Fraudulent Breast-Screening Email Asked Patient for Private Images
NHS Western Isles says a fraudulent message sent after a breast-screening appointment requested photographs or video for assessment. The board says its staff would never ask patients to send such images by email.
The short version
What you need to know
- NHS Western Isles says a patient received a fraudulent email that claimed to be from a healthcare professional and requested photographs or videos after a breast-screening appointment.
- The board says breast-screening services do not use personal or non-NHS email addresses and NHS staff would never ask patients to send photographs or videos by email.
- Verify an unexpected health message through a known NHS number before replying. Anyone who shared information or images should preserve evidence, stop contact and seek police and appropriate support; a VPN cannot authenticate an email sender or recover shared files.
What did NHS Western Isles report?
NHS Western Isles says a patient received a fraudulent email after a breast-screening appointment. The sender claimed to be a healthcare professional and requested photographs or video recordings for assessment.
The health board says the message came from a non-NHS email address. Its warning concerns a reported message to one patient; neither the BBC nor STV report evidence of a wider breach of NHS systems or a mass campaign.
What legitimate breast-screening contact looks like
NHS Western Isles says breast-screening services do not contact patients through personal or non-NHS email addresses. Patients may receive a letter or telephone call about appointments, results or follow-up arrangements, but staff would never ask them to send photographs or videos by email.
An email can copy NHS language, names or visual styling without coming from an NHS service. The sender address is useful evidence, but do not rely on appearance alone: contact the relevant clinic or health board through a number on an existing appointment letter or an official NHS page.
How to respond without increasing the harm
Do not reply, send files, click links or call a number supplied in the suspicious message. Save the original email and its sender details, then verify the request through a separately obtained official contact route. An ordinary scam email can be forwarded to the UK's Suspicious Email Reporting Service at report@phishing.gov.uk, but do not forward private images, sensitive health content or attachments; ask Police Scotland how to preserve that evidence safely.
If you already shared personal information or private images, stop contact and do not pay or negotiate with the sender. NHS Western Isles advises contacting Police Scotland on 101 and seeking appropriate support and advice. Tell the genuine healthcare provider through an official channel so it can give incident-specific guidance.
Why health-related impersonation can be especially coercive
A message linked to screening can create urgency, fear and embarrassment. Those pressures can make an unusual request feel like a necessary clinical step and can discourage a recipient from asking somebody else to check it.
There is no blame in being targeted by a convincing or sensitive scam. Keep copies of messages, avoid redistributing private material as evidence and ask police or a specialist support service how to preserve what investigators need.
Where a VPN helps — and where it does not
A reputable VPN can encrypt network traffic from a supported device, which can reduce what a local Wi-Fi operator or nearby attacker can observe. It does not establish who controls an email account or whether a healthcare request is legitimate.
A VPN cannot recognise every impersonation message, prevent a recipient from voluntarily sending a file, remove an image from a scammer's possession or replace police and safeguarding support. Separate-channel verification is the most important preventive step here.
VPN Rocks view
Healthcare providers should repeatedly tell patients which channels they use and name requests they will never make. A clear rule such as 'we will never ask for photographs or video by email' gives people a practical boundary they can apply under pressure.
Patients should not have to investigate a sensitive request alone. Pausing and calling a known NHS number is not obstructive; it is the correct response to an unexpected message involving health information or private images.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.