Verify the person before you change the account
Social engineering attacks hit more than a dozen Health-ISAC member organizations in recent months, the group’s chief security officer, Errol Weiss, told Cybersecurity Dive in September 2026. He described the attackers as “pretty belligerent when it comes to getting somebody on the phone.” They want a password or MFA reset, and federal health officials have seen how they get it.
How the attack works
The attacks show a common pattern. The help desk phone rings, and the caller ID shows a local area code. The caller says they work in revenue cycle. Their phone is broken, they explain, so they can’t log in or get their MFA codes.
The agent asks the usual questions. The caller knows the last four digits of the employee’s Social Security number and the corporate ID number. The answers match, so the agent enrolls a new MFA device.
But the caller wasn’t the employee. Attackers likely pulled those details from professional networking sites and past data breaches. Once inside, the attackers targeted payer websites and sent payments to accounts they controlled.
The American Hospital Association warned about the same scheme in January 2024. It said this step defeats MFA, including phishing-resistant MFA. Once the help desk registers an attacker’s phone, the strongest login method works for the attacker.
Why security questions fall short
Security questions are made to test what a caller knows. But HC3’s alert shows attackers can know enough to pass.
Clinical work adds pressure. For instance, a nurse locked out before a shift needs access right away, and help desk agents want to get care teams back to work. A fast reset helps the nurse, but it also helps an attacker posing as that nurse.
A familiar voice won’t settle it, either. The HC3 alert said attackers may use AI voice cloning, which makes remote identity checks harder.
What health systems do now
HC3 and the AHA suggest calling back the number on record, contacting the employee’s supervisor, and training staff to spot impersonation. One large health system now requires employees to show up in person at the help desk for these requests. Arctic Wolf, which in 2025 tracked callers posing as doctors who’d forgotten their passwords, advises agents never to reset a password during an inbound call.
Each step adds a check, and each check has limits. HC3 said attackers may claim they’re too busy to take a callback, while remote and traveling staff can’t always walk to the help desk.
Verify the person before any account change
Go back to that call. This time, before the agent touches the account, the caller gets a link by text or email. To pass, they hold their government ID up to the phone’s camera and take a selfie. Vouched’s visual identity verification checks that the ID is real and that the face in the selfie belongs to a live person who matches the ID photo. Vouched says results come back in under seven seconds.
An attacker with a stolen Social Security number and employee ID still has to show the employee’s face. The agent resets the password or enrolls the new MFA device only after the check passes.
The same check works for an employee calling from home at 6 a.m. or a traveling clinician in another state. Help desk agents want to get care teams back to work fast. A live identity check lets them do that and keep attackers out of the account in the same step.
Patient accounts are targets too
A patient opens an email offering a free “MyChart Medicare kit.” It carries the MyChart name and logo, and one click takes them to a page that asks for personal information. MyChart didn’t send it.
Texas Health warned its patients about these emails and told them to watch for spelling mistakes, odd wording, or an unfamiliar sender. Avera Health, Methodist Health System, Premier Health, and Sentara Health also sent warnings. By Aug. 24, 2026, more than a dozen U.S. health systems had done the same, Healthcare Dive reported.
What scammers collect, and what help desks ask
Phishing pages collect personal information. Some patient help desks verify callers with that same kind of information, such as date of birth, address, the last four digits of a Social Security number, or a recent visit date.
Date of birth also guards self-service recovery. Some patient portals ask for it, along with a code, before a patient can reset a forgotten password.
Hospitals have already watched answers like these fail on the workforce side. In the scheme HC3 described in April 2024, attackers called IT help desks already holding an employee’s corporate ID number and the last four digits of their Social Security number. HC3 said they likely gathered those details from professional networking sites and past breaches. The same alert warned that AI voice cloning makes it harder to judge a caller by voice.
NIST flagged this weakness in 2017. That year, it updated its digital identity guidelines for federal agencies and made clear that knowledge-based verification, the question-and-answer checks described above, should never be the only way to prove who someone is.
Contact changes need a closer look
Epic has told patients that MyChart will never ask them to change the email address or phone number on their account. In the HC3 case, the attacker’s key request was a new MFA device, which sent login codes to a phone they controlled. A request to change a patient’s phone number or email can reroute codes the same way.
Ask the caller to show their face
A patient calls because they can’t get into MyChart. Before the help desk changes anything, the patient gets a link by text or email. They hold a driver’s license or other government ID up to their phone’s camera and take a selfie. Vouched’s visual identity verification checks that the ID is real and that the face belongs to a live person who matches the ID photo.
Once the check passes, the help desk resets the password or updates the account email or phone number. A scammer holding that patient’s date of birth would get stuck at the selfie.
Vouched also works inside MyChart. Through its Epic Toolbox integration, it adds automated identity verification to MyChart account creation and recovery, which Vouched says reduces call center and help desk volume tied to portal access.
Health systems are warning patients about messages that borrow familiar names. Vouched’s verification can be fully white-labeled, so patients see their health system’s brand throughout. Patients who’ve been warned about scams still need a way back into their accounts. Verification under their health system’s name gives them a trusted option and gives the help desk proof of who’s calling.
Request a demo of help desk identity verification for workforce and patient workflows.