Better Business Bureau says public health officials are rolling out COVID-19 contact tracing programs to help slow the spread of the disease by informing people who have had contact with someone who has tested positive. Of course, scammers are finding nefarious ways to use these efforts for their personal gain.

How the Scam Works:

You receive an unsolicited message via text, email, or a social media messenger. The message explains that you’ve come into contact with someone who has tested positive for COVID-19. The message instructs you to self-isolate and provides a link for more information. Alarmed, you are tempted to click and get more details. But don’t fall for it! These links can contain malware that downloads to your device.

Another version of this scam involves a robocall claiming to be part of “contact and tracing efforts.”

Again, the call informs you that you’ve been exposed to someone who tested positive for COVID-19.

After electing to speak to a representative, the “contact tracer” asks you to verify personal information. This starts with questions about your full name and date of birth, but can quickly move to Personally Identifying Information (PII) and/or financial accounts. While contact tracers do normally reach out by phone, be sure to hang up if the caller doesn’t meet the guidelines described below.

How to tell a real contact tracer from a scam:

• Contact tracers will ask you to confirm your identity, but not for financial information .
Tracers will ask you to confirm your name, address, and date of birth. In most cases, they will already have this information on file. They will also ask about your current health, medical history, and recent travels. They will not ask for any government ID numbers or bank account details.
• Contact tracers will identify themselves . The call should start with the tracer providing their name and identifying themself as calling from the department of health or another official team.
• Contact tracing is normally done by phone call. Be extra wary of social media messages or texts.
• A real contact tracer will never reveal the identity of the person who tested positive . If they provide a person’s name, you know it’s a scam.
• Think the link may be real? Double check the URL . Scammers often buy official-looking URLs to use in their cons. Be careful that the link is really what it pretends to be. If the message alleges to come from the local government, make sure the URL ends in .gov (for the United States) or .ca (for Canada).

When in doubt, perform a separate internet search for the website.