Beware of NHS Covid Pass scams

Action Fraud has received over 700 reports from members of the public about fake emails purporting to be from the NHS offering Covid passes as fraudsters continue to capitalise on the pandemic.

The emails claim to be able to provide people with a “digital passport” that “proves you have been vaccinated against COVID-19”. These emails are fake, and the links within them lead to genuine-looking websites that steal your personal and financial information.

These emails could be attractive to adults who may want to show that they are fully vaccinated and therefore can avoid quarantine when returning from amber list countries.

Also, demonstrating a Covid status may be needed to gain entry to nightclubs and some other venues, including venues in which gigs and concerts are held. From September, it will become law for anyone wanting to go to a “higher risk” venue – like clubs and live music venues – to show a valid NHS Covid Pass.

Action Fraud are urging people to be cautious of unsolicited emails as fraudsters prey on uncertainty.

Remember, the vaccine is free of charge. At no point will you be asked to pay.

• The NHS will never ask you for your bank account or card details.

• The NHS will never ask you for your PIN or banking passwords.

• The NHS will never arrive unannounced at your home to administer the vaccine.

• The NHS will never ask you to prove your identity by sending copies of personal documents such as your passport, driving licence, bills or pay slips.

So how do I get the NHS Covid Pass?

You can download it via the NHS app (not the NHS Covid-19 app), if you are registered with a GP. You can also get it via the NHS website.

Once you are logged in you can select "domestic" and "travel" pass options.

The system generates a QR code, which lasts for 28 days.

You can also request an NHS Covid Pass letter by calling 119. This only shows vaccination status and has no expiry date.

Under-16s can't get an NHS Covid Pass because most children aren't being vaccinated.

Make sure you apply via the official website or app. Do not click on unsolicited emails or texts.

How to report scams

If you receive a call you believe to be fraudulent, hang up. If you are suspicious about an email you have received, you can report it by forwarding the email to: Suspicious text messages can also be reported by forwarding them to the number: 7726 (it’s free of charge).

If you believe you are the victim of a fraud, please report this to Action Fraud as soon as possible by calling 0300 123 2040 or visiting

The contents of blog posts on this website are provided for general information only and are not intended to replace specific professional advice relevant to your situation. The intention of East Midlands Cyber Resilience Centre (EMCRC) is to encourage cyber resilience by raising issues and disseminating information on the experiences and initiatives of others. Articles on the website cannot by their nature be comprehensive and may not reflect most recent legislation, practice, or application to your circumstances. EMCRC provides affordable services and Trusted Partners if you need specific support. For specific questions please contact us by email.


EMCRC does not accept any responsibility for any loss which may arise from reliance on information or materials published on this blog. EMCRC is not responsible for the content of external internet sites that link to this site or which are linked from it.