Phishing That Spoofs Your Health Insurer: Don’t Get Hooked

The email looks like it came from your insurance company. The logo is right. The formatting is clean. It says your claim for a recent medical visit was rejected because you failed to provide proof of eligibility. There is a button to click to “review your account.“ You feel a knot in your stomach. You just had that blood test last week. In a hurry, you click. That is precisely how a phishing attack succeeds.

Scammers build these messages because health insurance matters to you. Between 45 and 64, you deal with deductibles, denied claims, and open enrollment. You are also close enough to Medicare that benefit questions feel urgent. All of that works for the fraudster. They are not trying to trick an expert. They are trying to trick someone who is busy, concerned, and not expecting a con.

The most important rule is to ignore the cosmetics. Anyone can copy a logo. Instead, check the sender’s actual email address. A real message from Blue Cross or UnitedHealthcare will come from a domain the company owns. Look at the characters after the @ symbol. If you see something like @geha.com, fine. If you see @geha-care.org or gmail.com, it is a scam. Scammers register lookalike domains for pennies. Make it a habit to check every time.

Then read the language. Legitimate insurers send dry, formal correspondence. They do not say “Act now to prevent your coverage from being suspended.“ They do not tell you to “confirm your identity within 24 hours” or face a fine. That emergency is a weapon. When an email tells you to act fast or else, stop and think. The real company deals with thousands of members. It does not send ultimatums over email.

Another trick involves attachments. A file named “EOB_Summary.pdf” or “Direct_Deposit_Update.exe” can carry malware. Malware can install itself the moment you open the file. It might log your keystrokes. It might allow a remote operator to reach into your computer. Never open a file you did not expect. Delete the email and call the number on your insurance card. That number is printed for a reason. Use it.

Some phishing goes further and pretends to give good news. “You are eligible for a $250 rebate on your premiums. Click here to claim it.“ No insurer sends unsolicited checks by email. Free money is classic bait. Your instinct to grab a bargain is human, but that instinct is what the scammer feeds on. If an email promises a reward, treat it as poison.

You must also be wary of phishing that asks you to log in. Some emails claim to share a document from a claims adjuster or a secure message from a hospital. Once you log in to a fake portal, you hand over your birth date, Social Security number, and perhaps your bank routing number. The scammer uses that to file tax returns in your name or drain your savings.

What should you do when one of these emails arrives? Do not click any link and do not reply. Report the email to your insurer’s fraud department. Forward it to the Federal Trade Commission at spam@uce.gov. That helps fight the problem for everyone. If you already clicked and entered your information, act immediately. Place a fraud alert on your credit report with one of the three major credit bureaus. Contact your bank to freeze any accounts that might be exposed. Change your passwords on your real insurer’s website. Do not delay even one day.

The age group that falls for these scams respects authority. Health insurers appear as authority. Scammers know you trust official-looking paperwork. They count on that trust. The solution is not paranoia. It is deliberation. Every time a message about your health insurance arrives, take a breath. Open a separate browser tab. Type your insurer’s web address yourself. Log in. Look for an alert or a message in your account portal. If it is not there, the email is fake. That one habit keeps you out of ninety percent of phishing traps.

Take a few seconds of caution. They protect your wallet and your identity. Do not let a cheap imitation email turn a routine claim into a long, expensive fight.