In April 2024, the Health Sector Cybersecurity Coordination Center (HC3) put out a sector alert about phone calls reaching hospital IT help desks. The callers said they worked in revenue cycle or another finance role, and their numbers carried a local area code. Each one had the same story. Their phone was broken, they couldn't receive their multi-factor authentication (MFA) codes, and they needed a new device set up.

When a help desk agreed, the caller walked away with a reset password and a second login factor on a phone they controlled. HC3 said the attackers went after payer website logins next and changed where payments were sent. TechTarget's account of the American Hospital Association's warnings adds that the employee's email account was the target.

Read more: What HIPAA actually requires for security awareness training | Introducing Paubox Security Awareness Training

 

The second factor never came into play

MFA is supposed to stop someone who has stolen a password. Here the attacker didn't need to beat it, because the help desk registered the attacker's phone as the employee's own. The American Hospital Association told members it was seeing more of these calls, and TechTarget noted the tactic works even against phishing-resistant MFA, the stronger kind tied to a physical key or a specific device.

HC3 filed the calls under social engineering. Nothing was hacked in the technical sense, someone asked, and someone helped.

 

Scattered Spider's playbook

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) updated their joint advisory on the criminal group Scattered Spider on July 29, 2025. The advisory lists the same move among the group's techniques, with members posing as employees to get help desk staff to "reset the employee's password, and transfer the employee's MFA to a device they control."

Large companies are the usual targets, along with the outside firms that run their help desks. The July update also says the group may steal data for extortion and then encrypt systems for ransom. HC3 didn't name anyone for the hospital calls, but its alert noted that Scattered Spider had used similar techniques before.

 

Can people hear a fake caller?

Not reliably, going by the research. A team at Arizona State University placed ten rounds of scam calls to 3,000 university participants who had no idea a study was running. The USENIX Security paper found that spoofing the caller ID, so the call looked like it came from a trusted number, was one of the strongest parts of the scam.

In one round, the call appeared to come from the participants' own employer and talked about an upcoming payday. "3.7% of people possibly entered their Social Security numbers," said Adam Doupé, the Arizona State professor who led the work. No numbers were kept, and everyone got a debriefing survey afterward. A local-looking number and a reason tied to work are exactly what HC3 described.

Synthetic voices make this cheaper. Fred Heiding and his co-authors tested phishing calls voiced by AI models on 4,100 adults in the United States, and their 2026 study put overall compliance at 16.5%. That climbed to 36% when the call claimed a relative was in trouble. Their cost analysis found human-run voice phishing doesn't pay at US wages, while several AI models made it economically viable.

 

The help desk's own checks

HC3 recommends training staff to recognize and report social engineering. The rest of its list is procedural, built so an agent doesn't have to judge whether a caller sounds real.

The first item is a callback to the number already on file before any password reset or new device. Some hospitals now go further and make employees show up at the help desk in person. HC3 also suggests dropping text message codes as an MFA option, switching on number matching in Microsoft Authenticator, and only allowing MFA registration from trusted networks or approved devices. With number matching, the user has to type a number shown on the login screen, so an approval prompt can't be accepted blindly.

 

The email account at the end of it

Every version of this attack ends in a mailbox. From there come the payer logins and payment changes HC3 described.

Paubox Security Awareness Training tests staff on the email side with phishing simulations. It reports who opened, who clicked, and who typed in credentials, and it keeps six years of campaign records for documentation. Paubox Inbound Email Security looks at sender behavior and message intent to stop phishing before staff sees it. Both sit in the same account as Paubox's HIPAA compliant email encryption.

 

What the AHA pointed hospitals to

When HC3 published the help desk alert, it released a separate advisory on the ten ransomware groups most active against healthcare over the previous six months. The American Hospital Association circulated both to members in April 2024. It noted that the help desk alert includes technical guidance for securing MFA and preventing misuse of privileged accounts in Microsoft cloud environments.

 

FAQs

Does HIPAA require separate training for help desk staff?

No. HIPAA requires a training program for the whole workforce under 45 CFR 164.308(a)(5), and HC3 recommends that staff learn to spot and report social engineering.

 

Why didn't phishing-resistant MFA stop these calls?

The attacker never had to beat it. The help desk swapped the employee's device for the attacker's, so the protection moved to the wrong person.

 

What's the simplest control to add?

A callback to the number already on record before resetting a password or enrolling a device.

 

What is number matching?

A Microsoft Authenticator setting that makes the user type a number shown on the login screen before a sign-in is approved.

 

Why does email security come into a phone-based attack?

The calls HC3 and the AHA described ended with access to an employee's email account and, from there, payment systems.