A new patient inquiry usually brings hope: someone needs care, and your practice may be able to help. But a message that starts with ordinary questions can take an unexpected turn, and become a fake patient inquiry scam.
At Virtual Gal Friday, we saw this happen firsthand. I’m sharing the experience because scams targeting healthcare practices can look like routine business, especially when your team is busy responding to patients, managing schedules, and keeping the practice running.
A real experience: scams targeting healthcare practices aren’t always obvious
In September 2025, a mental health practice supported by Virtual Gal Friday received an inquiry from someone who said he was a father arranging therapy for his 19-year-old son.
At first, the questions sounded reasonable. He asked about availability, services, pricing, and the clinician’s experience. Then the conversation shifted toward purchasing numerous therapy sessions upfront and paying by check, rather than following the practice’s usual payment procedures.
The sender said he couldn’t provide credit card information because of previous fraud involving his bank account. A check eventually arrived for the practice owner, who took it to her bank. The bank identified it as fraudulent before it was deposited.
That practice received another communication associated with the inquiry in April 2026. Then, in October 2026, a second mental health practice supported by VGF received a remarkably similar inquiry from the same email address.
Some of the same VGF virtual assistants supported both practices. They recognized the similarities and alerted VGF leadership. That connection helped us recognize the recurring attempt and proactively warn our client base.
Our experience is firsthand. Separately, public reports have described similar approaches targeting therapists. Bitdefender reported on a therapist’s account involving a family member seeking therapy and offering to pay for many sessions upfront.
How a fake-check scam can unfold
A fake-check scam often follows a simple sequence:
- A supposed patient or client asks to book a service.
- They offer to pay a large amount upfront by check.
- The check appears legitimate, and funds may show in the recipient’s account.
- The scammer asks for a partial refund, return of an “overpayment,” or payment to a third party.
- The bank later identifies the check as fraudulent and reverses the deposit.
The key point: funds appearing in your account don’t mean the check has been verified as legitimate. A bank may make funds available before it finishes reviewing the check. If the check later proves fraudulent, the business can lose money it already sent.
The Federal Trade Commission’s guidance on fake-check scams explains why an apparently available balance doesn’t confirm that a check is good. Don’t refund or forward money based on a check, a payment screenshot, or a sender’s assurance. Follow your established payment process and confirm transactions with your bank or payment processor.
It isn’t just a mental health practice problem
A therapy appointment scam can feel personal because it involves a family member seeking help. But fraudsters adapt their story to fit the organization they contact.
Similar scams targeting healthcare practices and other service businesses can reach:
- Physicians, specialists, and medical offices.
- Mental health and wellness providers.
- Law firms and legal professionals.
- Consultants, coaches, and other service providers.
- Small businesses and professional service companies.
A criminal might approach a law firm with a plausible client matter, contact a consultant about a project, or pose as a patient seeking care. The setting changes; the pressure to ignore normal procedures often stays the same.
Other scams that can reach your inbox
Not every scam begins with a new client. Watch for messages aimed at your money, payroll, or business accounts:
- Business email compromise: Someone impersonates an owner, employee, manager, or vendor to request a payment or confidential information. The FBI’s IC3 describes how these schemes can use compromised or spoofed email accounts.
- Payroll and direct-deposit fraud: A message that appears to come from an employee asks payroll to change banking details.
- Fake invoices or purchase orders: A fraudulent notice claims you authorized a purchase or owe an overdue balance.
- Phishing links and attachments: An email impersonates Microsoft 365, DocuSign, Adobe, a bank, or another familiar service to get you to click, download, or enter login details.
- Fake document-sharing requests: A message says someone shared a contract, fax, voicemail, or file, then directs you to a questionable login page.
- Vendor payment diversion: Someone posing as a real supplier asks you to send payment to a new account.
- Refund and overpayment scams: A fraudster sends a payment that appears excessive and asks you to return the difference or pay someone else.
The FBI and HHS joint advisory describes social-engineering tactics targeting healthcare organizations, including attempts to obtain credentials and divert payments. These are practical risks for small offices, not just large institutions.
Red flags for your administrative team
One unusual detail doesn’t always prove fraud. But it should prompt a pause and a check against your procedures.
✅ The request asks you to bypass intake or payment policies.
✅ Someone offers an unusually large advance payment, especially by check.
✅ The sender creates unnecessary urgency or pressure.
✅ They request sensitive financial or account information.
✅ An unexpected attachment or login link appears.
✅ Someone requests a banking change without your usual verification.
✅ The email address, domain, or wording looks slightly different from familiar correspondence.
✅ A familiar contact makes an unusual request, such as changing payment details or asking for confidential information.
Even a message that appears to come from someone you know deserves verification when the request is unusual. An email account can be spoofed or compromised.
Prevention starts with consistent procedures
You don’t need to treat every new inquiry as suspicious. You do need clear steps for unusual requests, and everyone who handles communications or payments needs to know them.
- Train administrative staff to recognize common scams and know whom to notify.
- Set clear payment and refund rules. Don’t make exceptions because a stranger creates pressure.
- Verify banking changes independently. Call a known number or use another trusted channel, not the phone number in the unexpected email.
- Avoid unexpected links and attachments. When in doubt, go directly to the service’s website rather than following an email link.
- Enable multifactor authentication on business email and other important accounts.
- Limit account access to the people and tasks that require it.
- Escalate suspicious requests promptly. A second review can help catch a pattern one person hasn’t seen.
- Make reporting easy. Encourage staff to raise a concern or report a mistake quickly, without fear of blame.
- Keep communication open between leadership, administrative staff, and support professionals.
The CISA phishing guidance recommends staff training, multifactor authentication, and reporting suspicious messages. Those steps work best when your policies make it clear what to do next.
How an attentive administrative team adds awareness
A coordinated administrative team can provide an additional layer of awareness, not a guarantee against fraud, and not a replacement for cybersecurity expertise. A team that understands your procedures can notice when a request doesn’t fit, pause before acting, and bring the concern to the right person.
That’s what happened in our experience. VGF virtual assistants supporting two practices recognized similarities in separate inquiries and raised the issue with leadership. That communication helped us connect the dots and alert clients.
Virtual Gal Friday provides U.S.-based virtual assistant support to healthcare and mental health practices, legal offices, and other businesses. Our assistants learn client workflows and communicate concerns when something seems inconsistent with established procedures. You can learn more about our virtual medical assistant services and support for therapy practices.
Administrative fraud prevention depends on shared attention and clear escalation, not on any one person spotting every threat. Your team can be an important additional line of awareness while your organization maintains appropriate financial and cybersecurity controls.
Frequently asked questions about scams targeting healthcare practices
How can you recognize a fraudulent patient inquiry?
Look for requests that depart from your normal intake or payment process, especially large advance payments by check, pressure to act quickly, overpayments, or requests to refund or forward money. Verify the request and follow your practice’s established procedures.
Can a cashier’s check be fraudulent?
Yes. A cashier’s check can be counterfeit. An initial account credit doesn’t confirm that the check has passed verification. Contact your bank directly and don’t return or forward money based on an apparent payment.
What should you do if you receive a suspicious message?
Pause before clicking, responding, changing account details, or sending money. Verify the request through a trusted, independent channel and alert the person responsible for your practice’s procedures. If money or account credentials may be at risk, contact your bank or service provider promptly and seek appropriate cybersecurity or law-enforcement guidance.
Awareness is one of your best defenses
Scams targeting healthcare practices and other small businesses can reach organizations of any size. Slow down when a request feels unusual. Verify before you act. Educate your team and keep your procedures consistent.
At Virtual Gal Friday, we believe exceptional administrative support goes beyond answering phones, managing schedules, and responding to emails. It also means paying attention, recognizing when something isn’t right, and communicating concerns before they become larger problems.
To learn about administrative support for your practice or business, visit Virtual Gal Friday.
Sources
- Federal Trade Commission: How To Spot, Avoid, and Report Fake Check Scams
- FBI Internet Crime Complaint Center: Business Email Compromise
- FBI and HHS: Social Engineering Tactics Targeting Healthcare and Public Health Entities and Providers
- CISA, FBI, NSA, and MS-ISAC: Phishing Guidance
- Bitdefender: New Client Scam Targeting a Therapist
SEO metadata
- Focus keyword: scams targeting healthcare practices
- SEO title: Scams Targeting Healthcare Practices: Real Signs from VGF
- Meta description: Fake patient inquiries and check scams targeting healthcare practices are rising. Learn the red flags to watch and how clear procedures protect your practice.
- URL slug:
scams-targeting-healthcare-practices - Secondary keywords: fake patient inquiry scam, therapy appointment scam, fraudulent cashier’s check, fake check scam, healthcare fraud prevention, medical office scams, business email compromise, virtual medical assistants, administrative fraud prevention, mental health practice management
- Excerpt: A therapy inquiry can begin with ordinary questions and turn into a fraudulent check attempt. Learn what happened to two VGF-supported practices, what red flags to watch for, and how clear procedures help your team respond.
- Category: Healthcare / Practice Management