The holiday season brings extra work to care facilities: staffing gaps, family visits, gift deliveries and year-end billing. Criminals know it, and they time their scams accordingly. Distracted staff, short-handed offices and emotional families create ideal conditions for fraud.
Before the busiest weeks arrive, it is worth reminding your team about the scams that most often target healthcare organizations and the people connected to them.
Leaders are often traveling or out of office, so urgent requests seem plausible
Staffing is thin, so verification steps get skipped
Shipping and gift deliveries make fake tracking messages believable
Year-end invoices and renewals create cover for payment fraud
Families are more emotionally responsive to messages about residents
An email or text that appears to come from the administrator or owner asks an employee to buy gift cards for residents or staff, or to handle a quick payment. The sender address may be slightly off, or the account may have been taken over. The message stresses urgency and secrecy.
Defense: Set a rule that money, gift card and payment requests are always confirmed by phone using a known number. No exceptions, even for leadership.
Criminals impersonate vendors and send invoices or notices that bank account details have changed. If the business office pays, the funds disappear.
Defense: Verify any change in payment instructions by calling the vendor at a number you already have on file. Require two people to approve changes to vendor banking details. Check email sender domains carefully.
Messages claiming a package could not be delivered, with a link to reschedule, are common. Links lead to fake login pages or malware.
Defense: Do not click links in unexpected delivery messages. Go directly to the carrier's website or app. Remind staff not to use work computers for personal shopping and tracking.
Callers pose as insurance companies, doctors' offices, government agencies or even resident family members to extract information. Some use urgency, such as a medication emergency.
Defense: Staff should verify the caller's identity and authority before sharing resident information. Use call-back procedures to known numbers, and disclose only the minimum necessary under your policies.
Scammers use holiday giving to send emails, texts or social media requests. Some target staff with fake donation requests that appear to come from coworkers.
Defense: Use official internal channels for fundraising and gift programs, and remind staff to verify before donating.
Older adults and their families may receive calls or messages about fake grandchild emergencies, gift card demands, prize winnings or fake Medicare communications. Facilities often hear about these first.
Defense: Include a short reminder in resident and family communications. Encourage families to verify unusual requests by calling you or the person directly. Offer staff a simple way to report suspicious contacts a resident mentions.
Fake holiday schedules, bonus announcements, benefits enrollment notices and e-card greetings often carry malicious links or attachments.
Defense: Treat unexpected HR, payroll and benefits messages with caution. Confirm through official channels, and do not enter credentials through email links.
Send a short reminder to all staff about the scams above
Re-share how to report suspicious messages
Confirm that multi-factor authentication is on for email and payroll
Make sure someone with authority is reachable for urgent decisions, so staff are not tempted to act on unverified requests
Review who has authority to approve payments, and require dual approval
Post emergency IT contact numbers for holiday weekends
Check that backups are running and that on-call coverage is in place
Speed matters. If a staff member clicks a link, enters a password or sends money, they should tell IT and a supervisor immediately. Passwords can be reset, accounts secured, and banks contacted to attempt to recall payments, but only if the report comes quickly. Reassure staff that early reporting is always welcome.
UnityCare IT helps healthcare organizations strengthen email protection, set up verification procedures and train staff to spot seasonal scams. If you would like a short holiday awareness message for your team, we are glad to help you prepare one.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172