Feds Warn Patients, Healthcare Entities of Phishing Scams

U.S. federal authorities are warning the public and healthcare sector organizations of email and fax phishing scams by fraudsters seeking to steal personal information about patients or payments. The warnings come as three large U.S. insurers continue to recover from recent cyberattacks.

See Also: Top 10 Technical Predictions for 2025

The FBI and its Internet Crime Complaint Center in a joint alert issued Friday warned the public about criminals impersonating legitimate health insurers and their investigative team members.

“These criminals are sending emails and text messages to patients and healthcare providers, disguising them as legitimate communications from trusted healthcare authorities,” the FBI said.

“The messages are designed to pressure victims into disclosing protected health information, medical records, personal financial details or providing reimbursements for alleged service overpayments or non-covered services,” the FBI warned.

The U.S Department of Health and Human Services’ Centers for Medicare and Medicaid Services issued a similar warning on Thursday to healthcare sector organizations.

“CMS has identified a fraud scheme targeting Medicare providers and suppliers. Scammers are impersonating CMS and sending phishing fax requests for medical records and documentation, falsely claiming to be part of a Medicare audit,” CMS said.

“CMS doesn’t initiate audits by requesting medical records via fax. Protect your information. If you receive a suspicious request, don’t respond. If you think you got a fraudulent or questionable request, work with your Medical Review Contractor to confirm if it’s real.”

The government warnings come on the heels of recent separate cyberattacks on at least three large U.S. insurance companies – Aflac, Erie Insurance and Philadelphia Insurance Companies, including its Tokio Marine America unit. Each of those companies in their public disclosures about their incidents also warned customers of potential scams involving fraudsters reaching out directly by email and phone calls for information or payments.

As of Friday, each of the three companies were making progress with their recoveries from incidents earlier this month. Each have said their attacks did not involve ransomware encryption but that they were assessing whether information was compromised in the incidents.

Nonetheless, the incidents each disrupted various company operations due to various IT systems being taken offline during incident response.

Experts have said that cybercrime gang Scattered Spider is a prime suspect in the attacks.