NHS Vaccination phishing Scam

[Giles]

I have just received an Email notification from the NHS inviting me for vaccination - which is not altogether implausible. However, the appointments page wanted usual information plus my mother's maiden name - a huge red flag. I went back and checked the actual address it was from under the mask, and it was not the NHS at all.......

 

They lifted real pages of course....

 

Do please be careful, and check the source of any such things, and don't give away security information.

[Bernard Lamb]

When the time comes you will get a letter in the post.

This letter will contain your NHS number and inform you how to apply on line or by phone.

Any e mail is a scam.

Bernard

[A Murphy]

It is not the case that everyone receives a letter in the post. I live in South London. Last night I received a text with a link in it, inviting me to book my vaccination. I did so. I am now back home after booking an appointment for this morning. The whole process was smooth and speedy. 

 

Regards,

 

Alastair

[Nick C]

8 minutes ago, A Murphy said:

It is not the case that everyone receives a letter in the post. I live in South London. Last night I received a text with a link in it, inviting me to book my vaccination. I did so. I am now back home after booking an appointment for this morning. The whole process was smooth and speedy. 

 

Regards,

 

Alastair

I presume if that is the case then it will come from the same number as other messages from your GP surgery and have the name of the surgery in it, so that you know its genuine? Otherwise I wouldn't trust it!

 

Edit - I've just checked my GP's website - apparently in our area it's all centralised into a local hotel and everyone will be contacted by "phone or text message" when it's time - and there's a big banner warning about the above-mentioned email scam.

Edited January 28, 2021 by Nick C

[kevinlms]

1 hour ago, God's Wonderful Railway 1835 said:

I got this one a few days ago and sent it onto "report@phishing.gov.uk" <report@phishing.gov.uk>

 

You are required to reply to this invitation within 12 hours of this notification.

 

There's the biggest give away that it's a scam. There is NO WAY a genuine request would pressure you with such a ridiculous time scale. Not everyone checks emails constantly.

 

The idea is to make you panic and respond without thinking, because the deadline is looming.

[A Murphy]

Nick, yes, should have said that the text was easily identifiable as originating with my GP. 

Alastair

[Robert Stokes]

My wife and I were invited for vaccination by a telephone call from our local surgery. This was over a week ago and we were done the following day.

 

It does not surprise me that there are phishing emails about this. Criminals will try anything with the slightest chance of success.

 

Robert

[phil_sutters]

I was invited to my first vaccination by a text. It had clear indications that it came from my GP's list, although it was from South Downs Health & Care. It said that they had slots available the next afternoon and my name would be listed at the door. If I couldn't make it, I would be contacted later. It was clear that they were trying to fill unbooked spaces. My wife had not got her mobile registered with the GPs so didn't get an invitation. There were no contact details to try to get her one. I went because I felt it would help keep the system flowing. I will accompany my wife when her turn comes, as her mobility isn't brilliant. Most of those there were in the over-eighties age group, so filling the slot by taking younger people, who could probably respond more quickly, makes sense. The only down side was that the centre was the far side of Eastbourne, currently a higher infection rate area, and I travel on public transport - so two buses each way. However there were less than half a dozen people on each of the double decker buses.

Edited January 28, 2021 by phil_sutters

[tetsudofan]

Last Saturday (23/1) received an email from one of my friends saying that as I was (just) over 75 I could book an online vaccination appointment without having received a communication from the NHS.

 

Went online to the (real) NHS website and within a few minutes I had booked an appointment for Tuesday (26/1) at 10:10am with a follow-up appointment for April 14th.

 

Turned up at the venue (which had only just opened in what was once a branch of Debenhams) at 10:10am, had my jab (the AZ one) and was on my way home at 10:35am. Organisation was just fantastic - many thanks NHS!!

 

Later that afternoon (26/1) I received a phonecall from local GP surgery asking if I would like to have a jab the following day (27/1) at the GP run vaccination venue which I declined telling them that I had already received a jab that morning.

 

Yesterday (27/1) I received the letter from the NHS regarding the booking of an appointment for the jab.

 

So, I received all the necessary documentation etc. but not in the order that I expected. The system is working which is the important thing when you bear in mind how much work is involved in getting the system going. To be honest I did not expect to get my first jab until mid-February but I've got it now thanks to all the work being done by the people in the NHS.

 

Keith

[J. S. Bach]

6 hours ago, kevinlms said:

There's the biggest give away that it's a scam. There is NO WAY a genuine request would pressure you with such a ridiculous time scale. Not everyone checks emails constantly.

 

The idea is to make you panic and respond without thinking, because the deadline is looming.

I have a friend who only checks his email once a week when he does his weekly ebay trawl.

[TheSignalEngineer]

My wife had a similar one this afternoon. She is expecting here invitation shortly. 

As I had recently received mine by test direct from the NHS she asked me about it and when checked out it was asking for credit card details including the three digits on the back. Immediately passed to the cyber crime reporting squad.

[57xx]

On 28/01/2021 at 15:15, kevinlms said:

There's the biggest give away that it's a scam.

 

You don't even have to read that far, the very first line gives it away, it's addressed "Dear <email address>". That is the biggest give away of any scam.

[ejstubbs]

On 28/01/2021 at 18:07, tetsudofan said:

Last Saturday (23/1) received an email from one of my friends saying that as I was (just) over 75 I could book an online vaccination appointment without having received a communication from the NHS.

 

Went online to the (real) NHS website and within a few minutes I had booked an appointment for Tuesday (26/1) at 10:10am with a follow-up appointment for April 14th.

 

A skiing friend (possibly soon to be ex-friend) of mine down south gleefully reported on our Whatsapp group that he had done something similar - even quoting the URL that he had been given by his hairdresser!  Another friend in the group checked out the URL and found that it clearly stated that you should only proceed if you met one of a number of conditions - none of which the first guy met: he's not in the current priority age range, nor does he have any underlying complications.  First guy had ignored that and continued to successfully book his two appointments.  

 

Now, I know it's pretty poor of the NHS not to have better screening/validation on their booking system but when, in the midst of a global pandemic in which older and/or more vulnerable people are still falling seriously ill and dying, you are specifically requested to act honestly and honourably and you choose not to do so then I do believe that a lot of the fault lies with you.   It's a bit like blaming people for being burgled if they leave their front door open: they may be guilty of a degree of contributory negligence, but the burglar didn't have to walk in and steal their TV - he could have chosen to walk on by.  A truly honest person might even have gone to check whether the householder was at home, and if not then alerted the police to the apparently insecure property.

 

I don't know whether the NHS is actually aware of this apparent weakness in their system, but it seems to be becoming quite widely known based on what you, and my skiing acquaintance, have reported.  I do realise that you did qualify for the vaccination, but on the evidence of my skiing acquaintance it seems that anyone who can get or find the URL can effectively jump the queue.

 

If I knew where to go to lodge a concern about it officially I would do so.  Anyone any idea?

 

(FWIW I'm in Scotland and I assume that a different booking system is being used here.  I wouldn't bother trying to find out anyway.)

[woodenhead]

My invitation came by text and it was a personal link, I had to provide my DOB to confirm it was me and then booked.

 

As a lot of the vaccination drives are GP driven the actual method used will be specific to each GP or group of GPs as many are pooling resources.  Mine was booked via accurx which is an NHS service provider.

 

The invitations to the big vaccination centres I would imagine may be less personal and it may be that where the problem lies - many people don't trust random emails anymore and if GPs are driving their own vaccination programmes then most people would prefer to pop down to their local surgery than to travel to a central vaccination point.

[ejstubbs]

Interesting, thanks.  No sign of accurx branding on the web site that my acquaintance used: wall to wall NHS.

 

Here in Scotland it's strictly by invitation only: either by contact from your GP's surgery (for those in the older and at-risk groups), or a letter giving you a fixed date+time at a vaccination centre.  There doesn't appear to be any "self service" element as far as I can tell from the relevant web sites.

[Bernard Lamb]

58 minutes ago, woodenhead said:

My invitation came by text and it was a personal link, I had to provide my DOB to confirm it was me and then booked.

 

As a lot of the vaccination drives are GP driven the actual method used will be specific to each GP or group of GPs as many are pooling resources.  Mine was booked via accurx which is an NHS service provider.

 

The invitations to the big vaccination centres I would imagine may be less personal and it may be that where the problem lies - many people don't trust random emails anymore and if GPs are driving their own vaccination programmes then most people would prefer to pop down to their local surgery than to travel to a central vaccination point.

I thought you got an invitation to apply to be vaccinated and were then given a choice of venues.

Which is why I chose a local pharmacy rather than the two large centers that were on the short list.

Bernard

[tetsudofan]

13 hours ago, ejstubbs said:

 

A skiing friend (possibly soon to be ex-friend) of mine down south gleefully reported on our Whatsapp group that he had done something similar - even quoting the URL that he had been given by his hairdresser!  Another friend in the group checked out the URL and found that it clearly stated that you should only proceed if you met one of a number of conditions - none of which the first guy met: he's not in the current priority age range, nor does he have any underlying complications.  First guy had ignored that and continued to successfully book his two appointments.  

 

Now, I know it's pretty poor of the NHS not to have better screening/validation on their booking system but when, in the midst of a global pandemic in which older and/or more vulnerable people are still falling seriously ill and dying, you are specifically requested to act honestly and honourably and you choose not to do so then I do believe that a lot of the fault lies with you.   It's a bit like blaming people for being burgled if they leave their front door open: they may be guilty of a degree of contributory negligence, but the burglar didn't have to walk in and steal their TV - he could have chosen to walk on by.  A truly honest person might even have gone to check whether the householder was at home, and if not then alerted the police to the apparently insecure property.

 

I don't know whether the NHS is actually aware of this apparent weakness in their system, but it seems to be becoming quite widely known based on what you, and my skiing acquaintance, have reported.  I do realise that you did qualify for the vaccination, but on the evidence of my skiing acquaintance it seems that anyone who can get or find the URL can effectively jump the queue.

 

If I knew where to go to lodge a concern about it officially I would do so.  Anyone any idea?

 

(FWIW I'm in Scotland and I assume that a different booking system is being used here.  I wouldn't bother trying to find out anyway.)

 

There was no phishing in my case. The link I was sent was the proper link to the NHS booking system.

 

Seeing comments elsewhere about jumping the queue I phoned the NHS booking system to confirm that I was entitled to get the jab and the guy at the other end confirmed that I was entitled to get the jab so there was no need for me to cancel my appointment.

 

As it happens on the afternoon that I got the jab I got a call from my local GP asking if I would like a jab ..... and the following day I got the invitation letter (dated before I booked my appointments) from the NHS inviting me to have the jab.

 

My jab was given (on the first day) at a newly opened jabbing centre(called Folca) operated by the NHS whereas the local GPs are running a separate local jabbing centre. Things are changing so quickly these days luckily for our benefit. 

 

Keith

 

[Hibelroad]

It’s sad that we now live in a world where you have to question the authenticity of every call, text and email. It’s also disgusting that there are people who seek to exploit the vaccination system which is of critical importance to everyone’s future. The thing to bear in mind is that when you get an invitation the NHS already have all your details so all they will ask is that you pick a date and time from the options offered. 

[ejstubbs]

My acquaintance's experience (with a genuine NHS web site, not a phishing site) strongly suggests that the NHS booking system does not verify the validity of booking requests against data held by the NHS.

 

Agree it's pretty disgusting behaviour, hence why I am reconsidering my relationship with said person.

Edited February 27, 2021 by ejstubbs

[Zomboid]

On 28/01/2021 at 17:56, phil_sutters said:

My wife had not got her mobile registered with the GPs so didn't get an invitation.

This happened to my parents - my Dad got the text but my Mum didn't (she's also a couple of years younger so may not have made it to the front of the queue at that point). When my Dad called to to make the appointment he asked if my Mum could come and have hers at the same time even though she hadn't had the letter etc, and they said that she could. So now they've both been done. She got her letter a couple of days later.

 

No idea what other places will say, but it's worth asking the question if you have that kind of situation.

[woodenhead]

2 hours ago, Bernard Lamb said:

I thought you got an invitation to apply to be vaccinated and were then given a choice of venues.

Which is why I chose a local pharmacy rather than the two large centers that were on the short list.

Bernard

I did get a choice but all very local medical centres - some people were/are getting invites to big vaccination centres - which are oddly underused because over 70s typically do not want to travel miles and miles during a pandemic when they can just go down the road.

 

I'm in my fifties, they've got through all the more vulnerable folk where I live and now onto us youngsters.

[Siberian Snooper]

When I booked my jab online, they wanted my DoB and my NHS number, I went to a mass vaccination centre.

 

 

[Hibelroad]

Perhaps different health areas book in different ways. I booked through the local GP scheme and there was minimum fuss. Following that I have had another offer from the local hospital and also a letter arrived urging me to book so I don’t think all the databases are as joined up as they should be. I am hoping that this will not affect my registration with the GP scheme come second dose time. 

[laurenceb]

As I understand it you are told to ignore the letter if you have already made arrangments with your local GP.

[zarniwhoop]

3 hours ago, Siberian Snooper said:

When I booked my jab online, they wanted my DoB and my NHS number, I went to a mass vaccination centre.

 

 

Same for me in booking - got a letter telling me I was vulnerable (as a Type 1 diabetic I was aware of that), and then yesterday a letter inviting me to book. Will be going to the Brighton Centre, luckily for me that is quite convenient.