Deepfake Voice Phishing Response Checklist for Young Adult Patient Communities

A familiar voice is not proof of identity. A caller may make a phishing attempt by imitating a patient, friend, caregiver, or clinic employee to pressure you into revealing health information, sharing a one-time passcode, changing a prescription, or sending money. Use this checklist to pause, verify through a trusted channel, preserve useful evidence, and report concerns.

What should you do first during a suspected deepfake voice phishing call?

1. Pause and end the call. Do not let urgency, fear, secrecy, or a convincing voice push you into acting before you verify the request.
2. Do not share credentials or codes. Never disclose a password, one-time passcode, patient portal login, payment details, or recovery code to an unexpected caller. The FTC advises keeping verification codes private when you did not initiate the contact. Read the FTC guidance on two-factor authentication.
3. Do not follow instructions to transfer money, install an app, open a link, or grant remote access. Save any message or contact details you already received, then verify independently.
4. If someone may be in immediate danger, contact emergency services or a trusted care professional using a number you already know or obtain independently—not a number supplied by the caller.

A voice can sound authentic even when it is generated or manipulated. The FTC’s advice on AI voice-cloning scams is to verify a caller’s story by contacting the person through a known number or another trusted person.

How can you verify a caller’s identity through a trusted channel?

Use call-back authentication: hang up and contact the person or organization using a number saved in your contacts, printed on an official card or statement, or listed in an app or website you access independently. Do not call a number the caller gives you or rely on caller ID alone; phone numbers can be spoofed, as the FTC explains in its guidance on unwanted calls.

• For a clinic, pharmacy, or patient portal: use the organization’s official patient portal, app, or established phone number. Ask staff to confirm the request using their normal identity-checking process.
• For a community member: contact them through a previously established, separate channel, such as a known account or an in-person check. Do not treat personal details, a familiar voice, or knowledge of health information as proof of identity.
• For prescription change verification: independently contact the prescribing clinician or pharmacy before changing, stopping, or starting medication. If a change may affect an urgent dose or your health, contact a qualified clinician promptly.
• For a payment request: verify directly with the organization through its official app, website, or a known phone number before paying.

If your patient community is not part of a healthcare organization, do not assume its members or volunteers are authorized to verify identities or handle medical records; share only what is necessary with the appropriate, authorized contact.

Which warning signs may indicate a deepfake voice phishing attempt?

No single clue proves a voice is fake, and AI-generated audio can be difficult to identify. Treat the request and how it is delivered as important evidence, even if the voice sounds familiar. A familiar voice does not rule out a phishing attempt. The FBI’s guidance on AI-generated voice impersonation recommends independently verifying a caller’s identity.

• The caller demands immediate action, money, a password, or a one-time passcode.
• They insist you keep the call secret or discourage you from checking with a trusted person.
• They ask you to change a prescription, disclose diagnoses, or reveal patient portal details without a verifiable, expected reason.
• The caller’s number, account name, or contact details seem slightly different—or appear familiar but the request is unusual.
• The voice, timing, pauses, tone, or word choice seem unusual. These can be clues, but a natural-sounding voice does not establish identity.
• The person refuses a call-back through a known number or pressures you to stay on the line while you act.

Scammers may know a person’s name or other personal details, so correct information is not proof that a request is legitimate. Verify through a separate trusted channel before sharing anything sensitive.

How should you preserve audio, messages, and call details as evidence?

Save what you received without editing it. Original audio evidence preservation can help an organization review what happened, but do not put yourself at risk or delay urgent reporting to collect evidence.

• Keep the original voicemail, audio file, text, email, or direct message. Avoid trimming, enhancing, converting, or reposting the original.
• Take screenshots of messages and call logs, including the displayed number, date, time, and relevant account name. If you can, keep the original message as well.
• Write a brief timeline: what the caller claimed, what they requested, what information or action you provided, and who else may have received the communication.
• Record the caller’s claimed identity and organization, the callback number they supplied, any links or payment instructions, and whether you shared a code or health information.
• Store the material securely and share it only with the organization’s designated security or privacy contact, using its approved reporting channel. Avoid posting recordings or patient details in a group chat or public forum.

Do not make a call recording unless you have checked applicable recording rules and your organization’s policy. NIST notes that maintaining the integrity and documenting the handling of digital files are important evidence-preservation considerations; see NIST’s guidance on digital evidence preservation.

Who should you notify and how should you escalate an incident?

Report the attempt promptly—even if you did not share information or lose money. Use your clinic, community, school, or employer’s established security incident escalation process. Depending on what happened, notify the privacy officer, information security team, patient-support lead, or other designated incident contact. If you are unsure who that is, contact the organization through an independently verified main number and ask for the correct reporting channel.

• State whether you shared a one-time passcode, password, health information, portal access, payment, or prescription details.
• Say whether you clicked a link, downloaded an app, approved a sign-in, or gave the caller remote access.
• Provide the call time, displayed number, claimed identity, request, and preserved messages or audio through an approved secure channel.
• If a payment was made, contact the bank, card issuer, payment app, or gift-card provider immediately using an official number or app. Ask whether the transaction can be stopped or disputed.
• Consider reporting suspected fraud to the FTC. Report suspected criminal activity to the FBI’s Internet Crime Complaint Center when appropriate.

Do not announce that a specific community member is responsible or circulate their personal information based on a suspicious call. Escalate through authorized channels so the organization can assess the incident and protect affected people. HIPAA obligations depend on the organization and circumstances; HIPAA does not automatically apply to every peer community. For a general overview, see the HIPAA Breach Notification Rule. HHS explains the scope of the HIPAA Breach Notification Rule and the responsibilities of covered entities and business associates.

How can you protect patient information and access after a suspected attack?

If you shared a password, passcode, or portal details, contact the relevant organization using its official channel and ask it to secure the account. change the affected password from a trusted device, change it anywhere else you reused it, and review account activity. If you approved an unexpected sign-in, contact the provider promptly to revoke access or sessions where possible.

• Use unique passwords and enable multifactor authentication where available. Never approve a login prompt you did not initiate.
• Tell the portal, clinic, or community administrator if health information may have been viewed or disclosed. Follow their instructions about access resets and account monitoring.
• If you provided financial information or authorized a payment, alert the bank or payment provider immediately and follow its recovery instructions.
• Ask the prescribing clinician or pharmacy to verify any medication change requested during the suspicious contact.
• Limit further disclosure: share incident details only with people who need them to secure accounts, assess exposure, or support affected members.

Organizations—not individual community members acting alone—should assess whether an incident involves regulated health information and what response or notifications are required. HHS says the HIPAA Security Rule requires covered entities and business associates to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and outcomes; see HHS guidance on security incident response.

In short, do not trust a voice or caller ID by itself: stop, verify independently, preserve the original evidence, report the incident, and secure any affected accounts or payments.

FAQs.

Should I share a one-time code with a caller who sounds familiar?

No. Do not disclose a one-time passcode to an unexpected caller, even if the voice sounds familiar or the caller knows personal details. End the call and verify the request through a trusted channel. The FTC advises not to share a verification code with someone when you did not contact them first.

How can I verify a patient community member’s identity after a suspicious call?

Contact the person through a separate channel you already trust, such as a previously saved number or established account. If the request involves clinic services, medication, or patient records, confirm it with the relevant healthcare organization using its official contact information. A familiar voice or knowledge of personal details is not enough to verify identity.

What evidence should I save after a suspected deepfake voice phishing attempt?

Keep the original voicemail or audio, messages, screenshots, call-log details, links, and payment instructions. Note the date and time, what was requested, and whether you shared information or took action. Avoid editing or publicly reposting the material; send it securely to the appropriate incident contact.

What should I do if I already shared health information or approved a payment?

Report the disclosure promptly to the relevant clinic, portal, or organization’s privacy or security contact. If you shared login details or a code, ask the provider to secure the account and change affected passwords from a trusted device. If you paid or shared financial information, contact the bank or payment provider immediately. If a prescription change was involved, confirm it directly with the prescriber or pharmacy before acting on it.