Cyber Security

The Covid-19 Vaccine Pass Scam

James Hingley

People are losing money to prove that they are vaccinated.

Scam emails and texts are currently circulating regarding digital coronavirus passports. The sites linked in the message claim to provide an NHS Covid-19 pass. To provide authenticity, the links have the NHS logo. They take people to a fake NHS website that demands payment. Once the fee is paid, an NHS pass is supposedly issued.

The reopening of public venues is also seeing British airports increasing the number of flights. Scammers are exploiting the requirement of NHS passes for foreign travel. Some countries require proof of vaccination or negative test on arrival. For this reason, people are being taken in by the scam. In the rush to book foreign holidays, people mistakenly pay the fee demanded by the scammers.

The success of this scam points to the wider issue of misinformation around the vaccine passes. The NHS provides passes for people to prove their vaccine status free of charge. The passes are also issued after a positive PCR test within the past 6 months or within 48 hours of a negative PRC or lateral flow test.

Deepak Dwarakanath, medical director for North Tees and Hartlepool NHS Foundation Trust, sought to clarify how NHS passes work:

‘For those who have had both of their COVID-19 vaccinations, the NHS COVID Pass is crucial as people begin to look forward to events, holidays and their life after the pandemic. It’s a disgrace that people would seek to scam others in this cruel manner by taking advantage of this. If you have had both of your vaccinations and need a pass, please obtain it using NHS channels. The NHS COVID pass is free to anyone who needs one and will remain free while it is a necessity for travel.’

Large scale public events are now using the passes to help improve safety. On Monday, July 12, Health Secretary Sajid Javid encouraged nightclubs and other event organisers to ask for the so-called vaccine passports. At his press conference confirming the July 19 reopening, Prime Minister Boris Johnson stressed the importance of the passes:

‘As a matter of social responsibility we’re urging nightclubs and other venues with large crowds to make use of the NHS Covid pass, which shows proof of vaccination, a recent negative test or natural immunity as a means of entry.’

Vaccine passes are not unique to the UK. The EU is introducing its vaccine ‘passport’ that allows holders to prove their vaccinated status. It is issued under the same conditions as the NHS pass. Holders of the passport can travel around all 27 EU member nations, plus Switzerland, Iceland, Norway and Liechtenstein, without having to quarantine.

It is currently not possible to use the NHS pass in the EU or vice versa. Some countries such as Spain, Portugal and Greece are accepting the NHS pass. The UK government is working to allow fully vaccinated foreign nationals to come to the UK without needing to quarantine.

What else is out there?

Phishing emails and texts are commonplace. People receive messages telling them to follow a link that then asks for personal information. This includes name, mobile number, email address and living address. Most importantly, they ask for bank details and a money transfer. It is a simple, but effective formula that scammers continue to use.

The move to working from home gave scammers easy access to unwitting victims. Equally, the Covid-19 pandemic opened up a wide range of potential scams. During lockdown in the UK, a Track and Trace scam saw people asked to pay £500 for a test after supposedly coming into contact with someone who tested positive for Covid-19. Now that the Track and Trace system is winding down, this scam has lost some of its potency.

There is now a vaccine scam. Like the fake Covid-19 pass message, scammers send a link to a fraudulent NHS website. The messages claim to offer Covid-19 vaccines. People are then asked to confirm their address by providing their bank details. The scam profits from people’s desire to get the vaccine. With foreign holidays now a possibility, the demand for vaccines is growing.

The coronavirus vaccines are free. Any website asking for financial information is a scam.

Spotting a scam

Scammers have tells. They strive for authenticity. The fake websites will bear the hallmarks of the organisation they are impersonating. For example, a fake NHS or government website features their logos and mimic the layout of the real websites. Official websites never ask for bank details or money transfers.

The web address provides clues. The government website is gov.uk and the NHS is nhs.uk. Fraudulent websites have longer web address titles. The titles include words such as web redirect and takes people to websites ending in .org or .com.

Fraudulent text messages feature an actual phone number. In the UK, these numbers will have the UK country code +44. Numbers from the NHS are automated. Examining the text reveals no number.

Scammers are clever. As people catch onto their scams, they adapt and find new ways to deceive people. However, scammers cannot hide entirely. There will always be certain giveaways. By familiarising ourselves with them, it is possible to minimise the damage caused by scammers.

About the Author: James Hingley

James Hingley is a contributing Features Writer with extensive expertise in International Relations, Politics and Culture.