By clicking a retailer link you consent to third-party cookies that track your onward journey. This enables W? to receive an affiliate commission if you make a purchase, which supports our mission to be the UK's consumer champion.
NHS Covid test scam exposed
With recent changes to the Covid testing rules, fraudsters are impersonating the NHS in a series of constantly evolving scam text messages.
Unsurprisingly, scammers are taking the opportunity to capitalise on the Covid testing changes, sending text messages asking you to order a test and pay a delivery fee.
The NHS has raised the alarm again after another spate of these dodgy messages doing the rounds.
⚠️ We've seen reports of fake NHS text messages about ordering Omicron COVID-19 test kits.
— NHS (@NHSuk) June 21, 2022
We never ask for bank details, so please be aware of suspicious messages.
Find out more about scam emails, texts and phone calls ⬇️https://t.co/DV13iNJ6GK
Here we show you what these Covid-test text message scams look like and how the scam works. We also explain how to report it and where you can buy genuine Covid tests.
Sign up for free Which? Scam Alerts for the latest scams news and advice.
NHS Covid-test text scam
While we found many examples of this scam with slightly different wording and web addresses, the premise remains the same:
- It says you need to order a Covid test
- It includes a dodgy link to a fake NHS website
- You're asked to pay a delivery fee of around £1-£2
The copycat NHS website looks seemingly legit, but we know that scammers can be skilled at copying the branding, style and format of genuine websites. However, the big giveaway is the web address itself, which isn't the real NHS website.
As the video shows, the fraudsters use the scam to steal my personal details and to try and take money from my bank account a few days later. We set up fake details to giveaway for the purpose of this investigation.
Each of the attempted fraudulent transactions were for amounts of no more than just £1. This isn't unusual - scammers often start small to go unnoticed, then attempt higher sums further down the line. This is also the pattern we found when Royal Mail scammers tried to steal £4,000 from my account and when an energy phishing email led to a phone call with a scammer who tried to con me out of £1,000.
How to report a scam
- Email - forward phishing emails to report@phishing.gov.uk.
- Text - report scam texts to 7726 for free using the service provided by telecoms providers.
- Websites - if you've found a fake website, report it to the National Cyber Security Centre.
- Phone call - if you receive a suspicious phone call, hang up and report the number to Action Fraud or the police if you live in Scotland.
If you think you've shared your details with a scammer - contact your bank immediately. You can also report the scam to Action Fraud or the police if you live in Scotland.
Read our guide for further information on how to report a scam.
Help our scams research, policy and campaigns work by sharing your experience of a scam with us.
Avoiding text scams
The NHS told us they do sometimes include links in their vaccine text messages, these are only to the NHS website for booking and more information - the real NHS website is www.nhs.uk.
The NHS won't ask you to buy a test or hand over any financial details.
Text messages from the NHS should also come from a sender name, not a mobile phone number.
Which? is urging companies to improve text message communications to protect their customers and reduce the risk of impersonation scams.
Our guide for best practice text message communication includes calls on businesses to:
- Never include a phone number to call back
- Never use generic shortened URLs for hyperlinks
- Be consistent in how and why they use SMS communications to contact consumers
- Protect SMS sender ID, which is the sender name displayed on the text
Businesses at risk of spoofing by scammers should protect their inbound customer service numbers through the UK regulator Ofcom's Do Not Originate scheme. They should also protect themselves against SMS spoofing via the UK's Mobile Ecosystem Forum SMS SenderID Protection Registry.
This article was originally published on 6 April 2022. It was updated on 22 June to include information about the latest Covid-test text scam warnings.
