Phishing and scams

Welcome to HIPAA staff training. This is module three: phishing and scams. This is the most important module in the course. Most clinic breaches don't start with a hacker breaking through a firewall. They start with someone on the staff being tricked into opening the door. In about nine minutes you'll learn to spot the tricks and know exactly what to do. Quiz at the end.

What phishing is

Phishing is when a criminal pretends to be someone you trust to get you to click a link, open an attachment, hand over a password, or send money. It comes by email, but also by text message (called smishing), by phone (called vishing), and even by QR code.

Clinics are favorite targets because patient records are valuable, we're busy, and we're helpful by nature. Attackers count on all three.

The warning signs

Almost every scam uses some of the same levers. Learn these and you'll catch most of them:

Urgency or fear. "Your account will be closed today." "Payment overdue, final notice."
Authority. It claims to be from a doctor, the owner, IT, the bank, Medicare or an insurer.
Something unexpected. An invoice you weren't expecting, a shared document you didn't ask for, or a voicemail-to-email you can't place.
A request to log in, pay, or keep a secret. "Don't mention this to anyone yet."
Details that don't quite match. The display name says "Dr. Patel" but the address is a free Gmail account. The domain is off by one letter, like "rn" standing in for "m," or ".co" instead of ".com."

Before you click a link, hover over it, or press and hold on a phone, to see where it really goes. If the address doesn't match who it claims to be from, don't click.

Real examples aimed at clinics

Here are the kinds of attacks clinics actually receive. Details are changed, but the patterns are real.

The gift card favor. A text or email "from" the practice owner: "Are you at your desk? I need a favor. I'm in a meeting and need gift cards for a staff appreciation thing. Buy four $200 cards and send me photos of the backs." It's always urgent and always secret. No real manager asks for gift cards this way.

The vendor bank change. An email that seems to come from a supplier you really use: "We've changed banks. Please update our details before paying the attached invoice." Sometimes the vendor's real email account has been hacked, so the message looks perfect. Always verify bank changes by calling the vendor at the phone number already on file, not the number in the email.

The fake login page. "You have a secure message from your insurance portal" or "Your mailbox is full. Sign in to keep receiving mail." The link opens a page that looks exactly like the real sign-in page. Type your password and the attacker has it. Get to portals by going directly to the site you already use, not through an email link.

The fake IT call. "Hi, this is IT support. We're fixing a problem with your account. I've just sent a code to your phone, can you read it to me?" That code is your multi-factor authentication code, and giving it away hands over your account. Legitimate IT will never ask you for that code. Hang up and report it.

MFA fatigue. Your phone suddenly asks "Approve sign-in?" when you aren't signing in to anything. It might ask again and again. That means someone already has your password and is hoping you'll tap Approve to make it stop. Tap Deny, and report it right away so your password can be changed.

The QR code. A letter or flyer, sometimes made to look like it's from a payer or a building manager, says "Scan to update your provider information." QR codes are just links in disguise. The same rules apply.

The fake records request. An email or fax claiming to be from an attorney or another clinic, asking for records, with a link to "upload them securely." Records requests go through our normal verification process every time.

Stop, look, verify

When anything asks you to click, log in, pay or share, build this three-step habit:

Stop. Urgency is the attacker's tool, so slow down. Nothing legitimate falls apart because you took two minutes to check.
Look. Check the sender's actual address, hover over links, and ask yourself whether you were expecting this.
Verify. Confirm through a channel you already trust: walk over to the person, call the number on file, or type the website address yourself. Never use the contact details inside the suspicious message.

If you clicked

It happens to careful people too. What matters is what you do next.

If you clicked a link, opened an attachment or typed your password somewhere you shouldn't have, report it immediately to the person named in our incident policy. Don't wait to see if anything happens, and don't try to fix it yourself.

Reporting fast lets us reset your password, cut off access, and check whether patient data was touched, often before any harm is done. Nobody gets in trouble for reporting quickly in good faith. Hiding it is what turns a small problem into a big one.

Take one apart

Let's take a phishing email apart, line by line. This one arrived on a Tuesday morning:

From: Provider Services, at an address ending in "summit-healthplan-portal.co" Subject: Action required: three claims suspended

"Three of your recent claims have been suspended pending verification. To avoid payment delays, sign in to the provider portal within 24 hours. Click here to review."

Count the warning signs. First, the sender's address isn't the health plan's real domain. It's a lookalike with extra words and ".co" at the end. Second, urgency: 24 hours, payment delays. Third, money. Claims are something a busy billing person cares about. Fourth, it asks you to sign in through a link. And fifth, it's unexpected: you weren't waiting to hear about suspended claims.

The right move: don't click. Open the real portal from your bookmark, check whether there are any suspended claims, and report the email.

More real scenarios

The fax notification. An email says "You have received a new fax (3 pages)" with a button that says View Document. Your clinic does use e-fax.

That's exactly why it works. Open your fax system directly instead of clicking. If there's no fax waiting, it was phishing.

The direct deposit change. The office manager gets an email that looks like it's from a staff member: "I switched banks. Can you update my direct deposit before Friday's payroll?"

Payroll scams target clinics constantly. Verify in person or by calling the employee on a number you already have, never by replying to the email.

The search ad. You search for your insurance portal, and the top result looks right. It's actually a paid ad leading to a fake sign-in page.

Use bookmarks for the portals you use every day, not search results.

The voice that sounds like the doctor. Your phone rings, and it really sounds like Dr. Martinez: "I'm between patients. I need you to wire a deposit to a new equipment vendor today. I'll explain later."

Criminals can now clone a voice from a short recording. Unusual requests involving money get verified through a known number, even when the voice is familiar. Hang up and call back.

Recap

Watch for urgency, authority, surprises, requests to log in or pay, and details that don't match.
Never give anyone your MFA code, and deny sign-in prompts you didn't start.
Verify bank changes and unusual requests by calling a number you already have.
Stop, look, verify.
If you clicked, report it right away.

That's module three. Take the five-question quiz below. You need four right to pass.