Email fraud protection
Business email compromise protection for medical offices
CloudCentric protects mailboxes for medical, dental and veterinary offices from Charleston to Savannah and helps staff make a habit of verifying payment changes by phone.
Costly message types
Changed account details turn three everyday messages into costly scams
Staff handle invoices, payroll and insurer messages in the same mailbox, making any changed account number a costly scam. A 2018 FBI notice names healthcare among the sectors most affected by payroll diversion.
- 1
Vendor invoice with new bank
Attackers send a standard invoice using new payment instructions or bank details.
- 2
Payroll direct deposit change request
Employees appear to ask for direct deposits sent to a new prepaid card.
- 3
Insurer email asking for refunds
Fake insurer messages pressure staff into sending refunds for alleged overpayments or providing information.
FBI email fraud complaints and HHS record retention periods
Reports count billions in email fraud losses, thousands of payroll complaints and a six-year retention period for security records.
24,768
Business email compromise complaints
FBI IC3 2025 complaints recorded $3,046,598,558 in reported losses.
1,053
Payroll diversion complaints from January 2018 to June 2019
Older FBI figures for January 2018 to June 2019 count $8,323,354 in reported losses and an average loss of $7,904 for these complaints.
6 years
HIPAA Security Rule record retention
HHS says written policies and records of required actions, activities and assessments are kept until six years after the later of the date of creation or the date last in effect.
FBI IC3 2025 report, FBI 2019 public service announcement and HHS.
Medical, dental and veterinary offices: invoices, payroll, insurer messages
Census Bureau 2022 counts show 1,038 physician offices, 558 dental offices and 184 veterinary establishments in six coastal counties from Charleston to Savannah. Most area offices are small.
Pick an office type
Email usage examples
Attackers take over accounts to change payment instructions
Attack steps show attacker actions followed by CloudCentric setups made beforehand. Screenshots display Microsoft documentation with sample data.
Set up beforehand
FBI 2018, 2019 and 2025 public service announcements and Microsoft Learn.
HIPAA Security Rule safeguards connect directly to email security
HHS's summary describes the safeguards as the practice's own obligations, as the rule does not dictate specific measures. CloudCentric sets up technical controls and gives no legal advice.
45 CFR 164.308(a)(5)
Security awareness and training
Required training programs cover all workforce members and management, including Addressable periodic security updates and procedures for protection from malicious software.
Set up
Harmless test phishing messages run as periodic security reminders, relating to training programs.
45 CFR 164.308(a)(5)
Log-in monitoring and password management
Addressable procedures monitor log-in attempts, report discrepancies, and create, change and safeguard passwords.
Set up
Sign-in rules limit logins by location, and multifactor authentication requires more than just passwords, relating to password management safeguards.
45 CFR 164.312(a) and (d)
Authentication and access control
Required unique user identification and person or entity authentication verify persons seeking access are who they claim to be.
Set up
Unique logins and multifactor authentication relate to verifying person or entity authentication.
45 CFR 164.312(b) and 164.308(a)(1)
Audit controls and activity review
Required information system activity reviews cover audit logs, access reports and security incident tracking reports.
Set up
Defender portals follow alerts as incidents and administrators review sign-in and audit logs in Microsoft Entra, relating to activity review and audit controls.
45 CFR 164.308(a)(6)
Security incident procedures
Required procedures identify and respond to suspected or known security incidents, mitigate harmful effects, and document incidents and outcomes.
Set up
Forwarding alerts and impersonation safety tips flag suspicious activity, relating to incident identification.
45 CFR 164.308(a)(1)
Risk analysis and management
Required risk analysis evaluates potential risks and vulnerabilities to protected health information, and risk management reduces them.
Set up
Risk analysis remains a practice obligation, using technical findings CloudCentric supplies about email setup vulnerabilities.
Addressable never means optional. Whether a given office follows Security Rule safeguards remains its own question.
Technical controls limit logins and alert office staff
Technical layers limit what stolen passwords do, warn staff about impersonated domains and disable automatic external forwarding.
Software
See also
Response steps lock compromised accounts and review sent messages
Response work for CloudCentric's own clients follows Microsoft compromised account steps and FBI reporting steps.
Microsoft Learn, HHS and FBI guidance.
Common questions about business email compromise protection
- What is business email compromise and how does it reach a medical office?
Attackers compromise email accounts and send fake vendor invoices, changed payroll direct deposit requests or spoofed insurer emails asking for refunds to conduct unauthorized transfers of funds.
- What can an office manager do today with no software at all?
Call a known number for any changed account instruction, use separate payroll logins, enable multi-factor authentication, and report suspicious requests to HR, following FBI guidance.
- Can CloudCentric stop every fraudulent message?
No filter or rule is perfect, and that is why the callback rule comes first, requiring a phone call to a known number before money moves.
- Does CloudCentric make an office HIPAA compliant?
No. HIPAA duties remain the practice's own. CloudCentric sets up technical controls and gives no legal advice.
- Do Microsoft 365 and Google Workspace both work for these controls?
Both platforms support multifactor authentication and sign-in rules. Microsoft E1, E3 and E5 plans carry forwarding alerts. Attack simulation training requires Microsoft 365 E5 or Defender for Office 365 Plan 2.
- Are veterinary offices and dental offices covered by this work?
Veterinary and dental offices receive the same email and payment-fraud controls because they face the exact same fake invoice and payroll scams.
- What happens when a mailbox is hit and how does work start?
Administrators lock the account, remove any hidden rules the attacker added and review sign-in logs. Call (844) 422-7000 to discuss how we handle compromised mailboxes.
Sources: FBI IC3 2025 Internet Crime Report; FBI IC3 2018 payroll diversion announcement; FBI IC3 2019 business email compromise announcement; FBI IC3 2025 announcement on health insurer impersonation; HHS summary of the HIPAA Security Rule; 45 CFR 164.308; 45 CFR 164.312; HHS OCR Quarter 1 2022 Cybersecurity Newsletter; HHS Breach Notification Rule; Microsoft Learn, respond to a compromised email account.
Secure medical office email against payment fraud
Set up controls blocking automatic forwarding and warning staff about spoofed domains.