Vaccine phishing: How scammers exploited vaccination rollouts in early 2021

As COVID-19 vaccines began rolling out in early 2021, cybercriminals saw a new opportunity. Demand for appointments far exceeded supply, and millions of people were anxious to get vaccinated. Attackers flooded inboxes with fake vaccine appointment confirmations, fraudulent scheduling links, and counterfeit offers of priority access or proof of vaccination. Just as they had done with stimulus checks and PPE in 2020, attackers adapted to the moment faster than most people could keep up. Here is what organizations and their employees needed to watch for.

The dominant vaccine scam themes

Security researchers documented several recurring themes in early 2021. The most common were: fake vaccine appointment emails that appeared to come from health departments or pharmacies; fraudulent scheduling websites that collected personal and payment information; offers of priority access, early appointments, or vaccine certificates for a fee; and fake emails claiming recipients were eligible for vaccination when they were not. Each theme exploited the same anxiety and scarcity that had made COVID-19 phishing so effective the year before.

Why these scams worked

Vaccine phishing was effective because it tapped into legitimate, urgent behavior. People were genuinely expecting appointment emails. They were genuinely checking eligibility and searching for available slots. Attackers imitated the real communications so closely that the difference was easy to miss, especially for someone who was anxious or in a hurry. The volume of legitimate health and workplace emails also meant that one more email claiming to be about vaccination did not immediately stand out.

Red flags specific to vaccine phishing

The same general phishing indicators applied, but some were especially important in this context. Employees should have been trained to watch for: requests for payment in exchange for a vaccine appointment, since legitimate vaccines were free; emails asking for Social Security numbers, banking details, or other sensitive data to schedule a shot; links that did not match the official domain of the health department or pharmacy; offers of priority access or vaccine certificates for a fee; and any unsolicited email claiming to be about vaccination that arrived from an unusual address. These were strong indicators of fraud.

What employers needed to communicate

Organizations that communicated clearly with employees about vaccine phishing reduced their risk. Employers should have told their people: legitimate vaccine scheduling never asks for payment or banking details; verify any vaccine email through a separate, official channel before acting; do not click links in unsolicited emails, instead navigate directly to the health department or pharmacy website; and report suspicious emails through the established process. A simple, clear message delivered before the scams peaked made a measurable difference.

Training needed pandemic-specific examples

Generic phishing training was not enough. Employees needed examples drawn from the actual scams circulating at the time, because that is what they would encounter. Updating security awareness training to include vaccine phishing, stimulus scams, and other current threats made the training immediately relevant and easier to retain. Organizations that refreshed their training as threats evolved, rather than delivering the same static content year after year, saw better outcomes.

The continuing lesson

Vaccine phishing was not a new kind of attack. It was the same social engineering, applied to a new and highly emotional context. The organizations that handled it best were those that treated security awareness as an ongoing, evolving program, not a one-time event. They warned employees early, updated training with real examples, and kept the reporting channel clear. That approach, repeated every time the threat landscape shifted, was the most reliable defense they had.