AegisAI Perspectives · 110
Criminals hit a healthcare billing office by taking over a staff or vendor login, then emailing a bank detail change so payments land in their account.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Criminals use business email compromise against a healthcare billing office by stealing a login, then changing where payments go: the FBI warned that payment processor credentials were compromised and payments diverted to criminal accounts1. In one case about $840,000 was diverted over two transactions2. AegisAI agents check every payment request against the sender’s history17. Put a callback rule on every bank detail change first.
Give each of these three outcomes a named owner in the billing office.
It arrives as a routine request to change bank details, sent from a mailbox the billing team already trusts. In April 2022 a healthcare company with more than 175 medical providers found a criminal posing as an employee had changed the ACH instructions of a payment processing vendor.
In the first, the criminal takes over a real staff or vendor login and sends the change from inside. A hijacked vendor mailbox signs as itself, so email authentication passes, and there is no link or malware to find18. In the second, the criminal writes from an outside address posing as the vendor or a colleague, and counts on a busy billing clerk, as in the FBI case of a criminal posing as an employee.
The guide to email security for healthcare covers the wider rules for clinics and hospitals. Map both routes against your own vendor list before you change any control.
Short on time? Watch the explainer, or book a demo.
Treat any emailed request to change where money goes as an attack until a second channel confirms it. The FBI tells healthcare companies to verify any change to existing invoices or bank deposits with third-party vendors, and to verify direct requests for account actions through previously established channels3. The IC3 also advises secondary channels or two-factor authentication to verify requests for changes in account information7.
The 2025 IC3 report lists 24,768 business email compromise complaints4, with losses of $3,046,598,558 against $2,770,151,146 in 20245. In 2025 businesses reported losses over $30 million to BEC scams involving AI6. Print the list of request types that trigger a callback and pin it at every billing desk.
Set these seven controls in order; each one backs up the written rule in step 1.
No change to bank deposits, payee details or remittance instructions is made on the strength of an email alone.
The billing clerk calls the payer or vendor on the number already in the vendor record, never one in the email, through a previously established channel.
The IC3 names two-factor authentication as one way to verify requests for changes in account information. Use a phishing-resistant method on every billing login.
An admin can make it optional or required for users14, and security keys are the most secure form, with protection against phishing15.
In Microsoft 365, set automatic forwarding in the outbound spam filter policy to Off (Forwarding is disabled), which disables Inbox rules that redirect mail to external addresses12. In Google Workspace, turn user automatic forwarding off in the Admin console.
The Auto forwarded messages report shows users who forward to external recipients13. Check it each week for billing and revenue cycle mailboxes.
Turn on mailbox audit logging and alert on new forwarding rules, a step attackers use after they take over a mailbox23. HHS lists email security, against spoofing, phishing and fraud, among its healthcare cybersecurity goals8.
Assign each of the seven steps to one person and date the first weekly check.
Each step of the attack has a control that breaks it; read across each row to see who owns it.
| Attack step | Billing office or platform control | AegisAI |
|---|---|---|
| Stolen staff or vendor login | MFA on mail and portals, with security keys against phishing | The verdict rests on what this sender has sent you before and on the request itself21 |
| Email from a trusted vendor mailbox | Email authentication passes for a hijacked mailbox | Every payment request checked against the sender’s history |
| Request to change bank details | Written rule and callback on a number on file | Reads the change being asked for19 |
| Replies routed to the attacker | Forwarding set to Off | Reads where the reply actually goes |
| Message left in other inboxes | Search and clean up by hand | Removed from every mailbox that received it20 |
| Payment released | Callback through a previously established channel | No edge. Confirming the change with the vendor stays with your billing team |
Score your billing office on all six rows, and use the demo request page to see a bank detail change request checked on your own mail.
AI agents check every payment request against the sender’s history, and stop the business email compromise that authentication lets through. AegisAI reads the thread the way an analyst would: the sender’s history, the change being asked for, and where the reply actually goes. The median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it. You can run it in monitoring mode on live mail with no MX change, then turn on removal22.
Illustrative example, figures are fictional. Lakeside Family Practice (fictional) has 60 clinicians and a billing office of 4. On a Wednesday at 4:50 p.m., the billing lead gets an email from the real mailbox of the practice's claims clearinghouse contact. It asks billing to update the remittance bank account before Friday's $126,000 payment run. The message passes SPF, DKIM and DMARC, because the vendor's mailbox was taken over. The written rule holds the change, and on Thursday morning the billing lead calls the vendor on the number in the vendor record. The vendor says it sent nothing. The weekly Auto forwarded messages report shows 0 billing mailboxes forwarding outside the practice.
Run this scenario as a tabletop exercise with the billing team before the next payment run.
Track three numbers each week from the day the rule goes live.
Review all three on day 30 and close any gap before the next quarter's vendor payments.
They take over a staff or vendor login, or pose as a vendor, then email a bank detail change so payments go to their account. In one FBI case about $840,000 was diverted over two transactions.
It is when a criminal changes where a payment is sent, so money meant for a provider or vendor reaches an account the criminal controls. The FBI warned that payment processor logins were compromised to divert payments this way.
No, not when the vendor's real mailbox was taken over. A hijacked vendor mailbox signs as itself, so SPF, DKIM and DMARC pass. A callback on a number on file is what stops the payment.
MFA that resists phishing. In Google Workspace, make 2-Step Verification required and use security keys where you can, since they are the most secure form and protect against phishing.
Report it to the FBI's Internet Crime Complaint Center, which publishes the business email compromise figures each year, and call your bank the same day. Then follow the verification steps the FBI sets out for account changes.
