Healthcare & Insurance Phishing

How This Attack Works

Attackers impersonate health insurers, Medicare administrators, hospital billing departments, or pharmacy benefit managers. Emails claim a benefit is expiring, a claim was denied, or a payment is overdue — directing victims to fake portals that harvest insurance member IDs, Social Security numbers, date of birth, and payment card details. This data is used for medical identity theft and fraudulent benefit claims.

Red Flags to Watch For

• ✗
  Unsolicited email claiming your insurance card is expiring or benefits are changing
• ✗
  Link goes to a domain that is not the official insurer website
• ✗
  Asks for your member ID, SSN, and date of birth in one form
• ✗
  Urgent language: "Your coverage will lapse in 48 hours"
• ✗
  Legitimate insurers communicate changes via postal mail or secure member portal
• ✗
  Email arrives at the start of open enrollment season — a common timing tactic

Known Malicious Domains

These domains have been associated with this attack. Never click links going to these addresses.

• insurance-benefits-portal.comMALICIOUS
• healthcare-account-verify.netMALICIOUS
• my-health-plan-update.comMALICIOUS
• medical-coverage-alert.netMALICIOUS

Glance automatically blocks emails from domains on this list. Domain list is not exhaustive — attackers register new domains continuously.