As public health officials roll out COVID-19 contact tracing programs to help slow the spread of the disease, scammers are finding nefarious ways to use these efforts for their personal gain.

According to the Better Business Bureau (BBB), the way the scam works is a person receives an unsolicited message via text, email, or a social media messenger. The message explains that they’ve come into contact with someone who has tested positive for COVID-19. The message instructs them to self-isolate and provides a link for more information. These links, however, can contain malware that downloads to their device.

Another version of this scam involves a robocall claiming to be part of “contact and tracing efforts.” Again, the call informs you that you’ve been exposed to someone who tested positive for COVID-19. After electing to speak to a representative, the “contact tracer” asks you to verify personal information. This starts with questions about your full name and date of birth, but can quickly move to Personally Identifiable Information (PII) and/or financial accounts. While contact tracers do normally reach out by phone, be sure to hang up if the caller doesn’t meet the guidelines described below.

According to the BBB, these are some tips for distinguishing a real contact tracer from a scam:

Contact tracers will ask you to confirm your identity, but not for financial information. Tracers will ask you to confirm your name, address and date of birth. In most cases, they will already have this information on file. They will also ask about your current health, medical history, and recent travels. They will not ask for any government ID numbers or bank account details.

Contact tracers will identify themselves: The call should start with the tracer providing their name and identifying themself as calling from the department of health or another official team.

Contact tracing is normally done by phone call. Be extra wary of social media messages or texts.

A real contact tracer will never reveal the identity of the person who tested positive. If they provide a person’s name, you know it’s a scam.

Think the link may be real? Double check the URL. Scammers often buy official-looking URLs to use in their cons. Be careful that the link is really what it pretends to be. If the message alleges to come from the local government, make sure the URL ends in .gov (for the United States) or .ca (for Canada). When in doubt, perform a separate internet search for the website.

For more information about scams related to the coronavirus and how to protect yourself from them, see these BBB Tips on COVID-19. To read up on some general tips for avoiding scams, visit BBB.org/AvoidScams.

If you’ve been the victim of a coronavirus related scam, please report it on BBB.org/ScamTracker. Your report can help others to stay alert and avoid similar scams.