Beware NHS Covid pass fraud - one MoneySaver was scammed out of £25,000 though he got his money back after MSE intervened

Rory MacPhee, 65, from Fife in Scotland, told us he's been left feeling "completely violated" after falling victim to the Covid-19 text scam. He said: "I was assailed by profound trauma, and guilt that my daughter’s inheritance had been stolen. But I want to share the experience honestly, rather than run away from it."

Below we explain what happened to Rory, what you need to watch out for, and what to do if you've think you've been conned. You can also see our 25+ ways to stop scams guide for further help. Plus, consider reaching out to charities, such as Victim Support, if you're struggling with the emotional impact of being scammed. 

'I didn't know fraudsters could mimic legitimate phone numbers'

Rory says he was drawn in by scammers after clicking a link in a text message claiming to be from the NHS. He arrived at a page that looked like the NHS website and paid £4.99 for what he believed to be a Covid pass - though you can get your NHS pass for FREE (see below for more on this). It was only on closer inspection of the URL, which was slightly different to that for the legitimate NHS website, that Rory realised he'd been scammed.

He immediately called his bank - Santander - to report the fraud and it said it would send him a replacement card. The next day, Rory received a phone call claiming to be Santander's fraud department. When Rory asked for proof, he was referred to Santander's website where the number listed matched the one he was being called from. But it was a so-called 'number spoofing' scam and Rory was unknowingly talking to fraudsters.

They urged him to transfer his savings to another account that wasn't his own as they told him his cash was at risk following the initial NHS scam. The fraudsters convinced Rory to drive to a Santander branch in Dumferline - speaking to him on the phone the entire time - where the cashier followed his instructions to move £25,000 out of his Santander account.

Rory MacPhee (pictured above), who was scammed out of £25,000, works as a forest therapy guide.

It was only later that evening that alarm bells started ringing. But after contacting Santander numerous times over a number of days, and not seeming to get anywhere, a frustrated Rory posted on the MoneySavingExpert Forum. We contacted Santander on his behalf, and 10 days after Rory initially transferred the £25,000, he was refunded in full. 

Others aren't so lucky though, and end up having to take their complaints to the Financial Ombudsman Service after banks refuse to payout. According to the Payment Systems Regulator's (PSR) latest figures, £355 million was lost to so-called 'authorised push payment (APP)' scams - where victims are tricked into sending money to an account controlled by fraudsters - in the first half of 2021.

That's despite major UK banks agreeing to a voluntary code in 2019 to refund victims' money unless they ignored their bank's warnings about the scam or were "grossly negligent" in transferring the cash. The PSR is now proposing new laws be introduced to make it mandatory for banks to reimburse APP scam victims. Its consultation on this closed earlier this month.  

Rory said: "The financial institutions need to urgently to review their protocols and anti-fraud strategy. The existing system is demonstrably not fit for purpose. I've also since found out that fraudsters can mimic legitimate telephone numbers. Why is there no technical fix for this?"

A spokesperson for Santander told us: “We have a great deal of sympathy for all victims of scams. Following a review of the specific circumstances of Mr MacPhee’s case, we have refunded the £25,000 he transferred to criminals.”

Thousands of Covid-19 scams have been reported - here's how to download passes for free 

Cyber crime reporting agency Action Fraud has warned of scammers sending imitation text messages and emails and making phone calls pretending to be from the NHS offering fake vaccine certificates for sale. Action Fraud told us that between May and December 2021, it received over 2,000 reports of Covid documentation-related scams, with the numbers reported tending to increase month-on-month. 

Yet crucially, the NHS Covid Pass, which demonstrates your Covid-19 status either in a digital or paper format, is available for free in England via the NHS App, the NHS website or by calling 119. The NHS will never ask for payment or any financial details for a Covid Pass. Neither will the NHS issue fines or penalties relating to your NHS COVID Pass. See the official NHS website for more info on how to get your pass. 

The Department for Health and Social Care told us it continues to work "closely with law enforcement and partners to tackle online scams, including COVID-19 related fraud".

Covid passes and vaccination status certificates are also free throughout the rest of UK. Applications can be made via the respective countries' websites in Northern Ireland, Scotland and Wales, while residents of Scotland and Northern Ireland also have the option of applying via a free app.

What to do if you think you've been scammed

You can report suspicious messages by forwarding suspect texts to '7726’ and emails to report@phishing.gov.uk. But if you think you've already been scammed, here are the steps to take:

• End all further communication immediately.

• Call your bank directly to report the scam and to cancel any recurring payments set-up by the scammers – for speed and ease, you can call a new 159 telephone hotline. There's no guarantee your bank will reimburse you if you've lost out financially but it should look at each case individually and if you're unhappy with the response you can complain to the free Financial Ombudsman Service. 

• Report the scam to the police through Action Fraud on 0300 123 2040 in England, Northern Ireland and Wales, or report a scam anonymously on its website. With Action Fraud, it doesn't actually look into your individual complaint though - your report will either be referred to your local police force for investigation, or no further action will be taken and your report will simply be held on file for future leads and intelligence. If you're in Scotland, report a scam through Consumer Advice Scotland on 0808 164 6000 or on its website and it will tell you what steps to take next. You can also report scams to Police Scotland on 101.

• If you paid on card, you may be able to get a refund via Section 75 or chargeback.

   You can try Section 75 if you paid for something costing over £100 on credit card, or chargeback if you paid on debit card or on credit card for something costing less than £100. See our Section 75 and chargeback guides for more.

• If you wish to seek further advice, contact Citizens Advice Scams Action via its website, or call its Scams Action helpline on 0808 250 5050. Alternatively, you can contact the Financial Conduct Authority's scams helpline on 0800 111 6768.