The Out-of-Office Scam Your Front Desk Won't See Coming
It's August. Someone on your team is out for a week, and their email has an auto-reply on: "I'm out of the office until the 18th, please contact Jane for anything urgent." That single line is a gift to a scammer. It tells them exactly who to pretend to be and exactly who to target while the real person can't answer the phone.
This scam shows up every summer in medical and dental practices across Palm Beach and the Treasure Coast, and it works because it doesn't look like an attack. It looks like a normal email from the boss.
How the scam actually works
A scammer reads an out-of-office reply, or just guesses your team is short-staffed in August. They email the office manager or front desk, pretending to be the doctor or practice owner: "I'm stuck at the airport, can you buy some gift cards for a patient thank-you and send me the codes?" Or, "I need you to wire a payment to a new vendor today, I'll explain when I'm back."
The email address looks close enough at a glance. The tone sounds urgent but casual, the way a real boss might text between flights. And the one person who'd normally double-check with a quick "hey, is this really you?" walk down the hall is on vacation too.
Why practices are easy targets in the summer
Three things line up at once:
Short staffing. Fewer people means fewer eyes on an odd request, and less time to slow down and think it through.
Real travel. Doctors and practice owners actually do travel in the summer, so "I'm out of town" isn't suspicious on its own. The scam blends in with normal life.
Habit of helping fast. Front desk and office staff are trained to be responsive and solve problems quickly. That's a strength every other week of the year, and it's exactly what a scammer counts on in this one.
What to do about it
You don't need new software to fix this. You need one habit, practiced before it matters.
Set a rule now: no gift cards, wires, or payment changes from an email alone. Ever. If a request like that comes in, the answer is always "let me call you to confirm," even if the email says not to.
Keep out-of-office replies vague. "I'm out of the office with limited email access, contact the front desk for anything urgent" gives a scammer less to work with than naming a specific person and a specific return date.
Use a phone call, not a reply, to confirm anything unusual. Call the number you already have on file for that person, not a number from the suspicious email.
Tell your team this happens every summer. A five-minute conversation at your next staff meeting is enough. The goal isn't fear, it's a habit: unusual money request, always confirm by phone.
Have someone check email and voicemail while staff are out, even lightly. A gap of a week is exactly the window these scams are built for.
None of this requires new tools. It requires everyone on your team knowing the rule before the email shows up, not after.
The bigger picture
This is one small example of a much bigger pattern: patient data and practice finances are a target, and the busiest, most short-staffed weeks of the year are when practices are most exposed. Staff phishing training and a real security review catch far more of this than any one blog post can.
Not sure where your practice stands on this kind of thing? Our free HIPAA assessment looks at how patient data is handled, backed up, and protected, and we'll tell you in plain English what we'd fix. No pressure, no jargon.
