June 1st 2020
Today, Get Safe Online is issuing a serious warning about scams perpetrated by fraudsters claiming to represent the NHS Coronavirus test and trace service. These could take the form of fake emails, texts and phone calls and also bogus websites.
One of the key elements of the service – which was announced by the government last week – is an alert, usually by text, email or phone call, that the recipient has been in close contact with someone who has tested positive for Coronavirus. The alert prompts you to log in to the NHS test and trace website, or alternatively to talk to a trained call handler to guide you through the process.
Unfortunately, this represents a perfect opportunity for criminals to pose as one of the 25,000 tracers engaged under the scheme. Thousands of members of the public will receive fake texts, emails or phone calls – or possibly direct messages via social media – to inform them that they have been in contact with somebody who has the Coronavirus. Unlike the authentic approaches from the NHS, they could attempt to gain confidential information enabling the perpetrators to commit either identify theft, financial fraud, or both.
This comes despite an answer to a journalist at yesterday’s Coronavirus press conference from Dr Jenny Harries, Deputy Chief Medical Officer, who asked how people could tell if the approach was genuine.
Dr Harries is reported as saying: “I think it will be very obvious in the conversation you have with them that they are genuine in that regard. I recognise that many of us will be very cautious, and quite rightly so, about interactions from external organisations, but individuals will make it very clear to you that they are calling for a particular reason.
“I think it will be very evident when somebody rings you these are professionally trained individuals and sitting over them are a group of senior clinical professionals.”
Fraud warning
Tony Neate, CEO of Get Safe Online, commented: “As in many scenarios we’ve witnessed over the years, there’s no doubt that this situation has created the perfect storm for fraud. Panic over your own and your family’s health, combined with the fact that somebody official-sounding has contacted you, will spell success for the fraudster.
“Even the basic questions the government has said that tracers will use to confirm your identity – full name and date of birth – can be gems for a fraudster if revealed to the wrong person. But how can a member of the public tell if a fraudster is genuine or not, especially when phone numbers, email sender addresses and text phone numbers can be easily spoofed?”
We also anticipate a large number of fake NHS test and trace websites being set up to capture confidential details. A genuine call, email or text from the NHS will include secure login details. A criminal, however, could also provide you with login details, but also give you the address of a bogus but authentic-sounding website.
Neate continued: “The authentic test and trace website has the address ‘contact-tracing.phe.gov.uk/sign-in’. You should always type this into your browser rather than following a link, which may be fake. If someone gives you a different address, it’s probably an attempt at fraud.”
