Healthcare workers get more phishing emails than almost any other industry. Hackers know you are busy. They know you care about patients. And they use that against you.
This blog lists 10 real phishing scams. Each one has been used against hospitals, clinics, and individual doctors. You will learn how to spot them quickly.
1. The Fake Patient Portal Email
You get an email: "Your patient has sent a new message. Click here to view."
The link goes to a fake login page. The hacker steals your password.
How to spot it: Check the sender’s address. Real patient portals come from a specific domain (e.g., @myclinic.com, not @patient-portal.net).
2. The Fake IT Password Reset
IT Support (fake): "Your password expires today. Click to keep the same password."
How to spot it: Real IT teams never send password reset links by email. You always reset inside the system.
3. The Fake Medical Equipment Recall
An email from a "supplier" says a device you use is recalled. It asks you to download a form.
How to spot it: Call the supplier using a known phone number. Do not use the number in the email.
4. The Fake Payroll Change
HR (fake): "We updated our payroll system. Please confirm your bank details."
How to spot it: Go to your payroll system directly. Do not click the email link.
5. The Fake Urgent Prescription Request
An email that looks like a doctor asks you to approve a prescription quickly.
How to spot it: The email address will have small mistakes: @hosptial.com instead of @hospital.com.
6. The Fake Training Requirement
"Complete mandatory compliance training now. Click here."
The link downloads malware.
How to spot it: Check with your real training department. They do not send random links.
7. The Fake Fax Message
You get an email saying "You received a new fax". The attachment is a virus.
How to spot it: Does your organisation even use fax? Many do not. Call to check.
8. The Fake Colleague Request
An email from a "colleague" asks you to share a patient list quickly.
How to spot it: The writing style might be wrong. Call the colleague to confirm.
9. The Fake Conference Invitation
"You are invited to a free medical conference. Register here."
The registration page steals your login details.
How to spot it: Check the conference website separately. Do not use the email link.
10. The Fake Software Update
"Your electronic health record system needs an update. Download now."
How to spot it: Real updates happen through your IT team. Never download from an email.
How to Stay Safe
Remember one rule: Do not click links from unexpected emails.
If you are unsure, ask someone. Better to be slow than sorry.
Our Phishing Awareness for Healthcare Workers course teaches you how to recognise all 10 scams and more. It is practical and fast.