Business Email Compromise generated $2.9 billion in reported losses across U.S. organizations in 2023, according to the FBI's Internet Crime Complaint Center (IC3) — more than ransomware, more than data theft, and more than every other cybercrime category except investment and cryptocurrency fraud. Healthcare billing departments are a primary target category for one simple reason: they process large, regular payments through established relationships with entities — Medicare, Medicaid, insurance companies, and payers — that are impersonated convincingly and whose payment processes are standardized enough to be exploited systematically.
This isn't a hypothetical risk. In 2022, the Department of Justice charged ten defendants in a coordinated scheme that spoofed hospital email addresses to redirect payments intended for medical services — successfully diverting more than $11.1 million from five state Medicaid programs, two Medicare Administrative Contractors, and two private health insurers before the operation was uncovered. The mechanism was exactly the one this article describes: convincing impersonation of a trusted payer relationship, followed by a request to redirect payment routing to attacker-controlled accounts. HHS's own Health Sector Cybersecurity Coordination Center has separately warned healthcare organizations about BEC and phishing schemes — including attacks that specifically target IT help desks through social engineering to gain the access needed to redirect automated clearinghouse payments. This is a recognized, active, federally-flagged threat pattern in the healthcare sector, not an edge case.
BEC is a specific, financially-targeted subtype of a broader phishing problem — see Email Security for Home Health Agencies: Stopping the #1 HIPAA Breach Vector for the fuller picture of email-borne threats facing home health agencies beyond payment fraud specifically.
How BEC Attacks Are Constructed Against Home Health Billing
Phase 1: Reconnaissance
Before a BEC attacker sends a single email, they've already invested significant time learning about the organization. LinkedIn profiles reveal who the billing director, billing coordinator, and CFO are. The agency website reveals service area and referral relationships. Job postings reveal what EHR platform is in use, what billing software runs, and what billing processes look like. Public Medicare provider data reveals the provider number and gives context for impersonating Medicare communications. This reconnaissance produces a target profile that makes the subsequent social engineering highly contextual and credible.
Phase 2: Account Compromise or Email Spoofing
BEC attacks execute through one of two mechanisms: compromised email accounts (where the attacker has gained access to a real email account in the billing ecosystem and sends fraudulent messages from it) or email spoofing (where the attacker creates a domain that closely resembles a legitimate domain and sends from it) — the exact technique used in the DOJ Medicare/Medicaid case above, where hospital email addresses were spoofed to request payment redirection. The first mechanism is more dangerous — it's harder to detect because the emails come from a real account with a real history. The second is more common and can be mitigated by DMARC, DKIM, and SPF configuration on the email domain.
Phase 3: The Payment Redirection Request
The attack email arrives from what appears to be a legitimate source — a Medicare contractor, a payer platform, the CFO, or a senior billing administrator. The content is contextually appropriate: it references real provider numbers, real contract identifiers, or real billing scenarios the attacker identified during reconnaissance. The request is time-pressured — "this needs to be processed today" — and discourages verification through a secondary channel. The instruction is to update payment routing information, change a bank account, or redirect a specific payment to a new destination.
Technical Controls That Stop BEC
DMARC at reject policy — prevents external attackers from spoofing the domain to impersonate the CFO or billing director in emails to external contacts; see DMARC, DKIM, and SPF for Home Health Agencies: Stop Email Domain Spoofing Now for exactly how to configure this
Anti-impersonation protection in the email security platform — detects and quarantines emails that impersonate internal executives or known external billing contacts, even when the emails don't come from the organization's domain
Safe Links — rewrites URLs in emails to route through real-time scanning, catching malicious links delivered in BEC preparation emails
External email warning banners — a visual warning on all emails arriving from outside the organization that alerts billing staff the email didn't originate internally, even if it appears to
Policy Controls That Stop BEC
Technical controls address the email delivery mechanism. The payment redirection request itself requires a human decision. Policy controls protect that decision:
Dual-authorization requirement for any change to payment routing information — no single individual can authorize a payment destination change; two named individuals must confirm independently
Mandatory out-of-band verification for payment changes — any request to change payment routing, regardless of apparent source or authority, must be confirmed by calling the requesting party at a pre-established number (not a number provided in the email)
Written payment change request requirement — all payment routing changes are initiated and documented through a formal written process, not email alone
Periodic billing team BEC awareness training with realistic simulations — staff who have practiced identifying and responding to BEC attempts stop them instinctively; staff who have only read about them do not; see How to Respond to a Phishing Email at Your Home Health Agency: The 6-Step Staff Protocol for training content ready to build directly into this program
The 2022 DOJ case is a useful lesson in exactly this: the fraud succeeded at the organizations that redirected payment based on a spoofed email alone. The mandatory out-of-band verification step — picking up the phone and calling a known, pre-established number rather than replying to or acting on the email — is the single control that breaks this attack pattern most reliably, regardless of how convincing the impersonation is.
Closing
If you're ready to protect your home health agency with a cybersecurity partner that actually understands healthcare — not one that learned it from a brochure — start with a free HIPAA Risk Assessment. No obligation, no sales pressure. Thirty minutes with a healthcare cybersecurity expert.
→ Schedule Your Free HIPAA Risk Assessment — https://shieldforce.io/hipaa-assessment
→ Explore Home Healthcare Cybersecurity — https://shieldforce.io/home-healthcare
→ View Transparent Pricing from $35/user/month — https://shieldforce.io/home-healthcare/checkout
→ ShieldForce Advanced Email Security — https://shieldforce.io/shieldforce-email-security-solutions-pricing