Bank warns of spike in fake NHS text message scams

Around £880,000 of impersonation scams which started with fake NHS Covid-19 texts have been reported to Santander since January.

On average, people are being conned out of £5,600, according to the bank’s data.

In one case seen by the bank a couple transferred more than £20,000.

The scam works by fraudsters sending fake texts stating the recipient has been in close contact with someone who has tested positive for Covid-19. Texts include a link to a fake NHS website to order a PCR test.

The website asks for their personal details and a small amount of money is requested to cover postage for the PCR test.

This means the payment card details can be harvested by the fraudster, who then contacts the intended victim pretending to be from their bank and convinces them they are being scammed and they need to move their money into a “safe account”.

The name on the safe account is often someone else’s and the fraudster will concoct an explanation for why it is not in the customer’s name. In reality, the account is controlled by the fraudster.

Once the money is sent, all contact is cut off, and victims’ details are sometimes sold on to other criminals.

In one case seen by the bank, “Mrs D” received a text purportedly from the NHS warning her she had been in close proximity to someone who had tested positive for the Omicron variant. She clicked on a link in the text to order a PCR test and paid £1 for postage.

She then received a call from someone claiming to be from the Santander fraud team, who advised her she had recently fallen victim to an NHS PCR scam and that her account was at risk. She was told she needed to move her money to a safe account immediately.

The account details provided were under someone else’s name. When Mrs D transferred the money, confirmation of payee – the system used by many banks that checks whether the account name matches the account number provided – confirmed the account was registered to someone else but she continued with the transfer.

Once the transfer was complete, the fraudster asked to speak to her husband. Mr D was advised to move his money from his joint account with his wife into his sole account, as his wife’s details were apparently compromised.

He was then provided with the same account details as his wife and told to transfer his money to the safe account. In total Mr and Mrs D transferred more than £20,000 to the fraudster.

Chris Ainsley, head of fraud control at Santander UK, said: “Be on high alert if an SMS or email includes a link to a website, however genuine the website may look, and never feel pressured to move your money. No bank or legitimate organisation will ask you to transfer your money to a safe account – ever.”

Santander said if someone is contacted by a person claiming to be from their bank, the police or any organisation and they are asked to move their money, they should stop, end the call and call their bank, making sure to use a number they trust.

If they think they have fallen victim of this type of scam, they should report it straight away, the bank said.

Adam French, Which? consumer rights expert, said: “Throughout the pandemic, fraudsters have used every change in Covid rules as an opportunity to create new scams to part people from their hard-earned cash.

“These scam NHS texts offering PCR tests are no exception. People should be on high alert for scams and if in any doubt, should verify the text directly with the NHS or their bank before giving any personal or bank account details.

“Which? is calling on banks and businesses to sign up to its SMS best practice guide and commit to taking steps to help prevent their customers falling victim to fraud.”