Vishing Scams in Dentistry and How Dental Practices Can Stop Social Engineering
A dental office receives an email that looks routine. Another dentist appears to be asking whether a referral and X rays arrived. The name looks legitimate. The signature is professional. Nothing about it screams cyberattack.
Then someone in the office calls the number.
That is where the risk can escalate. A convincing voice answers, discusses the supposed patient, sounds familiar with dentistry, and offers to resend the records through a “secure” or “HIPAA compliant” link. By the time the link arrives, the staff member may no longer view it as suspicious. The conversation has created trust.
This is social engineering. More specifically, it can become callback phishing or vishing, meaning voice phishing. The FBI warns that criminals routinely disguise email addresses, phone numbers, websites, and caller identification to impersonate people or organizations victims already trust. Once credibility is established, the attacker may persuade someone to reveal credentials, send money, disclose protected health information, install remote access software, or open a malicious file.
Dentistry is especially vulnerable because unusual communications are part of normal workflow. Dental teams exchange radiographs, referrals, insurance information, treatment notes, prescriptions, lab cases, payment information, and technology support requests every day. A criminal does not need an exotic story. The best disguise may be something boring enough to look like ordinary dentistry.
The FBI reinforced this point in a 2025 warning about criminals impersonating health insurers and fraud investigators. Attackers used communications that appeared legitimate to pressure healthcare organizations into providing medical records, protected health information, financial information, or payments. In a dental office, a request involving an insurance audit, denied claim, referral, or radiograph may look entirely routine.
The scale of the broader problem is substantial. Verizon’s 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed breaches. In healthcare, it reported 1,438 confirmed breaches. The human element was involved in more than half of healthcare breaches, but that does not mean cybersecurity is simply a staff training problem. Vulnerability exploitation, phishing, stolen credentials, vendor weaknesses, system intrusion, and human error all played meaningful roles.
That distinction matters. A practice could train every receptionist to recognize a fake referral and still remain highly vulnerable if software is unpatched, remote access is poorly secured, passwords are weak, multifactor authentication is missing, backups are unreliable, or outside vendors have excessive access. Cybersecurity works best in layers because every layer can fail.
The most useful rule for a dental office is independent verification. Never authenticate a suspicious communication using information supplied inside that same communication. If an email tells you to call a number, do not rely on that number. If someone claiming to be an insurer asks for records, contact the insurer through a telephone number or secure portal your practice already knows.
This simple rule breaks the psychological chain on which many scams depend. An email creates the reason to call. The phone conversation creates credibility. That credibility makes the next link feel safe. Each step seems to validate the next, even though every step originated with the attacker.
The words “secure,” “encrypted,” and “HIPAA compliant” should never be treated as proof. A criminal can type them as easily as a legitimate dental office can. The same applies to caller ID. The FBI warns that caller identification can be spoofed, so a screen displaying the name of a bank, insurer, dental office, or government agency does not prove who is actually calling.
Even technical clues should be interpreted carefully. In one suspicious dental email, the sender used a domain ending in .dz. IANA identifies .dz as Algeria’s country code top level domain. That is a legitimate red flag when the sender claims to be an American dental office with no apparent connection to Algeria. But it does not prove that the attacker is physically located there. The clue raises suspicion. It does not establish identity.
The same caution applies to VoIP phone numbers. Criminals use Voice over Internet Protocol, but so do millions of legitimate businesses. Reverse phone searches, recycled numbers, and address databases may offer clues, but they are not forensic proof. The dental team’s job is not to become cyber investigators. It is to recognize enough uncertainty to stop and verify.
HHS treats cybersecurity as a patient safety issue. A ransomware attack can do more than create an expensive IT problem. It can remove access to schedules, radiographs, treatment notes, billing systems, communications, and clinical records. Once a practice cannot reliably access the information needed to treat patients, cybersecurity becomes an operational and potentially clinical problem.
That is why HHS, CISA, and the ADA recommend more than awareness training. Dental practices should use multifactor authentication, strong access controls, timely software updates, endpoint protection, restricted remote access, and tested backups that cannot easily be destroyed from the main network. Staff should only have the access they need, and ordinary users generally should not have unrestricted authority to install software.
Backups deserve special attention. A backup that has never been tested, cannot be restored quickly, or remains fully reachable from the production network may fail at exactly the moment it is needed. Recovery should be tested before the emergency.
Practices also need a response plan. If a computer is suspected of being compromised, current HHS and CISA guidance generally favors isolating it from the network and immediately contacting the appropriate IT or security professionals rather than automatically powering it off. Volatile memory may contain useful forensic evidence. The response should be prepared in advance, not improvised during a crisis.
The biggest mistake is believing that a firewall solves a human problem or that staff training solves a technical one. A mature practice assumes that eventually someone may click the wrong thing, answer the wrong call, trust the wrong person, or reuse the wrong password. The system should be designed so one understandable mistake does not become a practice wide disaster.
The essential lesson is broader than “beware of vishing.” Never let trust created in one communication channel authenticate the next. An email does not authenticate a phone call. A phone call does not authenticate a link. A familiar logo does not authenticate an insurer. Trust should come from independent verification and from systems designed to contain mistakes when human judgment fails.
If a convincing stranger called your front desk today, would your team know exactly what not to do?
Join the Conversation!