Phishing in Healthcare: How Staff Can Spot and Report Attacks
Fake referrals, supplier invoices, password resets and AI-written messages: how healthcare staff in Ireland and the UK can spot phishing and report it the right way.
Phishing in healthcare usually looks like ordinary clinical or admin work: a referral, a test result, a supplier invoice or a password reset from "IT". You can catch most of it by pausing, checking whether the sender and the request match what you would expect, and reporting anything doubtful straight away instead of just deleting it. Here are the lures staff in the HSE, the NHS, GP practices, clinics and care homes see most, and how to report them in Ireland and the UK.
Why healthcare staff are targeted
Healthcare inboxes are open by design: you receive email from patients, providers, labs and suppliers, often from unfamiliar addresses, and you are expected to act quickly. Attackers rely on that mix of openness, time pressure and goodwill.
The clearest example close to home is the HSE. The 2021 Conti ransomware attack began with a phishing email carrying a malicious Microsoft Excel file, which was opened on a single HSE workstation on 18 March 2021. The ransomware was not set off until 14 May, almost two months later (PwC independent post-incident review for the HSE, December 2021).
Phishing is also the most common attack across the wider economy. In the UK, it remained by far the most prevalent type of breach or attack, experienced by 38% of businesses, and 69% of organisations that had a breach or attack named phishing as the most disruptive (Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025/26). If you want the basics of how phishing and social engineering work in general, our phishing and social engineering awareness guide covers them. This post focuses on what it looks like in a clinical or care setting.
The healthcare lures you are most likely to see
Fake referrals and test results
A message that appears to come from another practice, a consultant's secretary or a lab, with a "referral letter", "discharge summary" or "results" attached or behind a link. Be wary of attachments that ask you to "enable editing" or "enable content", unexpected file-sharing links, and results for patients you do not recognise.
Supplier invoices and changed bank details
A common trick for practice managers, finance teams and care home administrators is an email, apparently from a known supplier, saying their bank details have changed. Always confirm payment changes by phoning the supplier on a number you already hold, never one in the email.
IT, password and mailbox alerts
"Your mailbox is full" or "your password expires today" messages lead to fake login pages that capture your password and sometimes your one-time code. Go to your usual login page or contact the IT service desk directly instead of using the link.
Texts and phone calls
Smishing (SMS phishing) and vishing (voice phishing) move the same tricks to your phone: a text from "the rota team", or a caller from "IT" who needs you to read out a code. Genuine IT staff do not need your password or your multi-factor authentication code.
AI-written and voice-cloned messages
Poor spelling is no longer a reliable giveaway. The UK National Cyber Security Centre (NCSC) assessed that generative AI will make it harder for everyone, whatever their level of cyber security knowledge, to judge whether an email or password reset request is genuine (NCSC, January 2024). Cloned voices are a growing part of this; our guide to deepfakes and voice cloning explains how they are used in fraud. The defence is the same as before: check the request, not the polish.
A 30-second check before you click
| Check | What to look for | Healthcare example |
|---|---|---|
| Sender | Does the display name match the actual address? | "GP Referrals" sent from a free webmail account |
| Expectation | Were you expecting this? | Results for a patient you have never seen |
| Urgency | Pressure to act now, or a threat | "Sign in within one hour or lose access to the rota" |
| Request | Credentials, payment, codes or patient data | A "commissioner" asking for a patient list by return |
| Links and files | Hover over links; be cautious with macros and zip files | A spreadsheet that asks you to enable content |
| Channel | Would this person normally contact you this way? | Your manager texting from an unknown number asking for gift cards |
If any of these feels off, verify through a separate channel you already trust.
How to report phishing in Ireland and the UK
One report lets IT block a message for everyone, and it can be the first sign of a targeted campaign.
- At work, report to your organisation first. Use the report button in your email client if you have one, or contact your local IT or ICT service desk.
- NHSmail users: select the email and choose Report, then Report Phishing. If you use an nhs.uk address instead, forward the email as an attachment to spamreports@nhs.net. Targeted attacks or compromised accounts go to the National Cyber Security Operations Centre at cybersecurity@nhs.net (NHSmail support guidance).
- UK, personal devices: forward suspicious emails to report@phishing.gov.uk and scam texts to 7726 (UK NCSC). If you have lost money, report it to Report Fraud, or to Police Scotland on 101.
- Ireland, personal devices: the National Cyber Security Centre Ireland advises reporting phishing, smishing and vishing to An Garda Síochána at your local station and using your email provider's report phishing feature (NCSC Ireland quick guide).
Public reporting works. The UK Suspicious Email Reporting Service had received more than 59.6 million reports, leading to 263,700 scams being removed across 466,300 web addresses (UK NCSC, September 2026).
If you have already clicked or replied
Tell IT straight away, and say exactly what you did: opened a file, entered a password, approved a sign-in or shared information. The HSE attack shows attackers can sit quietly on a network for weeks, so an early report gives your organisation time to act. Change your password through your normal route, not through any link in the message.
If patient information was shared or exposed, your data protection officer needs to know. Under the General Data Protection Regulation (GDPR) and UK GDPR, organisations must notify a reportable personal data breach to the regulator, the Data Protection Commission in Ireland or the Information Commissioner's Office (ICO) in the UK, within 72 hours of becoming aware of it (GDPR Article 33). Owning up quickly is the professional thing to do.
Making it a team habit
Awareness sticks when it is part of everyday practice: a two-minute slot at a team huddle, real examples from your own inboxes, and a clear "if in doubt, report" rule. For how to structure that kind of programme across a practice, ward or care home, see our post on cyber security awareness training for healthcare staff.
Frequently asked questions
Should I just delete a phishing email?
Report it first, then delete it. Reporting protects everyone else who received it.
Can phishing come from a real NHS or HSE address?
Yes. If a colleague's account is compromised, attackers can send phishing from a genuine address. Judge the request, not just the sender, and check unusual requests by phone.
What if a caller says they are from IT and needs my login code?
Hang up and call your IT service desk on the number you normally use. Legitimate IT staff will not ask for your password or authentication code.
Do I need to report a scam text on my personal phone?
Yes, especially if it mentions your employer. Forward it to 7726 in the UK or report it to An Garda Síochána in Ireland, and tell your IT team if it looks targeted at staff.
Spotting phishing is a skill you build with practice. For structured, practical learning on data security and confidentiality, explore our healthcare compliance CPD courses at Learnsignal.
This page was last updated:
Learnsignal Education Team
Expert Tutor at Learnsignal
Qualified professional with years of experience helping students advance their professional careers.
View all posts by Learnsignal Education Team
