NHS email spoofing or hack? What do I do?

[Mamanchen]

I got a scam email today, claiming I've inherited millions of USD.

It looks as though it's sent from an nhs.net email, and someone with that name is on LinkedIn as working for that hospital. The email also has the standard NHS footer about confidentiality at the bottom.

Has the scammer just spoofed the email address, or is their a chance that a scammer has got access to an NHS email account? If so, do I tell the hospital?

Likely spoofed, most would be someone@wales/england.nhs.uk

[quote Ivy48]Likely spoofed, most would be someone@wales/england.nhs.uk[/quote]
The name/address definitely follows the same format as emails I've received from my local hospital.

Names and places changed, but to show the format, it's e.g. [email protected] and the sender name is KARDASHIAN, Kim (Reality TV Hospital NHS Foundation Trust)

I work for a CCG and all the NHS emails I ever come across are .nhs.uk

so [email protected]

But regardless, why would someone from the NHS be contacting you to say you’ve inherited millions of dollars?

Most definitely a scam!

NHS IT folk would want to know, no idea who you report it to, though.

Have you googled the email addy to see who else has got one and asked about it?

I don't think that was ops question.
Op are you sure that's the email address? Have you looked at email details as it can appear one thing but be another.

Instructions How to report it here:

cits.cornwall.nhs.uk/spam/index.html#:~:text=If%20you%20receive%20a%20spam,please%20see%20our%20guides%20below.

Aren't all nhs emails nhs.net now?

I had an nhs.net email addy, it's legit domain

@Mamanchen

Names and places changed, but to show the format, it's e.g. kim.kardashian*@nhs*.net and the sender name is KARDASHIAN, Kim (Reality TV Hospital NHS Foundation Trust)

That is the standard format for NHS emails. I'd see if you can find the contact details for the IT team at the trust.

@SinkGirl - I thought most had changed now to be just @nhs.net without the trust or CCG name in the address? Although maybe it's regional?

I would inform the IT department but good luck getting through I have been trying for a few days as have no access to add notes

My nhs email is

[email protected]

As are most my colleagues

@SinkGirl

I work for a CCG and all the NHS emails I ever come across are .nhs.uk

so [email protected]

But regardless, why would someone from the NHS be contacting you to say you’ve inherited millions of dollars?

Most definitely a scam!

I know it's a scam!! My OP starts "I got a scam email today"!

My question was whether the scammer had hacked into an NHS employee's email - in which case I should let their employer know!

It's spoofed. Happens a billion times a day. Just delete it. You already know the person's name and job title are on LinkedIn so that's probably where the spoofer got their info from.

Just spoofed most likely. Won't have been sent from the person's email address. Probably their address has been leaked or picked up from someone's inbox by another piece of spam somehow.

I've had emails like this before and it's been because the real person who that email address belongs to has allowed a virus into their emails which then sends out the scam

I'd think that the NHS IT department will know about it by now but you could always message the person Linkedin so they are aware

Report it to the National Cyber Security Centre on [email protected] - they'll sort it out.

Yes, all nhs emails are nhs.net now.

Who knows what’s happened. I get these sorts of emails to my nhs.net address. So I don’t think the NHS cyber security is very strong! Weren’t they still running Windows ME until not very long ago?

Personally, I probably wouldn’t bother reporting, but there’s no harm either.

That’s really weird because at my trusts and CCG they’re still trust name / CCG name then nhs.uk - maybe both work at the moment? Will have to experiment!

I expect it’s just spoofing OP - you should be able to look at the reply to address which may well be different?

It probably depends on whether your trust have migrated over, sinkgirl. Are you using NHSMail2? There are a few trusts that still have an nhs.uk address.

If you know the hospital, they should have someway of contacting their IT department by e-mail or phone so you can let them know.

It was fun when they changed to nhs.net. Instead of a single name, a lot of people had a number added, so instead of ABC.nhs,net you had to put ABC62.nhs.net (my manager was one of 62 of the same name in the country

It's even more fun when the people who aren't using nhs.net names merge trusts/hospitals and keep changing the end of their nhs.uk addresses.