Back to Cases
Phishing UK 2021

The NHS COVID Vaccine Phishing Campaign

Millions of UK residents received fake NHS texts and emails offering early vaccine appointments.

Undisclosed (thousands of victims)Total Losses
Millions targetedVictims Affected
National Cyber Security Centre (NCSC) Annual Review 2021Source

Timeline: How It Unfolded

January 2021

As the UK's COVID-19 vaccination programme ramps up, scammers begin sending millions of texts and emails claiming to be from the NHS.

January-March 2021

Messages say: "You are eligible for the COVID vaccine. Apply now to book your appointment" with a link to a convincing fake NHS website.

On the fake site

Victims are asked to "verify their identity" by entering their name, date of birth, address, NHS number, and bank card details (to "confirm address for the booking system").

March 2021

The NCSC reports eliminating 442 phishing campaigns using NHS branding. Over 12 million blocks are applied against COVID-19 phishing domains between January 2020 and July 2021.

Throughout 2021

Variants of the scam continue — fake "vaccine passport" sites, fake booster booking pages, and fake test result portals.

How the Scam Worked

  • The scam exploited widespread public anxiety about getting vaccinated and the genuine confusion about how the NHS booking system worked.
  • Fake websites were near-perfect copies of the real NHS website, using the correct logo, colours, and layout.
  • The request for bank details was disguised as "address verification" — plausible enough during a time when many systems were being set up quickly.
  • The scam used the same channels (SMS, email) that the real NHS was actually using to contact people, making it harder to distinguish.

Red Flags That Were Missed

The NHS never asks for bank details or payment for vaccinations — they are free
The links went to URLs that weren't nhs.uk (e.g., nhs-vaccination-booking.com)
The messages created urgency — "limited appointments available, book now"
Some messages had incorrect NHS branding or formatting differences

What You Should Learn From This

Scammers exploit current events and public health crises — be extra vigilant during major news events.
The NHS (and healthcare services in most countries) never charges for vaccinations or asks for bank details.
Always go directly to the official website (nhs.uk) rather than clicking links in texts or emails.
During crises, official information comes through established channels — your GP, the NHS app, or gov.uk.
If you're unsure, call your GP surgery directly using the number you already have.

Outcome

The NCSC's Active Cyber Defence programme removed 2.7 million scam campaigns in 2021 — nearly four times more than 2020 — including 442 NHS-branded phishing campaigns and 43 fake COVID apps. The campaign led to increased public awareness about health-related phishing and prompted the NHS to issue clear guidance that vaccinations are always free.