They may ask for personal information, such as address, NHS number, or bank details.
The public is being warned that these calls are not genuine and told that the NHS will never contact patients by phone to demand updates to their records, threaten removal from a GP list, or request personal or financial information.
Patients have been advised to end the call and ring the practice directly if they are unsure whether a call is genuine.
And they have been asked to report suspected fraud to the NHS Counter Fraud Authority at https://cfa.nhs.uk/report-fraud.
Cybersecurity expert Javvad Malik from KnowBe4 said that such scams succeed because they manipulate authority, urgency and emotion – three triggering constructs designed to make victims act before thinking.
‘”GP records” sound legitimate, and when you’re busy, your instinct is to comply rather than challenge,’ said Mr Malik.
He said patients should avoid taking immediate action without checking.
‘Pause and never trust an unsolicited call demanding immediate action. And absolutely never share personal or payment details over the phone from an inbound call,’ he said.
A Management in Practice article by Julie Griffiths
13 November 2025
