When Patients Become the Target of Healthcare Impersonation
Healthcare organisations hold a lot of trust with their patients. That trust carries across the many interactions people have with healthcare services, whether they’re receiving an appointment reminder, accessing test results, managing a prescription, submitting a claim or receiving information about a payment or rebate.
Scammers can take advantage of that trust without ever needing to compromise the healthcare organisation itself. Instead, they can impersonate a healthcare provider, insurer, patient portal or even an individual doctor and create an interaction that looks like it has come from a legitimate source.
And we’re already seeing this happen in very different ways.
Services Australia has warned about scammers impersonating Medicare through text messages and emails about expired cards, account updates and supposed rebates. Bupa Australia has documented scams using its brand across email, SMS and phone calls. In the US, scammers have impersonated the MyChart patient portal using fake messages, websites and login pages. And in the UK, The BMJ documented AI-generated videos using the likenesses of well-known doctors to promote scam health products.
Healthcare impersonation can take many forms
The way healthcare impersonation reaches patients can vary significantly, even when the same organisation is being impersonated.
Bupa Australia’s scam alerts provide a good example. Across 2025 and 2026, Bupa warned about scams using its brand in fake refund offers, health surveys, giveaways and calls about claims or treatment.
In June 2025, Bupa warned that scammers were spoofing some of its phone numbers. The callers discussed claims or treatment details, including claims that could be reassessed, before requesting bank account information.
Other campaigns took a different approach. Fake refund messages directed recipients to malicious links designed to collect financial information or myBupa login details, while a fake health survey sent recipients to a non-Bupa website.
These examples show how the same healthcare brand can be used across very different scams and channels. Across these examples, the initial contact might be an email, SMS or phone call, while the next step can involve a fake website, login page or request for financial information.
Imitating the Patient Experience
Services Australia has warned about Medicare phishing scams claiming that a Medicare card has expired, an account needs to be updated, a service has been suspended or a rebate is available. These messages can direct recipients to click a link, copy a URL or scan a QR code to supposedly resolve the issue or access a payment.
Rather than relying on a completely unexpected scenario, these scams use issues that could reasonably get a Medicare customer’s attention, such as an expired card, account update or rebate.
message
rebate issue
QR code
update details
A more detailed example has appeared in the US with MyChart, the patient portal used by UC Davis Health and many other healthcare systems.
In 2026, UC Davis Health warned that scammers were using the MyChart name and branding across fake emails, text messages, phone calls and websites. Some offered a fake “2026 Medicare Health Kit” before requesting financial information to cover shipping. Others imitated lab result notifications, encouraging patients to click through to supposedly access their results.
What makes the MyChart example particularly relevant is that MyChart itself had not been compromised. Epic said the activity was not the result of a security issue with the platform. Instead, scammers were using the MyChart name and logo to make their own communications and websites appear official.
A patient could therefore encounter what appears to be part of their healthcare experience without the fraudulent interaction ever taking place within the legitimate healthcare platform.
When doctors become the identity being impersonated
The identity being exploited doesn’t always belong to a healthcare organisation or digital service. Scammers can also impersonate the healthcare professionals themselves that patients recognise and trust.
In the UK, The BMJ documented AI-generated videos using the likenesses of well-known doctors, including Hilary Jones, Michael Mosley and Rangan Chatterjee, to promote scam health products on social media. These included products claiming to treat conditions such as high blood pressure and diabetes.
In these cases, it isn’t a patient portal, insurer or healthcare provider being recreated. Instead, the scam uses the identity of a recognisable medical professional to make a product or health claim appear more credible.
This also creates a different challenge for healthcare impersonation. The fraudulent activity can appear across social media accounts and individual pieces of content, and removing one instance doesn’t necessarily mean the activity has disappeared.
Dr Hilary Jones described this problem to The BMJ, explaining that even when impersonating videos were taken down, “they just pop up the next day under a different name.”
Protecting patients beyond your own platforms
Healthcare organisations can secure their websites, portals and systems they control, but many of the impersonation examples we’ve looked at exist outside of those environments. Finding and removing one fake website, account or piece of content also doesn’t necessarily mean the wider activity has been addressed.
The example described by Hilary Jones shows how quickly impersonating content can reappear under a different name. In other cases, what initially looks like an isolated threat may have connections to other domains, websites, social media accounts or infrastructure being used as part of the same activity.
Looking beyond the individual asset can help uncover those connections. Shared infrastructure, registration details, content, contact information and other indicators can provide a clearer picture of the activity targeting an organisation and its patients.
Not every impersonation will be part of a larger campaign. But where connections do exist, identifying them can help organisations understand the wider activity rather than responding to each threat in isolation.
(Unphish’s Campaign Clustering & Intelligence helps identify connections between related threats, providing a clearer view of the wider activity behind individual impersonations.)
This is where visibility beyond an organisation’s own digital environment becomes important. Unphish helps organisations detect phishing, scams and impersonation across external digital channels, investigate the activity behind those threats and take action through enforcement and takedown. Campaign Clustering & Intelligence can also help identify connections between related threats, giving organisations a clearer understanding of activity that may extend beyond the first asset discovered.