Fake SMS messages have been circulating for at least a month which pass themselves off as official communications from the CUP (the Single Healthcare Booking Centre) and which, in reality, represent a dangerous attempt at phishing-type scams, which exploit a delicate context such as the healthcare one. The mechanism of the scam, in a nutshell, is this: an SMS arrives inviting you to urgently contact alleged “CUP offices” for unspecified personal communications, often using vague but, in the eyes of less astute users, sufficiently credible formulations. The message contains numbers that begin with special prefixes, such as 893 or 899. The caller does not actually speak to a CUP operator, but is kept on the line by recorded voices or fake waits which quickly increase the cost of the call, until the telephone credit is completely drained.
The Regions and Local Health Authorities involved have clarified that these SMS do not come from their systems and that the CUP does not use this channel nor these numbers. Recognizing deception means paying attention to formal details, such as incorrect acronyms or anomalous requests, and remembering a basic rule: official health communications only pass through verifiable institutional channels, not through invitations to call paid numbers. In this in-depth study we explain in more detail how to recognize the CUP fake SMS scam and how to defend yourself.
How to recognize the fake CUP SMS scam
Let’s get into the merits of how the scam works. The CUP, correct acronym of Single Booking Centeris an administrative service made available by healthcare facilities to manage appointments, tests and healthcare services. In the fraudulent messages that have circulated in recent weeks, however, the CUP is passed off as the “Single Primary Centre”, a gross error which upon careful reading should already set off the first alarm bells. Another relevant detail of the SMS in question concerns the text of the message, which focuses on urgency and a rather vague content. In the message, in fact, reference is made to «communications concerning you», «important information», «contact urgently». This approach, technically, can be traced back to social engineering, a strategy that consists of manipulating people’s emotional reactions to induce them to take a risky action without thinking.
The risky action we are referring to is the invitation to call numbers that begin with special prefixes, such as 893 and 899. These numbers fall into the category of special rate services, i.e. lines that have a much higher cost per minute or per call than that included in the normal tariff plan. It is therefore not a fraud that steals personal data in the strict sense, but a direct economic scam: the longer you stay online, the higher the charge. Some testimonies tell of recorded voices which, slyly, invite to «wait so as not to lose the acquired priority» or who promise a ride to a doctor, simulating a credible healthcare procedure. In reality, after a few minutes, it is the telephone credit that is reset to zero.
An element that makes these SMS particularly insidious is the coincidence with real situations. Many people who received them were actually waiting for contact to receive reports, post-operative communications, etc. and this has led some of these to lower their attention threshold and believe the message received.
How to protect yourself from the CUP fake SMS scam
What should you do to protect yourself from the CUP fake SMS scam? Just follow these very simple tips.
- Ignore the message: remember that the CUP and regional health facilities do not send SMS asking to call back paid numbers. When you receive a message of this type, therefore, you must not reply, you must not click any links and above all you must not call the number indicated. It is useful to know that the area codes 893 and 899 are a clear and obvious sign of special rate numbers. Don’t call them!
- Block the sender: even if you may receive further SMS from other numbers used by scammers, blocking the one who sent you the message trying to impersonate the CUP will prevent you from using the same number to send you any “reminders”.
- Contact the CUP safely: for any doubts about appointments or healthcare communications, rely exclusively on the official channels of the hospitals for which you are being treated. You may be able to find the correct contact details both in the medical documentation you may already have and online, perhaps by searching on Google for “cup contacts asl (name of your region)” or “cup contacts (hospital name)”.
