Business Email Compromise generated $2.9 billion in reported losses across U.S. organizations in 2023, according to the FBI's Internet Crime Complaint Center (IC3) — more than ransomware, more than data theft, and more than every other cybercrime category except investment and cryptocurrency fraud. Healthcare billing departments are a primary target category for one simple reason: they process large, regular payments through established relationships with entities — Medicare, Medicaid, insurance companies, and payers — that are impersonated convincingly and whose payment processes are standardized enough to be exploited systematically.
This isn't a hypothetical risk. In 2022, the Department of Justice charged ten defendants in a coordinated scheme that spoofed hospital email addresses to redirect payments intended for medical services — successfully diverting more than $11.1 million from five state Medicaid programs, two Medicare Administrative Contractors, and two private health insurers before the operation was uncovered. The mechanism was exactly the one this article describes: convincing impersonation of a trusted payer relationship, followed by a request to redirect payment routing to attacker-controlled accounts. HHS's own Health Sector Cybersecurity Coordination Center has separately warned healthcare organizations about BEC and phishing schemes — including attacks that specifically target IT help desks through social engineering to gain the access needed to redirect automated clearinghouse payments. This is a recognized, active, federally-flagged threat pattern in the healthcare sector, not an edge case.
BEC is a specific, financially-targeted subtype of a broader phishing problem — see Email Security for Home Health Agencies: Stopping the #1 HIPAA Breach Vector for the fuller picture of email-borne threats facing home health agencies beyond payment fraud specifically.
How BEC Attacks Are Constructed Against Home Health Billing
Phase 1: Reconnaissance
Before a BEC attacker sends a single email, they've already invested significant time learning about the organization. LinkedIn profiles reveal who the billing director, billing coordinator, and CFO are. The agency website reveals service area and referral relationships. Job postings reveal what EHR platform is in use, what billing software runs, and what billing processes look like. Public Medicare provider data reveals the provider number and gives context for impersonating Medicare communications. This reconnaissance produces a target profile that makes the subsequent social engineering highly contextual and credible.
Phase 2: Account Compromise or Email Spoofing
BEC attacks execute through one of two mechanisms: compromised email accounts (where the attacker has gained access to a real email account in the billing ecosystem and sends fraudulent messages from it) or email spoofing (where the attacker creates a domain that closely resembles a legitimate domain and sends from it) — the exact technique used in the DOJ Medicare/Medicaid case above, where hospital email addresses were spoofed to request payment redirection. The first mechanism is more dangerous — it's harder to detect because the emails come from a real account with a real history. The second is more common and can be mitigated by DMARC, DKIM, and SPF configuration on the email domain.
Phase 3: The Payment Redirection Request
The attack email arrives from what appears to be a legitimate source — a Medicare contractor, a payer platform, the CFO, or a senior billing administrator. The content is contextually appropriate: it references real provider numbers, real contract identifiers, or real billing scenarios the attacker identified during reconnaissance. The request is time-pressured — "this needs to be processed today" — and discourages verification through a secondary channel. The instruction is to update payment routing information, change a bank account, or redirect a specific payment to a new destination.