Is this a medical billing spear phishing attempt?

Question

Background info: I recently had a nasal swab sent off during a doctor's appointment, and I've already paid the small Labcorp bill. My medical insurance is not Blue Shield.

I got this text message last week:

Greetings!

This is Herbie from Flowhealth’s Patient Billing Department.

This message is MYFIRSTNAME MYLASTNAME. Our office has been informed by Blue Shield of California that a check was mailed to you for Covid Test (PCR Nasal Swab) services rendered by our laboratory. Please call Patient Call Center Billing Department at (855)551-3789 so we can discuss the complete details.

We are looking forward to hearing from you.

Thank you. Flowhealth Laboratory/Signal Diagnostics LLC

I immediately suspected a scam (weird phrasing, asking for a call, different lab, and strange setup about a check getting mailed to me) - but they did have my correct name; the phone number is listed on the website of Flowhealth, which seems to be a real medical company (or an unusually well-constructed scam site); and I did get a nasal swab recently. Note that the text message came from a different number.

I also got an email! (Which my email provider marked as "Possible Virus".) It has several PDFs attached, which I haven't opened.

Hi Myfirstname,

I'm Herbie from the Patient Billing Department at Flow Health Laboratory. We are the laboratory responsible for analyzing your sample from a past COVID test.

You may have noticed that as an out-of-network laboratory, insurance checks often land directly in the hands of patients like yourself. This process is essentially your insurance's approach to handle payment for the services Flow Health Laboratory provided. Given this, the check you received by your insurance is payment for our services, and I'm reaching out to assist you with the next steps on how to settle this.

I have attached a document to this email that will provide you with more information about the check that was sent to you from your insurance. Please note, the protection and confidentiality of your patient data is of paramount importance to us. Therefore, for security measures, the attached document is password protected. In order to gain access to it, please use the following password sequence: Patient’s Full Last Name, Initial of Patient’s First Name, Patient’s Date of birth. For example, if the patient’s name is Ella Sape, and the date of birth is March 1, 2023, the password sequence would be the following: SapeE_030123. Please note the password is case sensitive.

If any part of this process seems unclear or if you have questions, please don't hesitate to get in touch. We're here to assist!

Should you have any questions, please don't hesitate to call us at (855) 551-3789 or send us an email at patientbilling@flowhealth.com.

Best Regards,

Herbie Bernardino

So:

• Is this actually real, with this strange misdirected-check setup? Why would the company need me to call, and why would communications be from a different lab company and insurance company? How can I verify it?
• If this is a scam, should I be concerned that the scammers have my full name, phone number, email, and medical info (recent swab)? Is the scam's goal money (from this "check in the mail") or getting more personal info, like birth date? How should I proceed?
• What should I do if I actually do receive a check in the mail?

Answer 1

You handled this well to start off. Don't open any attachments or links and verify any email/phone on the actual website. Probably best to investigate with insurance first before you reach out to "Flow Health".

1. Check your Explanation of Benefits (EOB) document for the claim submitted by the lab. Verify the total cost, amount paid by insurance, and the amount you paid. Everything should add up (e.g. $100 charged, insurance paid $85 and you paid $15). The EOB might even give you an address where they sent the check.
2. Call your insurance and make sure there are no more pending claims for the lab work. Also verify where they sent any payment for the claim.
3. Call the lab that tested your swab and ask if they know who Flow Health is and why they want to be paid.

If the amounts add up and insurance doesn't have any other claims then I would honestly ignore these messages. Wait 30 days to see if Flow Health contacts you again or if you get a bill in the mail.

I don't know why insurance would send you the money owed to them. Even out of network labs still get money directly from insurance. In the small chance that insurance did send you the check. Just wait for the check and a valid bill from Flow Health.

If you absolutely want to contact Flow Health that should be okay. Call the number on the website and don't give them any more info than they already have (name, date of birth) and tell them to verify any debts. Then tell them to bill your address on file (do not give them SSNs or anything more). If they are a valid lab billing department then they already know your information.

Your name, phone number, and date of birth are basically public record between mortgage documents and all the data breaches. So don't be too concerned that they have that info, but still be cautious.