions were aroused as I am 10 years older than her and have yet to get an invite. It was also strange that they wanted her National Insurance number. Plus all the links at the bottom of the supposed convincing web site did not work.The senders address was webmaster@nhs.co.uk.
We contacted the NHS vaccination appointment service and they said they would never ask for your NI number, so this was a scam.
Has anybody else had a similar email requesting your NI number?

Midland lady says:
9 February 2021

I too received this bogus email offering a covid jab and was given a choice of two dates. On completing the first two pages, name, d.o.b etc. On the third page it was asking for £5 to secure my chosen date , requesting card details. Immediately I realised it was a scam and notified my doctors surgery. I hoped they would be able to inform the right authorities. What low life would do this, I am disgusted.

Peter Adams says:
9 February 2021

This wasn’t a covid scam but this morning I had a phone call supposedly from paypal customer services. They told me that there was suspicious activity on my account. I knew this was a scam because I have not given Paypal my landline number. When I told them that they would get nothing from me for their scam the person on the other end got really abusive and called me a Mother F***** when I said to her there is no need for abuse the line went dead. Only give out a mobile number to these people and listen carefully to what they say. There is uaually a lot of background noise to make it difficult to hear properly so you hear what you thought they said and not what they said.

B Wadsworth-Davies says:
9 February 2021

Slight variation in another convincing Covid scam I received by text recently.
“GOV-UK: Records show you are eligible for a Covid- 19 grant. To proceed fill in the form here:
https://cvd-19-ukgrant.com
WARNING – PLEASE DON’T!! They just want your secure details.
I didn’t open it but It’s a scam – note the hyphen used in GOV-UK – so easy to miss but genuine site would use GOV.UK

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

Mrs R.G. Kew says:
10 February 2021

Georgie K. says,
I received the ‘NHS VACCINATION ‘ email this morning, as I had my first jab several weeks ago, it was obviously false and so a scam. I simply read it through and deleted it.

David Shannon says:
10 February 2021

I suggest that legitimate companies look carefully at how they communicate with customers.

My invite for the jab directed me to a server called book.nhs.me

book.nhs.me is not a UK url, it was set up recently and is administered by a non-UK company registered to another non-UK company. It bears all the characteristics of a scammer.

It was not the nhs.

I took a chance, and it turned out to be legitimate. The company involved was acting as an agent for my GP. It did not ask for money. I have had the jab now.

My wife’s subsequent invite was to a server at nhs.uk – it would seem they learned to make the change given that others like me were suspicious of a non-uk domain.

My advice – do not click on a link sent to you by anyone, and very specifically, do not enter bank details anywhere a scammer can get at them.

Susan L says:
10 February 2021

Just had a text message from ‘GPSurgery’ – ‘Dear Mrs L (and it gave my correct surname) you have been invited to book your COVID-19 vaccination. Please click the link to book your vaccination times:
accurx.thirdparty.nhs.uk/r/8cyjp77zkv
Leighton Buzzard PCN’
I phoned my surgery and had it confirmed that this was a scam text.

Hi Susan, that link does seem awfully like the real messages being sent out. Thank you for sharing this, will be logging this down.

This is not a scam – why would your surgery even suggest such a thing?

The fact that the high level qualifier ends “nhs.uk” says this domain belongs to the NHS. Nobody could easily fake that.

Accurx are a third party working for the NHS to provide appointment booking services. If you go to the relevant NHS webpage (I’m not going to give the link here because end up in moderation!) you will find that Accurx have passed assurance and under contract to the NHS.

They also give the exact URL you are reporting as a scam, minus the ‘8cyjp77zkv’ which is unique to you @Susan_L. I suggest you go to that link, enter your date of birth and choose your appointment time.

I’ve just had my AZ vaccination this afternoon, all arranged via the Accurx appointment service.

And who is upvoting these false reports of scams. Anti-vaxers? If you don’t know what you are doing, then please stop encouraging the spread of misleading information.

I think the genuine message would have been more convincing if it had read “you are invited . . . ” rather than “you have been invited . . .”. Poor sentence construction is one of the tell-tale signs of a scam.

Patrick Taylor says:
11 February 2021

COVID-19 vaccination booking
Learn more about COVID-19 vaccines

You will be able to book in for your appointments at the following locations:

The Rugby Club, Stanbridge Road, Leighton Buzzard, LU7 9HR

It would seem worth someone asking the surgery about this matter. Is it true they told their client it was a fake? Are their staff not up to speed on this yet? Or is this a malicious stirring of the pot?

I would have hoped that the moderators could have confirmed it is genuine, a simple search shows the club welcoming the opening of the vaccination centre.

buzzardrugby.co.uk/buzzards-chosen-as-covid-19-vaccination-centre/

I would have hoped that the moderators could have confirmed it is genuine …

How would they know? In response to a comment by @Lisa_Jayne_Corkhill on 19 January 2021, reporting as scam a genuine link sent out on behalf of their GP surgery, Which? confirmed:

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

Patrick Taylor says:
11 February 2021

Em – Well as I could access the NHS site, and the Rugby Club showed as a vaccination site the odds suggest that it was legitimate. A poster could also have proceeded on the basis that provided the NI number, downloading anything, and money etc was not involved it would still probably be legitimate.

However me, by this stage would have queried the surgery again as I cannot conceive why this scam is so detailed as to the vaccination place. XXXX-up accounts for many things.

There is an interesting stories from both the first and second world war when rumour outran truth – I am a great fan of nailing rumour.

Can I suggest that if there were only one central resource that everyone was guided to for checking legitimacy of messages then the confusion might be much less? Logically that could be a Govt site.

Also the specifity of the types of fraud or misinformation should be made clear so that the people know where to look rather than scams in general. These specific guidance centres might exist but are obscured from public knowledge by the surfeit of sites all purporting to to offer a chance to post and have problems solved.

I have been invited to book my Covid-19 vaccination through accurx.thirdparty.nhs.uk. Is this legitimate?

Written by Matthew Honeyman
Updated this week
“The link you have received is a legitimate invitation from your GP. We’re accuRx, a software provider helping GP practices like yours to deliver the Covid-19 vaccination programme across the UK.

The link you have received is sent on behalf of your GP practice and will enable you to book in to appointments available at your Local Vaccination Centre(s). You should feel confident accessing it.

I think this is legit.

@malcolm r

accurx.thirdparty.nhs.uk is legit. I know this as a friend of a friend booked her vaccination thru this.

I am not sure if anyone see this reply. Yes accurx is legit.

Michelle says:
4 March 2021

did you get a booking reference? just booked mine through this and although I got a confirmation text there was no booking reference

All I got was a confirmation text. That was all I needed. When I got to the vaccination centre they just checked that my name was on their list.

Louisa says:
13 March 2021

I’ve just had a very similar text. I almost fell for it as it gave my correct surname and surgery. I’m so glad I saw your post. Thank you!

Are bit.ly web page addresses legitimate?

Bitly is a US technology company who provide a web page address compression service. It works using a computer technique called hashing, to convert a long string of characters into a much shorter string of seven or so “random” characters. However, the characters are not random at all. They will always point back to the original web page.

For instance, if I want you to look at this web page, I could say go to –

https://conversation.which.co.uk/scams/scam-nhs-covid-vaccine-text-message/

Or, I could use the Bitly service to give you a much shorter address to copy down –

https://bit.ly/3tOSZFq

Both addresses bring you back here.

How can I check where those “random” characters will take me, before clicking on the link?

Easy! Just add a ‘+’ (plus sign) to the end of the address, like this –

https://bit.ly/3tOSZFq+

Bitly tells you about this web page, when it created the compressed link, the title of the web page and the original, uncompressed web page address. If anything, it is slightly safer than clicking on a normal link, because you can see the title of the web page before you go there.

For instance, you receive this “suspicious” link, to which you add the ‘+’ to see where it leads –

https://bitly.com/3pPPPit+ (You can click on it; it’s safe!)

Bitly tells you it will take you to the “Book a coronavirus vaccination – NHS” web page provided by –

https://www.nhs.uk

Why are NHS and their agencies using these confusing links?

You will have to ask them that! But the main reason to use Bitly is to ensure that long web page address do not take up too many characters, get truncated or broken up when sending over SMS and other media limited to 160 characters per message. It is also a lot easier to transcribe or communicate the web page address by telephone.

The only thing to be careful of is that, unlike normal web page addresses, bit.ly addresses are case sensitive. You must type or spell it out phonetically exactly as shown:

“three – lower case papa – upper case Papa – Papa – Papa -lower case india – tango.

Are bit.ly web page addresses automatically safe then?

No, you should apply the same degree of common sense as with any other internet link.

Bryan says:
2 April 2021

The info re Bitly was very useful – I had often wondered whether this was part of a scam process!
Thanks

I received my invitation for vaccination from the GP surgery and was given the date, time and location of the local vaccination centre. That was an easy option.

Had I received a text message with a link I would have tried to find official information about what an invitation should contain for comparison purposes and what information I would be asked to supply before proceeding. It is likely that some will not be cautious and just use a possibly fraudulent link. Hopefully they will stop before parting with confidential information or making a payment.

It all seems rather risky and perhaps it would be better for a genuine text simply asking the recipient to arrange an appointment via the gov.uk website, ringing 119 or their GP surgery. No links required.

It would have been even better if we didn’t have a Covid-19 pandemic (anagram of “med-panic”) to contend with.

Frankly, I was sceptical of the government’s target of vaccinating 15 million people by the end of this week. But thanks to the efforts of the NHS, their staff, agencies and volunteers it looks like they are going to make it and are already moving forward with the next cohort of under 70’s a week ahead of schedule.

If everyone who received a phone call, text, email, letter treated it with the degree of scepticism shown in this Convo, there is no way we would be here. It is good that the NHS have provided multiple channels. Those of us who are comfortable with the technology can do our bookings on line to free up resources for those that need extra reassurance. It also suggests that people don’t have adequate virus and malware protection installed on their devices, if they are too afraid to click on a link.

Carol says:
11 February 2021

But the scammers are out there and using any means they can to steal your money. We need to extra vigilant

Carol says:
11 February 2021

Received an email today saying I was in line for a Covid vaccine it asked me to answer a survey which I didn’t and ,I didn’t click on any links.
We need to be so careful. It tells me not to phone my doctor’s surgery.
I will call them to ask if it was sent from them .

@Carol – Good. Surveys are always optional, even if legitimate. Linking it to eligibility for the vaccine is a sure sign it is a fake. In the current situation, I would just ignore it and not waste your GP’s time.

I don’t understand how the comment above has been inserted into this thread – it appears to have by-passed the moderators.

I find it exceedingly offensive and utterly disrespectful of the tens of thousands of people who have been suffering from the Covid-19 disease and the distress and grief this has brought upon their relatives. I see no place in Which? Conversation for this kind of contribution whatever the community guidelines on freedom of speech might suggest. I have accordingly reported the comment for editorial intervention. I spent nearly three weeks in hospital earlier this year [not Covid-related] and the scene was a complete contrast in every respect to the picture painted above.

@johnward, Which comment John?

It’s gone now, Malcolm . . . but it could come back if the editorial team take a relaxed view of needing to cultivate a diversity of viewpoints.

John, I see the offending comment has now been removed. I agree with your views on it, so I did take the step of reporting it as soon as I’d read it.

Rosemary Osnato says:
10 March 2021

I got an email from Nj covid. It looked the same as the email alerts. I Filled out the information which was the same information my friend was filling out on her computer. Same place time date etc. But when I clicked to move ahead I got a page asking for my insurance information, all of it. because my friend and I were on the phone together, I told her what I was filling out. She said that the insurance info was optional. I then said there was no option no box to say no to, and move to the next page, which according to my friend should have been a verification of the appointment. I did this three times. Three appointments no verification? Was this a scam? Also I never received a verification email.