Fake NHS e-signature app emails sent using a spoofed admin@business.ro address
An Inverness GP practice warned of fake NHS emails, sent from a spoofed admin@business.ro address, telling patients to download an "NHS e-signature app" and sign in with their NHS number.
- First reported
- Reports
- 1
Source: inverness-courier.co.uk · published
What happened
The Inverness Courier reported on October 13, 2026 that Crown Medical Practice in Inverness warned patients about scam emails pretending to be from the NHS, after NHS Counter Fraud Services was notified by an NHS Scotland health board about a scam email sent to one of its patients.
The sender name contains "NHS noreply", but the emails come from admin@business.ro, which is not an NHS Scotland address. Scammers spoofed or abused that address; business.ro is not their own domain. No one in the Highland area is known to have fallen victim.
How the scam works
The emails carry the NHS logo and a subject line suggesting your local GP is updating its register. They tell recipients to download an NHS e-signature app, sign in with their NHS number, confirm identity details and submit an e-signature.
Completing the fake form puts personal details at significant risk. The practice says it would never ask patients to log into an app to confirm their personal details.
Source
Inverness Courier, "GP practice warns of fraud NHS emails" (October 13, 2026).
Red flags
- An "NHS" email whose actual sender address is not an NHS address.
- Being told to download an app and confirm your NHS number and identity details.
- Messages saying your GP is "updating its register" and needs you to act.
If you were targeted
- 1Do not download the app or reply.
- 2Check any request directly with your GP practice or NHS care provider using contact details you already have.
- 3If you entered details, tell your GP practice and watch for further scam contact.
- 4Report suspicious emails to report@phishing.gov.uk.