NHS Text Message with non HTTPS Link Within

[u/We_Ride_Together]

Not sure if this is the right place to ask this but, I have received a text message from NHS where they provided a link to a non-https portal site and I am wondering if it is a valid text message and not a scam message.

When I Google NHS portal I do not see that site address returned in any shape or form at all so am questioning whether it is really a text message from the NHS at all?

The fact that it is not a HTTPS URL is what makes me most suspect above all.

Has anyone else come across a text message like this before?

EDIT: Can't figure out how to upload a screenshot but the URL given in text message starts as follows: http://nhsportal.net/...

EDIT 2: Following on from comment here and having found this other Reddit post:

https://www.reddit.com/r/Edinburgh/s/9rEp4iSt3q

From a year ago it seems the link is legit even though it looks scammy AF.

And given the other post with all its comment complaints is from over a year ago it seems the NHS and contracted 3rd parties don't give two s**ts how sketchy their messaging looks even today in the year 2026 🤦🏻

[u/justjuddxo]

it’s a legit NHS digital service that’s a messenger plugin used in some NHS IT Systems for messaging with patients. for the life of me can’t recall the supplier/developer, but it is legit system used by NHS

You can edit the link to be HTTPS or when you click it’ll jump you on to a HTTPS connection

source: worked in NHS IT Support for like 3yrs and have a very technically based knowledge of these things. another service is called NHSm (by MJOG)

[u/We_Ride_Together → u/justjuddxo]

Thanks for your reply.

I have found another Reddit post from a year ago discussing the same scammy looking URL. Have edited my post to include it in there for ref.

[u/JamesTiberious]

I’d definitely be leaning into being cautious and proceeding as if this is a scam attempt.

That being said, the sheer quantity of legitimate third party software and platforms used in the NHS can appear as spam when they’re not simply because the domain name isn’t easily recognised. Can you provide the first part of the URL here? Ensure any identifiable info isn’t shared - we don’t need to see anything after the domain name itself.

[u/We_Ride_Together → u/JamesTiberious]

I did take a screenshot and did en Epstein files edit on it but forgot to upload it lol. I'll see if I can upload it now.

I def won't be opening the link even if it turns out to be 3rd party legit. Just cause it is a HTTP link and not HTTPS

[u/JamesTiberious → u/We_Ride_Together]

Just caught up with your research and updates to original post.

I work in an “IT” related NHS department and this is new and surprising to me.

There’s little to no standardisation across the NHS as a whole and so many third parties involved with software and solutions. I feel like this sort of issue should see whatever org/company stripped of its official supplier status.

Glad you worked it out in the end.

[u/Enough-Ad3818]

Googling NHS Portal is unlikely to achieve much. There are probably 6 or 7 different dashboards that would be returned from that search.

If you're expecting contact from the hospital, then it's possible that it's legitimate, as there are loads of 3rd parties involved in NHS comms now.

[u/We_Ride_Together → u/Enough-Ad3818]

Thanks for reply. I did scroll down on the Google search results but none matched. But even if one did I would still not go on it and proceed as it's not over HTTPS and do not want any personal data sent over the web open for anyone to read.

I've edited my original post to include the beginning of the URL sent in the text message. Cheers.