PEOPLE are being warned about a new text message scam which asks for payment for a ‘Covid Pass’.
A NHS Covid Pass or vaccine certificate is used to show a person has had both doses of a coronavirus vaccination and are available to everyone in the UK through the official NHS app or website and does not require any payment.
They can be used to gain entry into domestic venues asking for proof of vaccination as well as for overseas travel.
But a new text message scam aims to catch people out and lose people a lot of money.
This is what you need to know about the ‘Covid Pass’ scam and how to stay safe.
What is the text message?
This scam involves a text message containing a link to a website mimicking the official NHS website with the URL nhs.yourcovidpass.com.
The site asks users to input the exact name registered with their GP surgery, as well as their home address.
It then shows a screen asking for credit card details, falsely claiming a £4.99 payment is needed to “process your Covid Pass application”.
Users are also asked for their bank details to ‘authorise’ the payment.
What are the key signs that it is a scam?
On the face of it, it is a fairly legitimate looking text message with a website that appears to be authentic. There also doesn’t appear to be any glaring grammar errors or low-resolution images that suggest it isn’t fake.
In fact, the scam uses the exact same text as the official NHS website's Covid Pass website.
But upon closer inspection, there are clues to suggest that it is not real and a scam.
The ‘Covid pass’ requires your bank card details as well as your bank details. This is a huge red flag as the real NHS COVID Pass, which is available via the NHS website, is actually free.
Sending your bank details to ‘authorise’ a payment is not a real method to verify online payments and is clearly done to commit fraud and cost a victim potentially a lot of money.
What security experts say about ‘Covid pass scam’
Cybersecurity firm Malwarebytes urged the public to be wary of text messages containing links and asking for payment details.
A spokesman said: “This attack is aimed at residents of the UK. It makes use of social engineering in a similar fashion to other pandemic-themed SMS texts, with a strong psychological aspect tied in for good measure.
“It’s important to note that the UK does have an actual Covid Pass system in place. There’s a proper process in place, and it doesn’t involve handing money over to random websites. It’s also worth noting there’s been a number of other scams along these same lines.
“Should you receive one of these text messages, you can safely ignore it and report for spam while you’re at it.”
How do I get a genuine Covid pass?
You can easily acquire a Covid pass from the NHS website or via its smartphone app.
The pass is a digital QR code that you can download or have sent to your email.
Users will be asked to input their name, date of birth, postcode and NHS number.
The digital versions last for 28 days if you are fully vaccinated, then automatically renew, while if you have a negative Covid test result it is valid for 48 hours.
Users can either download the Covid Pass as a PDF, get it sent via email or receive a paper copy sent to them.
How to stay safe and how to report scams
Action Fraud advises members of the public to remember these three steps to keep themselves safe against scammers.
- Stop: Take a moment to stop and think before parting with your money or information
- Challenge: Could it be fake? It’s okay to reject, refuse or ignore any requests - only criminals will try to rush or panic you
- Protect: If you have provided personal details to someone over the phone and you now believe it to be a scam, contact your bank, building society and credit card company immediately and report it to Action Fraud
You can report a scam to Action Fraud via the website or by calling 0300 123 2040.
Comments: Our rules
We want our comments to be a lively and valuable part of our community - a place where readers can debate and engage with the most important local issues. The ability to comment on our stories is a privilege, not a right, however, and that privilege may be withdrawn if it is abused or misused.
Please report any comments that break our rules.
Read the rules here