The Four Phishing Emails Your Front Desk Will Actually Fall For
Baseline phishing simulations at medical practices routinely return click rates above 30%. The reason is not careless staff — it is that the lures which work look exactly like a normal Tuesday at the front desk.
Lure 1: The payer portal password expiry
An email claiming your insurance payer portal password expires today, with a link to a convincing login page. It works because the deadline is plausible, the workflow is genuinely used daily, and the consequence of ignoring it — blocked claims — feels expensive. Staff click precisely because they are being conscientious.
Lure 2: The urgent refill or records request
A message that appears to come from a patient or referring provider, with an attachment purporting to be a records release or refill authorisation. Clinical staff open attachments from patients all day; that is the job. The defence is process, not vigilance: records requests arrive through a defined channel, and anything outside it gets verified.
Lure 3: The e-fax or voicemail notification
Healthcare still runs on fax, and e-fax notification emails are a near-perfect phishing template — routine, from a system nobody scrutinises, with a link that must be clicked to see the content. Know which e-fax service you actually use and what its notifications look like.
Lure 4: Vendor invoice and banking-change fraud
The highest-value lure, aimed at whoever pays the bills. An existing vendor writes to say their banking details have changed. This one rarely involves malware at all, and it is often preceded by weeks of quiet mailbox access. The only reliable control is procedural: any change of payment details is verified by callback to a number already on file, never a number in the email.
Why annual video training does not move the number
A once-yearly video produces a completion record, not a behaviour change. What moves click rates is frequency, relevance, and immediate feedback. In our engagements the change that matters most is coaching at the moment of the click rather than a report to management a quarter later — that single shift has taken practices from a 34% click rate to around 10% within two quarters.
- →Simulate monthly, with scenarios drawn from the practice's real workflows
- →Coach immediately on click, in under three minutes, with no punitive framing
- →Vary difficulty so the exercise stays honest rather than becoming pattern recognition
- →Track by role — front desk, clinical, and billing face different lures
Measure reporting, not just clicking
Click rate is the metric everyone watches and the less useful of the two. A practice where a suspicious message is reported within four minutes contains incidents faster than one where nobody clicked but nobody spoke up either. Make reporting a single button, thank every report including the false alarms, and never sanction someone for reporting late — only for not reporting at all.
Key takeaways
- 1.The lures that work mirror real clinical and billing workflows, not generic scams
- 2.Banking-change fraud needs a callback procedure, not better email filtering
- 3.Same-day coaching beats quarterly reporting for changing behaviour
- 4.Reporting rate is the leading indicator; click rate is the lagging one