Dental Phishing Attacks: 5 Real Email Patterns

The old stereotype of a phishing email is a badly written message from an unknown sender. Current campaigns are often much more polished. Attackers can spoof display names, register look-alike domains, compromise legitimate mailboxes, copy familiar branding, insert realistic signatures, and time the request around a real business process. The FBI warns that business email compromise frequently works by impersonating a known source and making a request that looks normal, such as a vendor invoice or a change in payment instructions.

Healthcare workflows create especially useful pretexts. Dental practices exchange messages with labs, software vendors, imaging companies, billing services, insurers, accountants, banks, landlords, supply companies, consultants, and professional associations. Staff are also used to secure-document links, password resets, patient communications, portal notifications, PDF attachments, and Microsoft 365 sign-in prompts. A phishing email does not need to invent a strange story when the practice already receives dozens of legitimate messages that look similar.

The practical defense is to train around patterns rather than spelling mistakes. Staff should learn which requests deserve independent verification, which sign-in prompts should never arrive unexpectedly, how to inspect sender addresses, when to stop using the email thread, and how to report a suspicious message without forwarding the malicious content to coworkers.

In September 2025, the American Dental Association warned members about a phishing email that claimed a membership would be suspended unless the recipient updated information through a linked 'payment advice document.' The message imposed a 24-hour deadline. The ADA reported the fraudulent link and the hosting account was disabled.

For a dental office, this pattern can be adapted to almost any trusted organization: an association renewal, insurance credentialing notice, continuing-education portal, supply account, software subscription, or patient-financing service. The attacker combines authority with a believable administrative task and then adds urgency so the recipient acts before checking the request.

Red flags include a threat of immediate suspension, an unfamiliar document-hosting site, a sender domain that is slightly different from the expected organization, or a login page reached from the email instead of the saved portal. The safest workflow is to close the message and navigate to the organization's known website or call a trusted number already on file. Do not use the contact information supplied inside the suspicious email as the verification channel.

HHS's Health Industry Cybersecurity Practices materials describe a healthcare social-engineering scenario in which employees receive a fraudulent email disguised as IT support from a patient billing company. The message tells staff to click a link to change billing-software passwords. The fake page then captures the credentials.

This is an unusually relevant pattern for dentistry because software support is part of normal daily operations. A front-desk employee may genuinely receive notices about a practice-management system, clearinghouse, payment portal, imaging service, patient-messaging platform, or insurance tool. Attackers take advantage of that familiarity. A convincing phish may even refer to a service outage, security update, expired password, or required migration.

Staff should be taught that a password-reset email is not automatically safe because it names the correct vendor. If the reset was not initiated by the user, verify it through the vendor portal or known support number. Managed bookmarks are helpful because they keep users from searching for or clicking through to look-alike login pages. Administrators should also review whether the affected system supports MFA and whether unusual sign-ins, password changes, forwarding rules, or new recovery methods can be detected quickly.

The FBI documents business email compromise scenarios in which a message appears to come from a familiar vendor but provides changed payment information. In some cases attackers spoof a look-alike address; in others they gain access to legitimate email threads and wait for the right moment to insert fraudulent instructions. The request feels routine because the victim already expects an invoice or payment conversation.

Dental practices have many payment relationships that can be exploited this way: laboratories, supply vendors, landlords, equipment companies, consultants, construction contractors, marketing providers, and software vendors. An attacker does not need access to patient data to cause a major business loss if the accounting or office-management workflow allows bank information to be changed from an email alone.

Create a rule that any new bank account, wire instruction, ACH change, mailing-address change, or unusual purchase request must be verified through a second trusted channel. The FBI specifically recommends verifying changes in account numbers or payment procedures with the person making the request. A known phone number from the practice's records is better than replying to the same email thread. High-risk payments can also require two-person approval so one convincing message cannot move money by itself.

Microsoft's Q1 2026 email-threat research documented a sharp rise in QR-code phishing. Between February 23 and 25, 2026, Microsoft observed a campaign that sent more than 1.2 million messages to users at more than 53,000 organizations in 23 countries. The themes included a payment request for a past-due invoice, a credit-hold warning, an important retirement-plan update, a question about a received payment, and a voice-message notification. Attachments led through a fake security check to credential-harvesting pages.

QR phishing is useful to attackers because the victim often moves from the managed workstation to a personal or less-protected mobile device. The email may contain very little text, while the malicious destination is hidden inside an image or PDF. A busy dental employee may scan the code because it looks like a modern way to retrieve a secure message, invoice, voicemail, or document.

Treat an unexpected QR code as a link you cannot inspect easily. Do not scan it simply because the PDF uses a Microsoft, bank, shipping, insurance, or vendor logo. If the message claims there is an invoice, voicemail, account hold, or required document, open the known portal separately. Email-security tools should be configured to inspect image- and attachment-based threats where supported, but staff behavior still matters because attackers continually change delivery formats.

In April 2026, Microsoft observed a large-scale credential-theft campaign targeting more than 35,000 users across more than 13,000 organizations. Healthcare and life sciences represented 19% of the targeted organizations. The campaign used polished 'code of conduct' and disciplinary-review themes, PDF attachments, time pressure, confidentiality language, and a legitimate-brand banner associated with secure healthcare communications. The attack ultimately led to an adversary-in-the-middle phishing flow designed to capture credentials and authentication tokens.

This pattern is dangerous because many traditional phishing heuristics are absent. The message may be grammatically correct, professionally designed, and sent from an authenticated attacker-controlled domain. It may invoke privacy, security, HR, device policy, or an accusation that makes the recipient anxious about delaying a response. A confidentiality statement can make a victim less likely to ask a coworker whether the message is legitimate.

The lesson for dental practices is that branding is not authentication. Staff should be skeptical of unexpected disciplinary, HR, security-policy, payroll, or secure-document messages that demand a sign-in from a link or attachment. For high-value accounts, phishing-resistant MFA such as properly implemented FIDO/WebAuthn can provide stronger protection than approval prompts or manually entered codes because adversary-in-the-middle attacks are designed to capture or relay weaker authentication flows.

Look first at the request. Is the email asking for credentials, a payment change, a new authenticator, sensitive records, a QR-code scan, an urgent download, or an exception to normal procedure? Those are high-risk actions even when the message looks professional. Next inspect the sender address and destination. A display name is easy to imitate, and the FBI notes that criminals often use slight variations in addresses or domains to fool the recipient.

Urgency is another recurring signal. A 24-hour membership deadline, an overdue invoice, a credit hold, an HR accusation, or an account-expiration warning tries to reduce the time available for independent verification. Confidentiality language can serve the same purpose by discouraging the recipient from asking someone else to review the message.

Finally, pay attention to workflow mismatch. If a vendor normally uses a portal but suddenly sends a PDF login, if the dentist never requests gift cards by email, if payroll changes normally require a form, or if IT never asks users to reset passwords through an emailed QR code, that difference matters. Document normal procedures so staff have something concrete to compare against.

Use a separate trusted channel. Call the sender using a phone number saved in the practice's records, open a known bookmark to the vendor portal, contact internal management in person, or start a new message to an address already stored in the directory. Do not reply to the suspicious thread to ask whether it is legitimate, because the attacker may control the mailbox or reply path.

For payment changes, require verification before money moves. For password resets, navigate directly to the service rather than using the email link. For document-sharing notices, open the known application and check whether the document exists there. For unexpected MFA prompts, deny the request and report it rather than approving it to make the notification disappear.

Give staff a simple reporting path that does not require them to diagnose the attack. A 'Report phishing' button, security mailbox, help-desk number, or documented escalation process is enough. The faster IT or the security provider receives the original message details, the faster they can search for similar messages, block malicious senders or destinations, and determine whether anyone interacted with the lure.

Do not wait to see whether anything bad happens. Contact the practice's IT/security provider immediately and preserve the original message. If credentials were entered, reset the password through a trusted path, review MFA methods and recovery settings, revoke active sessions where the platform supports it, and inspect the account for new forwarding rules, delegates, mailbox rules, administrative changes, or suspicious sign-ins.

If money was sent because of a business email compromise, the FBI recommends contacting the financial institution immediately and asking it to contact the receiving institution, then reporting the incident to the FBI's Internet Crime Complaint Center. Speed matters because fraudulent funds can be moved quickly.

If the incident may involve patient information, involve the practice's privacy/security leadership and appropriate legal or compliance advisors. HHS OCR's 2025 PIH Health phishing settlement is a reminder that compromised email accounts can become a HIPAA breach issue when unsecured ePHI is exposed. Whether breach notification is required depends on the facts of the incident and applicable HIPAA requirements, not simply on whether a phishing link was clicked.

Start with controls that support the workflow. Require MFA for email, remote access, cloud administration, backup portals, and other high-impact systems, using phishing-resistant methods where practical. Keep endpoints patched and protected, use modern email filtering, limit local and cloud administrator privileges, and remove old or shared accounts that make attribution difficult.

Next standardize high-risk business processes. Payment changes need out-of-band verification. Password resets should start from known portals. New vendors should be approved through a documented process. Staff departures should trigger immediate account disablement. Remote-support access should use named identities and MFA rather than shared credentials.

Training should be short, frequent, and specific to the practice. Show employees the types of messages they actually receive: lab invoices, insurance notices, software-support requests, payroll messages, patient-communication alerts, cloud-document shares, and professional-association notices. The objective is not to make staff afraid of email. It is to make verification an ordinary part of any request that could expose credentials, patient information, administrative control, or money.

Run a 15-minute exercise using five harmless screenshots or mock messages based on the patterns above. Ask staff what action the email is requesting, what would make the action high risk, and which trusted channel they would use to verify it. Include front desk, billing, management, clinical staff who use email, and anyone who handles purchasing or vendor payments.

Then test the support process. Can a receptionist report a suspicious message without forwarding it to the whole team? Does management know who to call after a payment fraud attempt? Can IT revoke email sessions and review forwarding rules? Does the practice know which critical systems have MFA and which still depend on passwords alone? Those operational details matter more than a one-time annual slide deck.

Dental IT can help South Florida practices review email security, identity controls, MFA coverage, endpoint protection, vendor access, backup readiness, and incident-response workflows as part of a broader cybersecurity program. The goal is a practice where a convincing phishing email can be reported and contained without turning the clinical day into a crisis.