Fake patient billing emails in Bakersfield medical, dental and vet offices

A patient gets an email that looks like it came from your front desk. It says there is a balance due, or that the insurance company needs a payment to finish a claim. The patient clicks, because it looks like you. This is one of the most common ways scammers go after health offices, and it works because patients trust you.

How a scammer fakes your address

Email was built a long time ago, and it has a weakness. The "from" line is like the return address on an envelope. Anyone can write anything there. A scammer can type your practice's real address, like billing@yourdentaloffice.com, and send a message that appears to come from you.

They did not break into your computer. They never touched your system. They just wrote your name on the envelope.

There are also lookalike addresses. These are real addresses the scammer owns, but they are close to yours, like yourdentaloffice.net or yourdentalofflce.com. Many people do not look that closely, especially on a phone.

Why patients fall for it

Think about how a patient sees it. They really did visit your office. They really might owe a balance, or be waiting on insurance. The email uses your name, maybe your logo, and sounds official.

A few things make it worse in health care:

• Patients expect bills and insurance letters, so one more does not seem strange.
• Many patients are worried or in a hurry, especially after a procedure or a pet emergency.
• People tend to trust a message that mentions a doctor, a dentist, or a clinic they know.
• Older patients may not know that the "from" address can be faked.

The goal is usually to get a card number, a bank login, or a click on a link that installs something bad. It can also be to collect patient details to use in the next scam. Because patient information is involved, this matters for the privacy rules your practice already works under. HIPAA expects reasonable safeguards, so it is worth talking with whoever advises you on compliance.

What the public setup of local practices looks like

You can tell mail servers how to treat mail that claims to be from you. The tool for that is called DMARC. It works with two other settings, SPF and DKIM, which are like a list of who may send for you and a signature that proves a message was not changed.

A DMARC policy tells receiving mail servers what to do with a message that fails those checks: let it through, put it in spam, or reject it.

Here is the honest part. If you have no enforced DMARC policy, that does not mean every fake gets delivered. Many mail services filter some fakes on their own. It means you have not told them to reject fakes that use your exact address, so the decision is left to chance.

In The Bakersfield Cybersecurity Report, made by Mitivanta from the public setup of 4,406 independent Bakersfield businesses on October 18, 2026, 88% of 524 Bakersfield health practices (medical, dental, veterinary, therapy, optometry) had no enforced DMARC policy. Only 7% of the health practices that could be fully checked passed all five basic checks. That is not a sign of careless offices. It is a sign that nobody told them it was on their to do list.

What your practice should set up

You do not need to do this all in a day. Here is a sensible order.

• Find out where you stand. Ask whoever runs your email, or use our free check, to see whether SPF, DKIM and DMARC are set up for your domain.
• List everything that sends email as you. That means your email host, your billing software, your appointment reminder tool, your patient portal, and any newsletter service. Each one needs to be set up properly, or its mail will fail the checks.
• Start DMARC in watch mode. This lets you see who is sending as you without blocking anything. Fix what you find.
• Move to enforcement. Once your real mail passes, change the policy so fakes using your exact address are sent to spam, and later rejected.
• Keep your website updated. In the same report, 35% of health practice WordPress websites that show a version were behind the current WordPress release. An old site is an easy way in, and a hacked site can be used to send convincing mail.

DMARC will not stop lookalike addresses, since those are not your domain

If you would like help with any of this, get in touch or see our pricing. We work with businesses across Bakersfield and Kern County.