AOA Alert: Spear-phishing emails, scams targeting optometry practices

Optometry practices should remain vigilant as a recent string of spear-phishing email activity targets the industry using fraudulent or spoofed credentials to impersonate trusted individuals and organizations. 

These emails do not originate from the AOA or affiliates and may be designed to trick recipients into revealing sensitive information, compromising practice systems or transferring money. 

Unlike typical spam, spear-phishing attempts are designed to look legitimate. Cybercriminals may mimic a familiar colleague, organization or business contact, using recognizable names, addresses, logos and language to make the message appear authentic. The email may then pressure the recipient to click a malicious link, download an attachment, provide login or financial information, or bypass normal business procedures.

5 Warning Signs of Email Scams 

Spear-phishing attacks are increasingly sophisticated, making even experienced email users vulnerable. The AOA encourages doctors and practices to watch for these common warning signs:  

1. Urgent or coercive language. Be skeptical of messages demanding immediate action, requesting secrecy, or creating unusual pressure to respond quickly.
   
2. Slightly altered email addresses. Look closely at the sender's full email address for misspellings, unexpected domains or subtle variations, such as ".co" instead of ".com."
   
3. Unusual requests. Be cautious when a familiar contact unexpectedly asks you to transfer money, share confidential information, provide account credentials or bypass your practice's standard procedures. 
   
4. Suspicious links or attachments. Before clicking, verify where a link actually leads. Fraudulent emails may direct users to convincing look-alike websites designed to capture usernames, passwords or other sensitive information.
   
5. Requests for confidential information. Never provide personal, financial, patient or network-security information unless you have independently confirmed who is requesting it and why. 

When in doubt, verify the request through a separate, trusted communication channel. Contact the individual or organization directly using a phone number, website or email address you already know rather than replying directly to the suspicious message. 

A few extra seconds spent verifying an unusual request can help protect your practice, patients and sensitive, protected information from a potentially costly cybersecurity incident.