Not every attack arrives by email. Criminals send text messages, call front desks and leave voicemails designed to look urgent and official. They know that staff in a care setting are busy, caring and inclined to help, and that residents and families may be more vulnerable to pressure. Phishing by text message is often called smishing, and phone-based fraud is called vishing.
This article covers the common scams and what a facility can do about them.
A message arrives from an unknown number claiming to be the administrator or director of nursing, often saying they are in a meeting and need a quick favor, such as buying gift cards or sharing a staff list. The number is new and the request is unusual.
A text or call says there is a problem with direct deposit or benefits and asks the employee to click a link or confirm personal details. The link leads to a fake sign-in page.
Someone calls pretending to be from the helpdesk or a software vendor and asks for a password, a verification code or remote access to a computer. Legitimate technicians do not ask for passwords or one-time codes.
A caller claims to be from an insurance company, pharmacy or supplier and asks for resident information or a change in payment details.
An attacker has already tried to sign in to an account and triggers a verification code. They then message or call the person, asking them to read the code back. Sharing it hands over the account.
Callers who pretend to be a grandchild in trouble, a government agency or Medicare representative
Prize or lottery notices that ask for fees or bank information
Texts pretending to be delivery services or banks with links
Fake charity requests
Staff who know residents well are often the first to notice that something seems wrong, such as a resident suddenly receiving many calls or buying gift cards.
Unknown numbers claiming to be someone you know
Urgency, secrecy or threats
Requests for gift cards, wire transfers or unusual payment methods
Requests for passwords, verification codes or Social Security numbers
Links in text messages, especially shortened links
Callers who refuse to let you hang up and call back
Hang up or ignore the text, and contact the person or organization using a number you already have, not the one provided in the message.
One-time codes are meant for you alone. No real support person needs them.
If the message claims to be from a bank or shipping company, go to the official app or website directly.
Scammers rely on pressure. A pause of a few minutes, or asking a coworker, often reveals the trick.
Tell the supervisor or IT contact, so that others can be warned. Forward fraudulent texts to the carrier's spam reporting number, which is 7726, and report fraud to the Federal Trade Commission.
Make clear in writing that leadership will never request gift cards or credentials by text. Say it in staff meetings.
Publish an approved list of how IT will contact staff, such as an internal ticketing system or a known phone number.
Require a callback to a known number before changing payment or banking details, with two people approving any change.
Provide a clear way to report suspicious calls and texts.
Use multi-factor authentication methods that resist code theft, such as app prompts with number matching or security keys.
Decide on rules for personal phones used for work, including messaging resident information, which should happen only through approved secure tools.
Consider posting simple scam awareness reminders in common areas, and include scam topics in family newsletters or care conferences. Encourage residents to tell a trusted staff member before sending money or sharing information with a caller.
Share real examples of messages in huddles and talk about what makes them suspicious. Rehearse what to say: I will call you back at the number I have on file.
UnityCare IT helps healthcare organizations set up secure messaging, stronger authentication and awareness training that covers phone and text threats along with email. If your staff have received suspicious messages recently, we can help you respond and build a plan.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172