NHS COVID-19 contact tracing message: how can I tell if it's real or a scam?

People are being warned to be wary of scammers pretending to be from NHS Covid-19 contact tracing services.

Fraudsters are pretending to be from NHS contact tracing services to con people into handing over money and personal details.

Contact tracing works by asking people who have tested positive for the virus to share the details of others who they have recently been in contact with.

But this is exactly the kind of information criminals want in order to trick people out of their money, making the service an ideal target for scammers to hijack.

We've heard reports that fraudsters pretending to be from the NHS have been contacting people and offering 'fast track' testing for a fee.

NHS contact tracing services will never ask you to pay up front for a coronavirus test - the service is completely free for everyone.

The National Cyber Security Centre (NCSC) said it received 600,000 reports about scam emails in the first three months of the pandemic, all trying to take advantage of the confusion and worry around the virus outbreak.

Here, Which? looks at how the official NHS contact tracing service works and how you can tell a real message from a fake one.

How the real contact tracing process works

If you have coronavirus symptoms you can get tested.

If your test is positive you'll be contacted by the NHS England by text, email or phone. In Scotland, Wales and Northern Ireland, the NHS is only contacting people by phone at the moment.

The NHS England Test and Trace service will only get in touch with you for one of the following two reasons:

1. You've tested positive for the virus

If you test positive for the virus, you'll be contacted within 72 hours of taking the test.

Genuine texts, calls or emails from the NHS service won't ask you for any personal details upfront.

You'll be given a unique ID number to log in to the NHS England Test and Trace website. The only official web address for the NHS Test and Trace service is: https://contact-tracing.phe.gov.uk/

Once you've logged in using your ID, you'll be asked to enter some basic information about yourself including:

• Your name, date of birth and current address
• the names of the people you live with
• places you've recently visited
• names and contact details of people you were in touch with around 48 hours before you developed symptoms.

If you can't access the website, you'll be asked to give these details over the phone.

And if you're in Scotland, Wales or Northern Ireland, all NHS contact tracing is currently being carried out over the phone.

If you get a call about testing positive for coronavirus, but you haven't taken a test in the past few days or have never taken a coronavirus test, then the call isn't real.

2. You've been in contact with someone else who has tested positive for the virus

The NHS will also contact you if someone else who has tested positive for the virus has been in close contact with you.

You'll be asked to self-isolate for 14 days. You'll be given advice on how to do this, what symptoms you should look out for and what to do if you develop the illness.

You won't be asked for any other personal details or payment information in this kind of call or message. And, crucially, you won't be asked to pass on the details of anyone you've been in contact with either.

This is because unless you have tested positive or developed symptoms, there is no need to notify anyone you've been in touch with at this stage.

It's a red flag if you're asked to hand over this information to a caller or by replying to a message.

If you've downloaded one of the NHS contract tracing apps, you may also get a notification on your smartphone if you have recently been near others who have tested positive.

There are only three official apps available in the UK, depending on where you live:

• NHS England and Wales Covid-19 app
• NHS Scotland Test and Protect app
• NHS Northern Ireland Stop Covid NI app

Check the caller or sender's details

The NHS Test and Trace service will only contact you by phone, text message or email.

Contact tracing callers may leave an answerphone message to let you know they've tried to get in touch. You don't need to call them back and they won't leave a number to return the call - they will try to call you again later.

Calls will come from 0300 013 5000, however there's still a risk of this number being spoofed.

Calls from any other numbers, or from a withheld number, should be treated with caution. However, the Department of Health and Social Care said that there is a chance some Test and Trace calls may display as a local area number.

Under 18s will be asked for a parent or guardian's permission before continuing with a Test and Trace call.

Text messages will come from 'NHStracing' which is a protected sender ID.

How to report a Test and Trace scam

If you've received a dodgy message or call you can report it to Action Fraud, the national fraud reporting centre working with the police.

If you can take down any details such as numbers and email addresses, this will also be useful.

Find out more about reporting scams from our guide.

What if you think you've given your details away to a scammer?

If you've given away payment or bank details, let your bank know as soon as possible. They'll be able to help you protect your accounts.

If you've shared other personal details, keep an eye out for unexpected bills or invoices addressed to you. Check your credit report regularly for any new accounts that you haven't opened.

You can also let us know if you suspect a message or call you've received is suspicious. Email us at scamwatch@which.co.uk

Read the latest coronavirus news and advice from Which?.

This article was originally published on 3 June. It was last updated on 6 November.