{"success":true,"data":{"id":"medical-billing-surprise-phish","label":"Fake hospital or out-of-network billing claiming a surprise medical bill requires immediate payment or insurance verification via email link to avoid collections — credential-harvest and payment-diversion fraud; real medical billing goes through authenticated patient portals or postal mail.","description":"Fake hospital, out-of-network provider, or billing clearinghouse claiming a surprise medical bill or balance billing amount requires immediate payment via email link or that insurance details must be updated to avoid collections — credential-harvest and payment-diversion fraud. Real medical billing goes through authenticated patient portals (Epic MyChart, Cerner), paper statements, or phone contact; cold emails demanding credit card or insurance credentials via link to pay a medical bill are unauthorized billing attacks. Distinct from healthcare-prior-auth-denial-phish (CMS PA denial) and healthcare-insurance-sbc (SBC document). Detection: medical bill/hospital bill/out-of-network balance billing + pay now/avoid collections/verify insurance vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +3. Source: GC1-R24; CMS No Surprises Act patient protections; FTC medical billing fraud advisory 2025.","tier":"danger","category":"phishing","isThin":false}}