With recent changes to the Covid testing rules, fraudsters are impersonating the NHS in a series of constantly evolving scam text messages.
From April, the majority of people living in England need to pay for lateral flow tests, . In Scotland, some free testing will continue until Monday 18 April. In Wales, free PCR tests ended in March, but free lateral flow tests will be available until June. But, no changes to Covid testing have been confirmed for Northern Ireland yet.
Unsurprisingly, scammers are taking the opportunity to capitalise on the Covid testing changes, sending text messages asking you to order a test and pay a delivery fee.
Here we show you what the scam looks like and how it works. We also explain how to report it and where you can buy genuine Covid tests.
While we found many examples of this scam with slightly different wording and web addresses, the premise remains the same:
The copycat NHS website looks seemingly legit, but we know that scammers can be skilled at copying the branding, style and format of genuine websites. However, the big giveaway is the web address itself, which isn't the real NHS website.
As the video shows, the fraudsters use the scam to steal my personal details and to try and take money from my bank account a few days later. We set up fake details to giveaway for the purpose of this investigation.
Each of the attempted fraudulent transactions were for amounts of no more than just £1. This isn't unusual - scammers often start small to go unnoticed, then attempt higher sums further down the line. This is also the pattern we found when from my account and when an led to a phone call with a scammer who tried to con me out of £1,000.
If you think you've shared your details with a scammer - contact your bank immediately. You can also report the scam to Action Fraud or the police if you live in Scotland.
The NHS won't ask you to buy a test or hand over any financial details.
Text messages from the NHS should also come from a sender name, not a mobile phone number.
Which? is urging companies to improve text message communications to protect their customers and reduce the risk of impersonation scams.
Our guide for best practice text message communication includes calls on businesses to:
Businesses at risk of spoofing by scammers should protect their inbound customer service numbers through the UK regulator Ofcom's Do Not Originate scheme. They should also protect themselves against SMS spoofing via the UK's Mobile Ecosystem Forum SMS SenderID Protection Registry.