12 ways to stop the hacker who just picks up the phone

The caller says she works in the billing office. Her phone broke, she can't get her login codes and she needs the help desk to set up a new device before the end of the day. She even knows her employee ID and the last four digits of her Social Security number. According to a sector alert from HHS' Health Sector Cybersecurity Coordination Center, calls like that one let attackers enroll their own device in multifactor authentication, log in to payer websites, change the ACH deposit information and route legitimate payments to accounts they controlled.

The phone has become the easiest way in. Health-ISAC told Cybersecurity Dive in September that more than a dozen member organizations had been hit by social-engineering attacks in a couple of months, including voice-phishing campaigns tied to the ShinyHunters group. AI voice cloning makes the caller harder to doubt. Meanwhile, two-thirds of Medicare and Medicaid payers surveyed by the HHS Office of Inspector General said they had been targeted by schemes to divert provider payments through bogus bank account changes.

Most practices aren't ready. Just 19 percent of medical group leaders told an MGMA Stat poll they were very confident they could recover quickly from a cyberattack. The good news is that stopping a phone scam takes process more than software. Here are 12 places to start.