Jump to content

Family Member's Business hit by scammers


YGIFS

Recommended Posts

SiL (no pics) has a medical specialty practice in DFW area.  Anyway, somebody got ahold of their digital billing platform and has been sending out fake invoices to people around Texas, and even out of state.  So far one person alerted them and so she has been in touch with VISA.  The other person's card triggered auto-pay and is now contesting $600+ and she is working with that person (hopefully taking my advice and admitting nothing else, who knows how bad their computer security is).  Scammers were wise enough not to include a line item for sales tax, just generic "clinical consult" charge.  They did, however, include wiring/ACH instructions if the payee wanted to pay that way instead of credit card (old school case of wire fraud, Lou!).  I'm sure more are to follow...

-So this isn't a credit card scam so much as a billing scam that uses CC and WF wire (ACH is of course a masked international depositor).  She can't really go to the County DA, can she?  

-Is there some dept. at Sec. of State that handles businesses that want to investigate people passing themselves off as that business?

-She does a lot of Medicare billing, so far neither of the two are on Medicare.  But I assume once that happens, she can into an abyss with Medicare about this?

-Looking for past experiences, best practices, any advice to pass along to her?  I got a quote from our security firm who'll hunt these folks down but it's not worth it at this point (they cost a lot).  I'll deal with referring her to somebody on here who can help shore up their IT security later on.  Right now, she's worried about her reputation and making these people whole again.  

 

THANKS! 

Edited by YGIFS
Link to comment
Share on other sites

I can make the people who did it suffer afterwards.  But I can’t even post a meme on here, no idea a to digitally track down somebody who can mimic their billing system electronically.  I may have made some claims but I have never once pretended to know Jack shit about IT theft/security/etc.  I don’t know even where to go to report something like that, hence my post.  Figured it’s happens before to professional SBOs on here who do electronic invoices for licensed services.  

Link to comment
Share on other sites

Good question.  But no, no EHR attached because the two people fraudulently billed aren't real patients.  One is some out-of-stater that opened the wrong email.  The other is in DFW area, and their bank-issued CC just auto-paid it without blinking.  And then when person personally reviewed paper statements, is rightfully trying to walk it back.  

Link to comment
Share on other sites

2 hours ago, Incredulity said:

No expert, but I have seen this happen with hacked email accounts.

Are you certain the accounting system was compromised?

I would guess it was the email delivery. 

yeah, confused here as to what happened. Did the invoices come out of her system (ie. she can see them in her system) or is this just someone pretending to be her company and sending their own fake looking invoices to people?  (ie. is this a computer security issue or just a fraud issue)

Link to comment
Share on other sites

1 hour ago, MonkeyDoughnut said:

yeah, confused here as to what happened. Did the invoices come out of her system (ie. she can see them in her system) or is this just someone pretending to be her company and sending their own fake looking invoices to people?  (ie. is this a computer security issue or just a fraud issue)

yeah. my bad.  This is all third-hand from wife from her sister.  So to your second point, that's what it looks like now.  Somebody just thought she was an easy mark.  So they're using her logo, address, etc.  But the invoices look pretty similar to hers (then again, how different could they be?).  so they're sending them around via e-mail seeing who'll bite.  I'm guessing 99% went unopened.  One person opened it, phoned in the scam.  Another person's CC somehow paid it (this is where I get confused, never said I was tech-savvy, ever) automatically or maybe some assistant of theirs just saw it and paid it.  But they had to have phoned it in, she's not setup for online pay.  Sounds like that's what happens because her optician remembers a call about it.  

So VISA is cooperating.  As is her online billing system processor (whatever you call it in the medical specialty field, I dunno).  Her question is who does a small business owner go to when somebody is passing themselves off, and billing as such, as their office?  I know law enforcement, but there are now folks in other states calling in about this.  I've never really been part of a business that bills retail consumers directly, I have no idea the recourse.  Is there some dept. at the Sec. of State's office in TX?  FTC for interstate?  I know this happens everyday in Texas, but I only have experience with it in B2B, Third Party vendors, wholesale, etc.  Thanks.   

Link to comment
Share on other sites

9 minutes ago, YGIFS said:

yeah. my bad.  This is all third-hand from wife from her sister.  So to your second point, that's what it looks like now.  Somebody just thought she was an easy mark.  So they're using her logo, address, etc.  But the invoices look pretty similar to hers (then again, how different could they be?).  so they're sending them around via e-mail seeing who'll bite.  I'm guessing 99% went unopened.  One person opened it, phoned in the scam.  Another person's CC somehow paid it (this is where I get confused, never said I was tech-savvy, ever) automatically or maybe some assistant of theirs just saw it and paid it.  But they had to have phoned it in, she's not setup for online pay.  Sounds like that's what happens because her optician remembers a call about it.  

So VISA is cooperating.  As is her online billing system processor (whatever you call it in the medical specialty field, I dunno).  Her question is who does a small business owner go to when somebody is passing themselves off, and billing as such, as their office?  I know law enforcement, but there are now folks in other states calling in about this.  I've never really been part of a business that bills retail consumers directly, I have no idea the recourse.  Is there some dept. at the Sec. of State's office in TX?  FTC for interstate?  I know this happens everyday in Texas, but I only have experience with it in B2B, Third Party vendors, wholesale, etc.  Thanks.   

That sucks... yeah not much can be done... it just happens, but like other suggested I'd contact local law enforcement as quick and can't hurt, but also file a complaint on the FBI's Internet Crime complaint center: https://www.ic3.gov/  

 

  • Like 1
Link to comment
Share on other sites

yeah. my bad.  This is all third-hand from wife from her sister.  So to your second point, that's what it looks like now.  Somebody just thought she was an easy mark.  So they're using her logo, address, etc.  But the invoices look pretty similar to hers (then again, how different could they be?).  so they're sending them around via e-mail seeing who'll bite.  I'm guessing 99% went unopened.  One person opened it, phoned in the scam.  Another person's CC somehow paid it (this is where I get confused, never said I was tech-savvy, ever) automatically or maybe some assistant of theirs just saw it and paid it.  But they had to have phoned it in, she's not setup for online pay.  Sounds like that's what happens because her optician remembers a call about it.  
So VISA is cooperating.  As is her online billing system processor (whatever you call it in the medical specialty field, I dunno).  Her question is who does a small business owner go to when somebody is passing themselves off, and billing as such, as their office?  I know law enforcement, but there are now folks in other states calling in about this.  I've never really been part of a business that bills retail consumers directly, I have no idea the recourse.  Is there some dept. at the Sec. of State's office in TX?  FTC for interstate?  I know this happens everyday in Texas, but I only have experience with it in B2B, Third Party vendors, wholesale, etc.  Thanks.   

The person you contact is the fbi.

It appears all we have happening is scammers are using her NIL (lolz) to develop fake invoices and submit them to random people for payment.

Her systems have not been compromised it seems. However, having her reach out to her vendors is good, as is a security assessment. Depending on what she is using, her having a conversation with a security firm would be a wise next step.

We can take this offline if you want. I led a team in a research project hacking hospitals - we were the first to prove we could kill a patient remotely. So much of security in healthcare is total bullshit.
Link to comment
Share on other sites

Yep.  She took advice and reached out to Sheriff, Tarrant AG, Sec. of State, FBI, and FTC and filed appropriately with all.  I told her it would be a good idea for two reasons to do a security audit of both external billing and internal systems.  One for CYA purposes, another to give other patients that may get wind of this peace of mind.  

I just didn't know where to help her start.  $600 here, $600 there...but eventually your patient base of a few thousand start to get nervous.  Some 80 year old on Medicare who comes in for glasses freaks out and you have a run on stuff.  I know this stuff happens all the time, but...

Link to comment
Share on other sites

I recall some scams in the 90s/00s where people would send many fake invoices to many companies. Most likely 99% would get tossed and only cause wasted time but a few would get paid from lazy clerks/managers or companies with poor controls. 

im not surprised that scammers go after “patients.”  As someone managing an older relative’s medical bills, you get random bills that are most likely legit but you are unsure of the source. My standard practice is to wait for a second bill if I have no idea what it is. 

Link to comment
Share on other sites

3 hours ago, Nice Guy Eddie said:

I recall some scams in the 90s/00s where people would send many fake invoices to many companies. Most likely 99% would get tossed and only cause wasted time but a few would get paid from lazy clerks/managers or companies with poor controls. 

im not surprised that scammers go after “patients.”  As someone managing an older relative’s medical bills, you get random bills that are most likely legit but you are unsure of the source. My standard practice is to wait for a second bill if I have no idea what it is. 

Yep, this was my initial feeling.  They're literally targeting vulnerable populations with poor eyesight.  First two that popped though were under 65 adults.  Though I guess there's some loophole where a small % of disabilities under 65 qualify for Medicare, not Medicaid.  Which I thought was weird.  Anyway, I figure since they got two to bite, they'll start targeting their over 65 patient base which now turns into Medicare fraud.  Which is much more serious, but also much more pervasive.  She started filing the necessary reports yesterday.  Thanks all for the advice.  Again, uncharted territory for us and I certainly have no idea how to track down digital thieves by myself.  I suppose that's why there's a cottage industry around it. 

I'm gonna be bummed out when it's somebody overseas I can't easily locate.  I miss when crimes were face-to-face.  

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...