Spotting phishing at the front desk
Medical practices are targeted deliberately — you handle money, insurance and identity data, and your staff are trained to be helpful to strangers. Here is what to look for.
Medical practices are targeted deliberately. You process payments, you hold insurance and identity data, and your staff are trained to be helpful to people they do not know. That combination is the point — not bad luck.
What actually arrives at a practice
| The doctor is busy | An email that appears to be from a physician or the practice manager, asking for gift cards, an urgent transfer, or staff payroll details. Often “I’m in clinic, can’t take calls.” The display name is right; the address is not. |
|---|---|
| Changed bank details | A supplier or contractor emails new payment details for an invoice you were expecting. Sometimes sent from a genuinely compromised supplier mailbox, which is why it reads perfectly. |
| Fake login page | “Your mailbox is full”, “verify your account”, a shared document you were not expecting. The link goes to a convincing copy of a Microsoft or Google sign-in page. |
| Fake patient | An enquiry with an attachment — “my referral”, “my insurance card” — that is really a document with a malicious macro or a link. |
| Fake vendor support | A call or email claiming to be your EHR or IT provider, needing remote access or a password to fix an urgent problem. |
How to check, in about thirty seconds
Read the actual address
Not the display name — the address behind it. On a phone you may have to tap the sender to expand it. Look for lookalike domains:
yourpractlce.comwith an L, oryourpractice-billing.com.Hover the link before clicking
The real destination appears at the bottom of the window. If the text says one thing and the destination says another, stop. On mobile, press and hold to preview.
Ask whether you expected it
An invoice you were not waiting for, a document nobody mentioned, a password reset you did not request. Unexpected plus urgent is the signal.
Verify on a channel you already trust
Call the number you already have — never a number in the message. Walk to the doctor’s office. Reply to an older thread rather than this one.
What to do when someone clicks
People will click. What matters is what happens in the next fifteen minutes, and staff must not be afraid to report it.
Say something immediately
No blame. Speed is the only thing that limits the damage, and hesitation is what turns an incident into a breach.
Disconnect if a file was opened
Unplug the network cable or turn off Wi-Fi on that machine. Leave it powered on — do not wipe it — so it can be examined.
Change the password if credentials were entered
From a different device. Change it anywhere else that password was reused, and sign out all active sessions.
Check for mail rules you did not create
Attackers routinely add a hidden forwarding or auto-delete rule so you never see the replies. Check your mailbox rules and forwarding settings.
Call us
Then work out whether patient information was reachable — that question determines whether this is also a HIPAA breach with notification duties.
What actually reduces the risk
- MFA on email. Stolen credentials become far less useful. Single highest-value control — see Password managers and MFA.
- DMARC at enforcement. Stops attackers using your exact domain against your own staff — see SPF, DKIM and DMARC.
- A written rule for payment changes: bank detail changes are always verified by phone on a previously known number. No exceptions, including for the practice owner.
- A no-blame reporting culture. Practices that punish clicking find out about incidents days later.
FAQ
The email came from a real colleague’s address. Is that possible?
Yes — either their mailbox is compromised, or the From address is forged. If your domain is not at DMARC enforcement, forging it is trivial. Verify in person or by phone, and treat their mailbox as suspect until checked.
Is a phishing click automatically a HIPAA breach?
Not automatically. It depends on whether protected health information was actually accessible or acquired. That assessment needs to be made and documented promptly — do not decide informally that it was nothing.
Should we run simulated phishing tests on staff?
They help if framed as practice rather than a trap. Publish the results as a team figure, never name individuals, and pair every test with a short explanation of the tells. Punitive programmes suppress reporting, which is worse than the clicking.