22% of Brits Received Proof of Vaccination Phishing Email in Past Six Months

Nearly a quarter (22%) of Brits have received phishing emails asking them to download their ‘proof of vaccination’ in the past six months, according to new research by Tessian.

The analysis found that most of these scam messages received in the UK impersonated the National Health Service (NHS), the public body that manages official vaccination pass documentation in the country.

The researchers noted many of these phishing messages look genuine, containing official logos, using accurate display names and correct spelling. The emails commonly looked to convey a sense of urgency to panic victims into acting without thinking clearly. This included using subject lines with terms like “IMPORTANT” and “OFFICIAL,” and describing the potential repercussions of failing to act on the message, such as an inability to travel or requirement to quarantine if instructions are not followed.

Figure 1 was displayed as an example of a message of this type:

Most of these emails then redirected the recipient to a website requesting sensitive data to receive their proof of vaccination. These include personal details and credit card or banking details. These websites were often highly sophisticated, appearing to be genuinely from the NHS (Figure 2).

Tessian also found more than one in three (35%) US citizens received a phishing email requesting proof of vaccination in the past six months.

The findings come during Cybersecurity Awareness Month 2021, in which one of the themes is ‘Fight the Phish.’ This campaign urges online users to slow down and think before clicking on any suspicious emails, links or attachments.

Regarding the proof of vaccination scams, the researchers pointed out that NHS services are free for UK residents, and the institution would never ask for payment details or other financial information. US residents noted that COVID-19 vaccination providers could not charge you for a vaccine or charge you for any administration fees, copays or coinsurance.

Charles Brook, a threat intelligence researcher at Tessian, commented: “Throughout the pandemic, we’ve seen cyber-criminals leverage COVID-related trends as lures in their phishing campaigns. Now they’re capitalizing on the uncertainty surrounding vaccination certificates to dupe people into sharing login credentials and personal or financial information.

“In many cases, the emails purporting to come from the NHS look very convincing. Detecting these scams requires everyone to question messages they receive via phone, text or email. If you are unsure whether a text or email is a scam, then assume it is. Avoid clicking any links or attachments or handing over any information until the sender has been verified. And remember, the NHS won’t charge you for a COVID NHS pass, so any email asking for payment details should be deleted. If you have further questions, go to the official NHS or gov.uk website.”