People are being warned to be wary of scammers pretending to be from the NHS as coronavirus contact tracing launches in the UK.
It’s feared fraudsters will pretend to be from NHS contact tracing services to con people into handing over personal details.
Contact tracing works by asking people who have tested positive for the virus to share the details of others who they have been in contact with who could have caught it from them.
This is exactly the kind of information fraudsters want and need in order to trick people out of their money, making the service an ideal target.
The National Cyber Security Centre (NCSC) said the public has sent it 600,000 scam emails since the start of the pandemic, all trying to use confusion and worry around the outbreak to their advantage.
Here, Which? looks at how the official NHS contact tracing service works and how you can tell a real message from a fake one.
How the real contact tracing process works
If you have coronavirus symptoms you can get tested.
If your test is positive you’ll be contacted by the NHS England by text, email or phone. In Scotland, Wales and Northern Ireland, the NHS is only contacting people by phone at the moment.
The NHS England Test and Trace service will only get in touch with you for one of the following two reasons:
1. You’ve tested positive for the virus
If you test positive for the virus, you’ll be contacted within 72 hours of taking the test.
Genuine texts, calls or emails from the NHS service won’t ask you for any personal details upfront.
You’ll be given a unique ID number to log in to the NHS England Test and Trace website. The only official web address for the NHS Test and Trace service is: https://contact-tracing.phe.gov.uk/
Once you’ve logged in using your ID, you’ll be asked to enter some basic information about yourself including:
- Your name, date of birth and current address
- the names of the people you live with
- places you’ve recently visited
- names and contact details of people you were in touch with around 48 hours before you developed symptoms.
If you can’t access the website, you’ll be asked to give these details over the phone.
And if you’re in Scotland, Wales or Northern Ireland, all NHS contact tracing is currently being carried out over the phone.
If you get a call about testing positive for coronavirus, but you haven’t taken a test in the past few days or have never taken a coronavirus test, then the call isn’t real.
A smartphone app that will alert people that they’ve been in contact with other app users with coronavirus is still being trialled on the Isle of Wight.
It’s not currently available for the general population, so avoid downloading any apps that claim they’re contact tracing.
2. You’ve been in contact with someone else who has tested positive for the virus
The NHS will also contact you if someone else who has tested positive for the virus has been in close contact with you.
You’ll be asked to self-isolate for 14 days. You’ll be given advice on how to do this, what symptoms you should look out for and what to do if you develop the illness.
You won’t be asked for any other personal details or payment information in this kind of call or message. And, crucially, you won’t be asked to pass on the details of anyone you’ve been in contact with either.
This is because unless you have tested positive or developed symptoms, there is no need to notify anyone you’ve been in touch with at this stage.
It’s a red flag if you’re asked to hand over this information to a caller or by replying to a message.
Check the caller or sender’s details
The NHS Test and Trace service will only be contacting people by phone, text message or email.
Texts will come from ‘NHStracing’ which is a protected sender ID.
Calls will come from 0300 013 5000, however there’s still a risk of this number being spoofed.
Calls from any other numbers, or from a withheld number, should be treated as fake.
How to report a Test and Trace scam
If you’ve received a dodgy message or call you can report it to Action Fraud, the national fraud reporting centre working with the police.
If you can take down any details such as numbers and email addresses, this will also be useful.
Find out more about reporting scams from our guide.
What if you think you’ve given your details away to a scammer?
If you’ve given away payment or bank details, let your bank know as soon as possible. They’ll be able to help you protect your accounts.
If you’ve shared other personal details, keep an eye out for unexpected bills or invoices addressed to you. Check your credit report regularly for any new accounts that you haven’t opened.
You can also let us know if you suspect a message or call you’ve received is suspicious. Email us at firstname.lastname@example.org
Read the latest coronavirus news and advice from Which?.
This article was originally published on 3 June. It was updated on 4 June to make clear how the app being trialled on the Isle of Wight works.