Table 2.

Selected correlations between events and cyber-criminal campaigns.

Event date	Event	Incident date & type	Incident
21-02-20,	Doctors warn GPs are running out of PPE;	17-04-20 p,ph,f	Fake PPE offers through email. Link to URLs which capture credit card and other details
09-03-20	Hospitals running out of PPE	27-05-20 p,ph,f
11-03-20	Government announces a range of financial assistance packages in the budget	20-03-20 p,ph,f	Smishing campaign promising a COVID-19 financial relief payment. Respondents are directed to a fake gov.uk website which requests credit/debit card details
19-03-20	Government announces a scheme which entitles children who qualify for a free school meal to a food voucher or alternatives if they are not able to continue attending school.	24-03-20 p,ph,f	A smishing campaign which targeted parents with a promise of help with their free school meals in return for banking details. Banking details are defrauded
23-03-20	Lockdown announced. £60 contravention fine, later (10-05-20) increased to £100	27-03-20 p,e	Lockdown contravention SMS
24-03-20	COVID-19 hardship fund enables councils to reduce council tax bills by £150 for residents of working age and who have had their bill reduced by an award of council tax reduction	15-05-20 p,ph,f	Council tax rebate scam
25-03-20	Government announce intention to make home testing kits available	31-03-20 p,f, 17-04-20 p,f, 27-05-20 p,f	Phishing campaigns in England and Scotland direct victims to fake websites which claim to sell PPE equipment
17-04-20	Government announces job retention scheme	19-04-20 p,f	Fake job retention scheme phishing campaign.