TextCheckUK

NHS scam texts: what a real NHS text looks like and how to spot a fake

Checked by TextCheckUK · Last checked · How we check

NHS services are told to text from a sender name you'll recognise, greet you by name, use readable links to trusted sites such as NHS.UK or GOV.UK and avoid link shorteners: those are the NHS service manual's rules for a real NHS text. NHS England Digital describes the NHS App's own text as coming from 'NHSApp' and telling you to open the app, or log in at nhs.uk/inbox, to read a secure message. A text that breaks those rules, or asks for payment or bank details, should be checked without using its link.

Open the scam text checker

What the NHS App text looks like

NHS England Digital's page on messaging in the NHS App describes the text sent to people who have a new message in the app but haven't turned on its notifications. Its site blocks automated access and we could not open the live page on 2 October 2026, so this is from the Internet Archive copy of 13 February 2026, in our words:

  • the sender shows as ‘NHSApp’;
  • it greets you by your first name;
  • it says you have a new secure message from the NHS;
  • it tells you to open the NHS App to read it, or to log in through the NHS website at nhs.uk/inbox.

It doesn't ask you to reply, pay or confirm anything. It only tells you where to read the message: inside the NHS App, which you sign in to with NHS login. If a text that looks like this ever asks for more, open the app yourself rather than using the text.

How NHS services are told to write texts

The NHS digital service manual, updated in August 2026, tells NHS services how to help patients recognise genuine texts. Those rules make a practical checklist:

The NHS's own rules for texts, and how to use them as a check
NHS services are told toSo when you check a text
Use a sender name patients are likely to recognise, and name the service or organisationExpect a name you know, such as NHSApp or your GP practice, not a random number.
Personalise the message with the patient's name and a recognisable sign-offA text with no name, or 'Dear customer', doesn't match.
Refer to something you may know about, such as an appointment or testA test or appointment you never heard of is worth a call to the service.
Link to trusted sites such as NHS.UK or GOV.UKAn unfamiliar web address is a reason to check through the NHS App or the service first.
Make links readable, for example nhs.uk/tests-and-treatmentsYou should be able to see where a link goes before you tap it.
Avoid link shorteners, which patients don't trustA shortened link is not how NHS services are told to write.
Keep personal information, such as your name or NHS number, out of linksA link carrying your details doesn't follow the rules.
From the NHS digital service manual, 'Writing NHS messages' (updated August 2026, © NHS England, Open Government Licence v3.0), read on 2 October 2026.

A fake NHS text, checked against those rules

A fake NHS text, checked against the NHS's own rulesWritten by us. Each mark is a point where it breaks the rules NHS services are given for writing texts, or asks for something an official body won't ask for.
A fake NHS text, checked against the NHS's own rulesWritten by us. Each mark is a point where it breaks the rules NHS services are given for writing texts, or asks for something an official body won't ask for. The message reads: NHS ALERT: you are due a new health check. Confirm your details and pay a [fee] to book at [shortened link]Text message[UNKNOWN NUMBER]NHS ALERT: you are due a new1health check. Confirm yourdetails and pay a [fee] to2book at [shortened link]3

Written by us; not a real message. [fee] and [shortened link] stand in for details we leave out.

  1. 1. No name, no service you know

    NHS services are told to greet you by name, say which service is writing and use a sender name you are likely to recognise. NHS England Digital describes the NHS App's own text as coming from 'NHSApp' and greeting you by first name.

    “personalise your message with the patient's name and a recognisable sign off” (NHS service manual, writing NHS messages, read 2 October 2026)

  2. 2. Details and a payment, by text

    The NCSC reminds people that official organisations never ask you to supply personal information. Booking a check-up does not start with a payment link.

    “Remember, your bank (or any other official organisation) will never ask you to supply personal information.” (NCSC, after your details are exposed, read 2 October 2026)

  3. 3. A shortened link

    NHS services are told to link to trusted sites such as NHS.UK or GOV.UK, with addresses you can read, and to avoid link shorteners.

    “avoid URL shortening services as patients do not trust them” (NHS service manual, writing NHS messages, read 2 October 2026)

Other NHS bodies that text you

The NHS Business Services Authority says members of the NHS Pension Scheme may get texts about their pension queries, such as retirement, transfers or refunds, and that “The text message will be sent from ‘NHSPensions’.” It adds that you will never be asked to dial a premium-rate number, make a payment, or give bank details or other personal information such as login details.

How to check without the link

Check an NHS text without tapping its link

  1. Open the NHS App yourself

    Not from the text: open the app on your phone and look at your messages. The NHS App text NHS England Digital describes only points you there.

    (NHS England Digital, NHS App text messages, checked 2 October 2026 against the Internet Archive copy of 13 February 2026)

  2. Or type nhs.uk/inbox

    NHS England Digital gives this address for logging in through the NHS website. Type it into your browser rather than tapping a link.

    (NHS England Digital, NHS App text messages, checked 2 October 2026 against the Internet Archive copy of 13 February 2026)

  3. Or call the service

    Ring your GP practice or hospital on a number you already have or from its official website, never one from the text.

    (NCSC, how to spot a scam, read 2 October 2026)

From NHS England Digital's description of the NHS App text (Internet Archive copy of 13 February 2026) and the NCSC's advice to use contact details from the official website. Drawn by us.

Report a fake NHS text

  • Forward it to 7726, free on most networks, then delete it.
  • Or take a screenshot and send it to report@phishing.gov.uk, which the NCSC accepts for scam texts.

If you entered details or paid

Call your bank first, on 159 or the number on your card. Then report it to Report Fraud (0300 123 2040), or to Police Scotland on 101. If you tapped the link or installed anything, follow what to do after clicking a scam link.

Paste any text into the scam text checker: it flags links that use "nhs" on a domain that isn't nhs.uk. For an unknown number, try the 6-point number checklist.

Sources

  • NHS England Digital, NHS App text messages: NHS England Digital, 'Notifications and messaging in the NHS App' (the live page blocks automated access and could not be opened on 2 October 2026; checked against the Internet Archive copy of 13 February 2026), summarised in our own words: in the version archived on 13 February 2026, NHS England Digital says people who have not turned on NHS App notifications may get a text about a new NHS App message; it gives the sender as 'NHSApp', and the text greets the person by first name, says they have a new secure message from the NHS and tells them to open the NHS App or log in through the NHS website at nhs.uk/inbox. It does not ask for a reply, a payment or any details. — https://digital.nhs.uk/services/nhs-app/nhs-app-features/notifications-and-messaging-in-the-nhs-app, read on 2026-10-02
  • NHS service manual, writing NHS messages: NHS digital service manual, 'Writing NHS messages', section 'Protecting people from spam and phishing' (updated August 2026; © NHS England): "To access messages in the NHS App, patients need to go through NHS login and prove their identity. ... Do include the name of your service or organisation; reference an event they may be familiar with such as an appointment or test; use a sender name patients are likely to recognise; personalise your message with the patient's name and a recognisable sign off ... If you include links in your text message make sure they: go to trusted sites such as NHS.UK or GOV.UK; are human readable, for example, http://www.nhs.uk/tests-and-treatments; avoid URL shortening services as patients do not trust them; do not contain any personal information such as the patient's name or NHS number" Contains public sector information licensed under the Open Government Licence v3.0. — https://service-manual.nhs.uk/content/writing-nhs-messages, read on 2026-10-02
  • NHSBSA, texts about NHS pensions: NHS Business Services Authority, 'Why have I received a text message from the NHS Business Services Authority (NHSBSA)?': "The text message will be sent from ‘NHSPensions’." Short quote; the rest is summarised in our own words. — https://faq.nhsbsa.nhs.uk/knowledgebase/article/KA-28868/en-us, read on 2026-10-02
  • NCSC, after your details are exposed: NCSC, 'Data breaches: guidance for individuals and families' (published 28 January 2021): "Be alert to suspicious messages (we've published guidance that can help you with this), which may be sent some time after the breach is made public. Remember, your bank (or any other official organisation) will never ask you to supply personal information." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/guidance/data-breaches, read on 2026-10-02
  • NCSC, report a scam text: NCSC, 'Report a scam text' (published 26 November 2021, reviewed 5 September 2022): "By reporting, you can: reduce the amount of scam texts you receive; make yourself a harder target for scammers; protect others from cyber crime online. 40.9K scams removed across 93.3k URLs as of July 2026 as part of the 7726 service. ... You can also take a screenshot or screen recording of the text message and send it to us at report@phishing.gov.uk ... If 7726 doesn't work, you can find out how to report a text message by contacting your phone provider. ... The purpose of a scam text message is often to get you to click a link. This will take you to a website which criminals use to download viruses to your computer, or steal passwords or other personal information." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message, read on 2026-10-02
  • NCSC, how to spot a scam: NCSC, 'How to spot a scam email, text message or call' (published 26 November 2021, reviewed 5 September 2022): "Urgency Are you told you have a limited time to respond (such as 'within 24 hours' or 'immediately')? Criminals often threaten you with fines or other negative consequences. ... If you have any doubts about a message, contact the organisation directly. Don’t use the numbers or address in the message – use the details from their official website." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams, read on 2026-10-02
  • NCSC, forwarding to 7726: NCSC, Report a scam text: "Most phone providers are part of a scheme that allows customers to report suspicious text messages for free by forwarding it to 7726. If you forward a text to 7726, your provider can investigate the origin of the text and arrange to block or ban the sender, if it's found to be malicious." — https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message, read on 2026-09-29
  • Report Fraud: Action Fraud / City of London Police press release, 4 Dec 2025, summarised in our own words: from 4 December 2025 fraud and cyber crime in England, Wales and Northern Ireland are reported to the new Report Fraud service, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040; people in Scotland keep calling Police Scotland on 101. — https://www.wired-gov.net/wg/news.nsf/articles/Report+Fraud+service+goes+live+04122025143000; https://www.reportfraud.police.uk/, read on 2026-09-29

Quotes from GOV.UK, legislation.gov.uk, mygov.scot, the NCSC, the ICO and NHS England are used under the Open Government Licence v3.0; material from Ofcom is Ofcom copyright. Other pages are summarised in our own words or quoted briefly, with a link. How we check.

Frequently asked questions

Does the NHS send text messages?
Yes. NHS services are given rules for writing texts in the NHS service manual, NHS England Digital describes a text from 'NHSApp' for people who have a new NHS App message and haven't turned on app notifications, and the NHS Business Services Authority texts pension scheme members from 'NHSPensions'.
What does a real NHS App text say?
In the version of its page archived in February 2026, NHS England Digital says the text comes from 'NHSApp', greets you by first name, says you have a new secure message from the NHS and tells you to open the NHS App or log in at nhs.uk/inbox. It doesn't ask you to reply, pay or confirm anything.
Is an NHS text with a shortened link a scam?
Treat it with suspicion: the NHS service manual tells NHS services to avoid link shorteners and to link to trusted sites such as NHS.UK or GOV.UK, in a form you can read. Check in the NHS App or call the service on a number you already have.
Will the NHS ask for bank details or a payment by text?
The NCSC says official organisations never ask you to supply personal information, and the NHS Business Services Authority says its texts will never ask you to make a payment or give bank details.
Where do I report a fake NHS text?
Forward it to 7726, free on most networks, or send a screenshot to report@phishing.gov.uk. If you paid or gave details, call your bank first.

More guides

Last updated 2026-10-02. Independent information service. Number data from Ofcom shows the original range holder; numbers can be ported or spoofed. Not affiliated with any organisation named on this page, including Ofcom, the FCA, the ICO, the NHS, DWP, HMRC, TV Licensing, Apple, Google or any police service.