COVID-19: Proof of vaccination phishing scam hits the web

Scammers and threat actors are asking people to download their 'proof of vaccination' or vaccine certificates in the latest trend in COVID-19 related phishing attacks.

According to new research from security company Tessian, 22 per cent of citizens in the United Kingdom had received a 'proof of vaccination' phishing email this year. In the United States, this figure rose to 35 per cent, or just over one in three, citizens.

Tessian's analysis of email related to 'proof of vaccination' scams over the past six months revealed that a majority of these scams in the UK saw attackers impersonate the NHS (National Health Service), in an attempt to trick targets into thinking they'd received an email from a legitimate source.

These scams regularly contain official logos, use accurate display names, and correct spellings to look as real as possible. Most emails would, then, redirect the recipient to a website designed to trick them into entering sensitive information such as personal details, credit card or banking details in order to receive their proof of vaccination.

What's more, cybercriminals commonly applied a sense of urgency to their messages, using subject lines that include "IMPORTANT" and "OFFICIAL", before acknowledging repercussions, such as an inability to travel or requirement to quarantine if instructions are not followed.

The purpose of these tactics are to prompt the victim to rush their actions so they don't have much to think about the legitimacy of the email, or the consequences of complying with the request.

"Throughout the pandemic, we've seen cybercriminals leverage COVID-19-related trends as lures in their phishing campaigns," says Charles Brook, threat intelligence researcher at Tessian.

"Now they're capitalising on the uncertainty surrounding vaccination certificates to dupe people into sharing login credentials and personal or financial information," he says.

In New Zealand, CERT NZ is working to put a stop to COVID-19 vaccine scam campaigns and ensure the safe roll out of the COVID-19 vaccine.

"Scammers will use any opportunity to try to trick and manipulate people into giving out their personal or financial details, especially through email and SMS scams," the organisation says.

"One of the best ways to put a stop to scammers is to be aware of the current scams out there."

Brook adds, "In many cases, the emails purporting to come from the NHS look very convincing. Detecting these scams requires everyone to question messages they receive via phone, text or email. If you are unsure whether a text or email is a scam, then assume it is.

"Avoid clicking any links or attachments, or handing over any information until the sender has been verified," he says.

"And remember, the NHS won't charge you for a COVID-19 NHS pass, so any email asking for payment details should be deleted. If you have further questions, go to the official NHS or gov.uk website.