7 phishing scams that target medical offices

Most clinic breaches start the same way: someone on the staff is tricked into clicking, logging in, or paying. Medical offices are prime targets because patient records are valuable, the front desk is busy, and healthcare workers are helpful by nature.

Here are seven patterns clinics see over and over, with the details changed but the tricks real.

1. The gift card favor

"Are you at your desk? I need a quick favor. I'm stuck in a meeting. Can you grab four $200 gift cards for a staff thing? Send me pics of the backs. Keep it quiet for now."

It always claims to be from the owner or a physician, it's always urgent, and it's always secret. No real manager asks for gift cards this way.

2. The vendor bank change

An email that looks like it's from a supplier you really use asks you to update their bank details before paying an invoice. Sometimes the vendor's real account has been hacked, so it looks perfect. Always call the vendor at the number already on file.

3. The fake portal login

"You have a secure message waiting" from an insurer, clearinghouse or EHR portal. The link leads to a perfect copy of the real sign-in page. Get to portals by typing the address or using your bookmark, never through an email link.

4. The "mailbox full" or password expiry warning

"Your mailbox has exceeded its limit. Sign in to keep receiving mail." Same trap, aimed at your email password.

5. The fake IT support call

"This is IT. We're fixing your account. I just sent a code to your phone, can you read it to me?" That's your multi-factor code. Legitimate IT never asks for it.

6. MFA fatigue

A sign-in prompt pops up on your phone again and again when you aren't signing in. Someone has your password and is hoping you'll tap Approve to make it stop. Deny and report.

7. The QR code letter

A letter that looks like it's from a payer or building management says "Scan to update your provider information." QR codes are just links in disguise.

The habit that stops them: stop, look, verify

1. Stop. Urgency is the attacker's tool. Nothing legitimate falls apart because you took two minutes.
2. Look. Check the real sender address (not just the display name), hover over links, and ask whether you expected this.
3. Verify. Confirm through a channel you already trust, like walking over or calling a known number. Never use the contact info inside the message.

And if someone does click: report it immediately. Fast reporting turns a potential breach into a password reset.

Train your whole team in 9 minutes

Our phishing module is free to watch, quiz included. It works well as a quick staff meeting: watch the free module. The full course adds five more modules and a certificate for every staff member.

This article is general information, not legal advice.