Beware EU health card salesmen who know all your personal details
SNEAKY websites that charge you to apply for free European Health Insurance Cards have obtained personal details of holidaymakers to lure them into using their services.
The so- called EHIC gives you access to free medical care — or care at the same price as it is offered to locals — in all 28 European countries, including Switzerland, if you fall ill while abroad.
The cards are available free from the NHS, but dozens of websites have sprung up charging travellers up to £35 to apply.
Many of the firms mimic the NHS website to appear official, while other sites claim to make the application easier and speedier by checking it for mistakes.
Now Money Mail has discovered evidence that these firms have obtained holidaymakers’ names, phone numbers, dates of birth and even National Insurance numbers.
Readers say they have received emails from these firms containing application forms with their details already completed.
EHIC applications from Brits hit a five-year high last year, possibly over fears that Brexit could affect our ability to sign up to the scheme.
Experts say your name, age and address can be obtained from publicly available sources, such as the phone book, Land Registry or Companies House.
But the only way an EHIC firm could get hold of someone’s National Insurance number, without asking, is from leaked data from a government department or buying it from hackers on the internet. Graeme Batsman, of data
securityexpert.co.uk, says that the use of personal data is designed to trick you into buying the service more quickly.
‘When firms send you forms that are half filled in with personal details it’s to make you more likely to buy their service or to make them appear a genuine outfit,’ he says.
‘ It easy for your personal information to fall into the hands of undesirables.
‘National Insurance numbers, for instance, are held by many government departments and private companies, so it’s almost impossible to prevent them being leaked.’
Garth Burden, 72, a former deputy managing editor of the Daily Mail, raised the alarm when he received an email warning him that his EHIC was due to expire.
The email, from a firm calling itself EHIC Card, prompted him to ‘kindly renew or apply’ before his card expired in January.
When he clicked on the ‘renew’ button on the email, he was taken to a web page containing an application form.
All of his details, including his National Insurance number, had already been filled out — along with the details for his wife, Jayne, 66, despite neither of them having ever dealt with the firm before.
‘I thought it was an official form until I realised that they were charging for the application. That’s when I knew it wasn’t,’ says Garth.
‘I have no idea how they got that information. The only thing they didn’t seem to have was my bank account details.’
Garth called the firm to find out how it had obtained the information, but he says the person who answered the phone refused to reveal the source. The firm then sent the couple, from Hertfordshire, another two emails and called them again trying to persuade them to use its services. Dozens of sites online have sprung up attempting to persuade more holidaymakers to pay to complete an EHIC application when it simply isn’t necessary. Anyone can get an EHIC card free through the NHS by calling 0300 330 1350 or by visiting ehic.org.uk.
Presently, the EHIC still covers British citizens who travel in any country in the European Economic Area and Switzerland. There is no guarantee this will continue to be the case after Britain leaves the EU.
Technically, private firms that charge for these services aren’t acting illegally unless they pretend to be affiliated with a government body. The company EHIC Card has a London phone number and various different email addresses for applications, customer care, administration, accounts and general information. It has a disclaimer on its home page saying it’s not linked with the NHS.
However, this warning does not appear on its emails or the application form that internet users receive.
The firm is not registered with Companies House and appears to belong to someone called Sachin Kapoor, based in Gurugram, formerly Gurgaon, a city near New Delhi, India, according to WHOIS, online software that shows who owns a website address.
The firm says that it only contacts people who have booked a flight or hotel from its sister company froottrip.com, a package holiday firm in India.
An employee, going by the name of Betty, told Money Mail: ‘We don’t have the details of anyone who hasn’t booked a flight or hotel with us before.’
Initially, the firm could not confirm whether the Burdens were customers, but eventually claimed that they had paid for an EHIC in 2013. The Burdens deny this.
A spokeswoman for the Information Commissioner’s Office, Britain’s data protection watchdog, says: ‘People have a fundamental right to know that their information is handled fairly and lawfully.
‘If anyone has concerns about how their information is being used they can complain to us, calling 0303 123 1113, and we will investigate.’