Family Member's Business hit by scammers

[YGIFS 19450]

SiL (no pics) has a medical specialty practice in DFW area.  Anyway, somebody got ahold of their digital billing platform and has been sending out fake invoices to people around Texas, and even out of state.  So far one person alerted them and so she has been in touch with VISA.  The other person's card triggered auto-pay and is now contesting $600+ and she is working with that person (hopefully taking my advice and admitting nothing else, who knows how bad their computer security is).  Scammers were wise enough not to include a line item for sales tax, just generic "clinical consult" charge.  They did, however, include wiring/ACH instructions if the payee wanted to pay that way instead of credit card (old school case of wire fraud, Lou!).  I'm sure more are to follow...

-So this isn't a credit card scam so much as a billing scam that uses CC and WF wire (ACH is of course a masked international depositor).  She can't really go to the County DA, can she?  

-Is there some dept. at Sec. of State that handles businesses that want to investigate people passing themselves off as that business?

-She does a lot of Medicare billing, so far neither of the two are on Medicare.  But I assume once that happens, she can into an abyss with Medicare about this?

-Looking for past experiences, best practices, any advice to pass along to her?  I got a quote from our security firm who'll hunt these folks down but it's not worth it at this point (they cost a lot).  I'll deal with referring her to somebody on here who can help shore up their IT security later on.  Right now, she's worried about her reputation and making these people whole again.  

 

THANKS! 

Edited January 9, 2023 by YGIFS

[Incredulity 11674]

22 minutes ago, YGIFS said:

She can't really go to the County DA, can she?  

Why not?

Report to the Police/Sheriff(whichever is most likely to follow up and has jurisdiction)

[royiv 9317]

Is her EHR linked to her billing system?

[conVINCEd 21469]

I thought this was your area of expertise???

[Incredulity 11674]

2 minutes ago, conVINCEd said:

I thought this was your area of expertise???

Isn't that every area?

[YGIFS 19450]

I can make the people who did it suffer afterwards.  But I can’t even post a meme on here, no idea a to digitally track down somebody who can mimic their billing system electronically.  I may have made some claims but I have never once pretended to know Jack shit about IT theft/security/etc.  I don’t know even where to go to report something like that, hence my post.  Figured it’s happens before to professional SBOs on here who do electronic invoices for licensed services.  

[conVINCEd 21469]

5 minutes ago, Incredulity said:

Isn't that every area?

[YGIFS 19450]

I guess we’ll start with DA’s office.  Knew I could count on y’all for solid advice   

[Incredulity 11674]

2 minutes ago, YGIFS said:

electronic invoices for licensed services

No expert, but I have seen this happen with hacked email accounts.

Are you certain the accounting system was compromised?

I would guess it was the email delivery. 

[Native Horn 3504]

Depending upon her medical malpractice insurance carrier, she may be covered for cybercrime.  She needs to check her policy.

[Bevo 13577]

2 hours ago, royiv said:

Is her EHR linked to her billing system?

There are probably HIPAA violations, so she may need to tread lightly. The board frowns upon security breaches.

 

https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/index.html

 

Edited January 9, 2023 by Bevo

[YGIFS 19450]

Good question.  But no, no EHR attached because the two people fraudulently billed aren't real patients.  One is some out-of-stater that opened the wrong email.  The other is in DFW area, and their bank-issued CC just auto-paid it without blinking.  And then when person personally reviewed paper statements, is rightfully trying to walk it back.  

[MonkeyDoughnut 10235]

2 hours ago, Incredulity said:

No expert, but I have seen this happen with hacked email accounts.

Are you certain the accounting system was compromised?

I would guess it was the email delivery. 

yeah, confused here as to what happened. Did the invoices come out of her system (ie. she can see them in her system) or is this just someone pretending to be her company and sending their own fake looking invoices to people?  (ie. is this a computer security issue or just a fraud issue)

[harold 81]

Contact local law enforcement.

[YGIFS 19450]

1 hour ago, MonkeyDoughnut said:

yeah, confused here as to what happened. Did the invoices come out of her system (ie. she can see them in her system) or is this just someone pretending to be her company and sending their own fake looking invoices to people?  (ie. is this a computer security issue or just a fraud issue)

yeah. my bad.  This is all third-hand from wife from her sister.  So to your second point, that's what it looks like now.  Somebody just thought she was an easy mark.  So they're using her logo, address, etc.  But the invoices look pretty similar to hers (then again, how different could they be?).  so they're sending them around via e-mail seeing who'll bite.  I'm guessing 99% went unopened.  One person opened it, phoned in the scam.  Another person's CC somehow paid it (this is where I get confused, never said I was tech-savvy, ever) automatically or maybe some assistant of theirs just saw it and paid it.  But they had to have phoned it in, she's not setup for online pay.  Sounds like that's what happens because her optician remembers a call about it.  

So VISA is cooperating.  As is her online billing system processor (whatever you call it in the medical specialty field, I dunno).  Her question is who does a small business owner go to when somebody is passing themselves off, and billing as such, as their office?  I know law enforcement, but there are now folks in other states calling in about this.  I've never really been part of a business that bills retail consumers directly, I have no idea the recourse.  Is there some dept. at the Sec. of State's office in TX?  FTC for interstate?  I know this happens everyday in Texas, but I only have experience with it in B2B, Third Party vendors, wholesale, etc.  Thanks.   

[MonkeyDoughnut 10235]

9 minutes ago, YGIFS said:

yeah. my bad.  This is all third-hand from wife from her sister.  So to your second point, that's what it looks like now.  Somebody just thought she was an easy mark.  So they're using her logo, address, etc.  But the invoices look pretty similar to hers (then again, how different could they be?).  so they're sending them around via e-mail seeing who'll bite.  I'm guessing 99% went unopened.  One person opened it, phoned in the scam.  Another person's CC somehow paid it (this is where I get confused, never said I was tech-savvy, ever) automatically or maybe some assistant of theirs just saw it and paid it.  But they had to have phoned it in, she's not setup for online pay.  Sounds like that's what happens because her optician remembers a call about it.  

So VISA is cooperating.  As is her online billing system processor (whatever you call it in the medical specialty field, I dunno).  Her question is who does a small business owner go to when somebody is passing themselves off, and billing as such, as their office?  I know law enforcement, but there are now folks in other states calling in about this.  I've never really been part of a business that bills retail consumers directly, I have no idea the recourse.  Is there some dept. at the Sec. of State's office in TX?  FTC for interstate?  I know this happens everyday in Texas, but I only have experience with it in B2B, Third Party vendors, wholesale, etc.  Thanks.   

That sucks... yeah not much can be done... it just happens, but like other suggested I'd contact local law enforcement as quick and can't hurt, but also file a complaint on the FBI's Internet Crime complaint center: https://www.ic3.gov/  

 

[Handcruser 2805]

yeah. my bad.  This is all third-hand from wife from her sister.  So to your second point, that's what it looks like now.  Somebody just thought she was an easy mark.  So they're using her logo, address, etc.  But the invoices look pretty similar to hers (then again, how different could they be?).  so they're sending them around via e-mail seeing who'll bite.  I'm guessing 99% went unopened.  One person opened it, phoned in the scam.  Another person's CC somehow paid it (this is where I get confused, never said I was tech-savvy, ever) automatically or maybe some assistant of theirs just saw it and paid it.  But they had to have phoned it in, she's not setup for online pay.  Sounds like that's what happens because her optician remembers a call about it.  
So VISA is cooperating.  As is her online billing system processor (whatever you call it in the medical specialty field, I dunno).  Her question is who does a small business owner go to when somebody is passing themselves off, and billing as such, as their office?  I know law enforcement, but there are now folks in other states calling in about this.  I've never really been part of a business that bills retail consumers directly, I have no idea the recourse.  Is there some dept. at the Sec. of State's office in TX?  FTC for interstate?  I know this happens everyday in Texas, but I only have experience with it in B2B, Third Party vendors, wholesale, etc.  Thanks.   

The person you contact is the fbi.

It appears all we have happening is scammers are using her NIL (lolz) to develop fake invoices and submit them to random people for payment.

Her systems have not been compromised it seems. However, having her reach out to her vendors is good, as is a security assessment. Depending on what she is using, her having a conversation with a security firm would be a wise next step.

We can take this offline if you want. I led a team in a research project hacking hospitals - we were the first to prove we could kill a patient remotely. So much of security in healthcare is total bullshit.

[YGIFS 19450]

Yep.  She took advice and reached out to Sheriff, Tarrant AG, Sec. of State, FBI, and FTC and filed appropriately with all.  I told her it would be a good idea for two reasons to do a security audit of both external billing and internal systems.  One for CYA purposes, another to give other patients that may get wind of this peace of mind.  

I just didn't know where to help her start.  $600 here, $600 there...but eventually your patient base of a few thousand start to get nervous.  Some 80 year old on Medicare who comes in for glasses freaks out and you have a run on stuff.  I know this stuff happens all the time, but...

[bernorange 8361]

11 hours ago, YGIFS said:

... no idea a to digitally track down somebody ...

You have to backtrace them.

 

Edited January 10, 2023 by bernorange

[YGIFS 19450]

Using the mainframe?  

[bernorange 8361]

Don't forget to enhance.

[Nice Guy Eddie 13512]

I recall some scams in the 90s/00s where people would send many fake invoices to many companies. Most likely 99% would get tossed and only cause wasted time but a few would get paid from lazy clerks/managers or companies with poor controls. 

im not surprised that scammers go after “patients.”  As someone managing an older relative’s medical bills, you get random bills that are most likely legit but you are unsure of the source. My standard practice is to wait for a second bill if I have no idea what it is. 

[YGIFS 19450]

3 hours ago, Nice Guy Eddie said:

I recall some scams in the 90s/00s where people would send many fake invoices to many companies. Most likely 99% would get tossed and only cause wasted time but a few would get paid from lazy clerks/managers or companies with poor controls. 

im not surprised that scammers go after “patients.”  As someone managing an older relative’s medical bills, you get random bills that are most likely legit but you are unsure of the source. My standard practice is to wait for a second bill if I have no idea what it is. 

Yep, this was my initial feeling.  They're literally targeting vulnerable populations with poor eyesight.  First two that popped though were under 65 adults.  Though I guess there's some loophole where a small % of disabilities under 65 qualify for Medicare, not Medicaid.  Which I thought was weird.  Anyway, I figure since they got two to bite, they'll start targeting their over 65 patient base which now turns into Medicare fraud.  Which is much more serious, but also much more pervasive.  She started filing the necessary reports yesterday.  Thanks all for the advice.  Again, uncharted territory for us and I certainly have no idea how to track down digital thieves by myself.  I suppose that's why there's a cottage industry around it. 

I'm gonna be bummed out when it's somebody overseas I can't easily locate.  I miss when crimes were face-to-face.  

[Updawg 2266]

Reset all pass words. Enable Mfa on everything. Look for rules setup on all mailboxes etc.

Sounds like the compromise her patient list at the least potentially

Good to file all those reports