Fake healthcare messages are no longer rare interruptions. They've become a routine part of how patients experience medical communication. Cybercriminals are increasingly posing as trusted providers through emails, texts, and voicemails, exploiting familiar language and urgent scenarios to deceive patients.

To understand the scope and consequences of this growing threat, Tebra surveyed patients and healthcare professionals to examine how often these scams occur, how people respond, and how prepared practices are to protect patient trust. For private practices, understanding how these scams affect patient behavior is essential to safeguarding communication, minimizing disruption, and maintaining continuity of care.

Scam messages are affecting how patients interpret and respond to reminder workflows and medical communication. To measure real-world behavior, survey respondents were shown a realistic example of a healthcare-related scam message and asked how they would respond if they received it.

If they received a healthcare-related text message, 51% of Americans said they would first search online to check whether the message was legitimate. Nearly half (47%) said they would contact Healthy Blue or Medicaid directly using a phone number or website they trust.

However, more than 1 in 10 said they would take higher-risk actions, such as clicking the link, replying to the message, or attempting to re-enroll or check coverage, underscoring how easily scam messages can prompt engagement before verification.

In the past month alone, more than 1 in 4 Americans have received an average of 3 questionable healthcare messages. This includes nearly one-third of Gen X (30%) and Gen Z (30%), compared to 26% of Millennials and just 14% of Baby Boomers.

On average, Americans reported receiving 5 suspicious healthcare-related messages in a single month. More than 1 in 10 (11%) received 10 or more in a single month, which equates to more than 120 scam messages in a year.

Nearly 1 in 5 Gen Z patients (19%) reported receiving 10 or more suspicious healthcare messages in a month, compared with 17% of Baby Boomers, 13% of Gen X, and 7% of Millennials. This steady exposure increases the likelihood that even cautious patients could eventually engage.

These scams can be quite convincing at first glance. About 1 in 5 Americans (19%) said they initially believed a suspicious healthcare-related message was real when they first received it, and 1 in 10 actually engaged, including calling the number provided.

About 1 in 20 Americans reported losing money to a healthcare-related scam, with losses averaging $2,750. Among those who had received healthcare messages, scam concerns led many (53%) to delay responding to legitimate communication, affecting 83% of Baby Boomers, 67% of Gen Z, 53% of Millennials, and 44% of Gen X.

Scams also had ripple effects across families. Over 2 in 5 Americans (45%) said they know a parent, grandparent, or older family member who has received a healthcare-related scam message. More than 1 in 10 said a close family member lost money or shared sensitive information due to a healthcare-related scam, with losses averaging just under $800.

Scam messages are not only affecting patients. They are creating real operational strain and impacting staffing capacity inside private practices.

Healthcare scams are creating operational strain for practices, often surfacing through patient confusion, increased call volume, and added administrative work for front-desk and clinical teams. Healthcare workers said patients report scam messages after they have already engaged with them (26%), before engaging (16%), or both (22%). These scams have led to patients missing appointments (23%) and delaying care (20%).

Roughly 1 in 5 healthcare workers (22%) said patients frequently report suspicious messages claiming to be from their practice. Twenty-seven percent estimated that they spend 5–10% of their time addressing confusion caused by scams.

Many practices have taken steps to clarify how they communicate with patients. Nearly 3 in 4 healthcare workers (72%) said their practice actively explains how it does and does not communicate with patients, and 3 in 5 said their practice explicitly tells patients which communication methods they will never use.

Even so, most healthcare organizations reported making no changes to patient communication strategies despite rising scam activity. Just 23% reported taking action, while 52% said zero changes have been made. Additionally, 15% said their front-desk or administrative teams are not trained at all to identify or respond to scam-related patient inquiries.

Healthcare-related scams are changing how patients engage with everyday medical communication, creating hesitation around eligibility verification and messages that once felt routine. As the findings show, fraudulent outreach is not only costing some patients money but also leading many to delay or ignore legitimate messages, contributing to missed appointments and disruptions in care.

For private practices, the consequences extend beyond patient trust to daily operations. Scam-related confusion is pulling staff time away from core responsibilities and increasing front-desk strain. By clearly defining communication boundaries, educating patients on what legitimate outreach looks like, and training teams to respond consistently, practices can reduce disruption while reinforcing confidence in their communications as digital engagement continues to grow.

Practices can reduce confusion by clearly explaining how they communicate with patients and which methods they will never use, such as asking for sensitive information via text. Consistent messaging sent through trusted systems, including patient portals connected to the practice's EHR, helps patients recognize what legitimate outreach looks like.

Repeated exposure to fraudulent messages makes patients more cautious, leading some to question or ignore legitimate outreach out of fear. When patients are unsure which messages to trust, important updates about appointments, test results, or billing can be delayed or missed.

Using standardized, recognizable communication channels helps patients feel more confident that messages are coming from their provider. When appointment reminders, follow-ups, and billing notifications follow predictable patterns, patients are less likely to second-guess their authenticity.

Clear protocols for front-desk and administrative teams can help staff quickly address patient concerns about suspicious messages. Centralizing communication through established workflows can also limit the mixed signals that scammers often exploit.

When patients trust and understand how a practice communicates, they are more likely to engage promptly and appropriately. This can lead to fewer clarification calls, fewer missed appointments, and smoother daily operations as digital engagement continues to expand.

Tebra surveyed 500 Americans and 500 healthcare professionals, including physicians, nurses, and front office staff, to understand how cybercriminals exploit patient trust in healthcare communications by quantifying the scale, psychology, and real-world consequences of medical phishing scams. Among  Americans, 9% reported as baby boomers, 32% reported as Gen X, 46% reported as millennials, and 14% reported as Gen Z. 

Tebra, headquartered in Southern California, empowers independent healthcare practices with cutting-edge AI and automation to drive growth, streamline care, and boost efficiency. Our all-in-one EHR and billing platform delivers everything you need to attract and engage your patients, including online scheduling, reputation management, and digital communications.

Inspired by "vertebrae," our name embodies our mission to be the backbone of healthcare success. With over 165,000 providers and 190 million patient records, Tebra is redefining healthcare through innovation and a commitment to customer success. We're not just optimizing operations — we're ensuring private practices thrive.

If you'd like to share these insights, you're welcome to do so for noncommercial purposes. Please link back to Tebra and provide proper attribution.