“Nurse” from nowhere: how fraudsters play on the trust in medicine

The Prosecutor’s office of the Moscow region and the Main Directorate of regional security of the region warned about the two-stage scheme, which is already harvesting in the suburbs. Its specificity is in psychological sequence. Fraudsters do not start with threats, but with empathy.

Stage One: “Nurse” in the messenger

Victim receives a message in messengers. On the avatar is a pretty woman in a medical suit. In the profile is the name of the clinic, to which the person may actually be attached. The text reads, “Hello!” We are updating the database of medical records. Please check your height, weight and if there are any health complaints.”.

"How sweet," the citizen, flattered by attention, begins to think. It turns out that it's not just soulless answering robots communicating with patients by phone. That's good. A human voice that is interested in you. It discourages, disarms, bribes... In other words, it creates an atmosphere of trust. And then? Key point. Fraudsters do not ask for a passport, SNILS or card number. They ask what the person is used to telling the doctor. Height, weight, “backache”, “pressure jumps”. This creates the illusion of legitimate medical dialogue. The victim is relaxing.

After a short correspondence follows the phrase: “Thank you!” You will receive a call to confirm the data. Please send me the number from which they will call so that we can verify the recording.”.

Here is a carefully disguised trap. Not a card number, not a CVV, not a SMS password. There is even something familiar about it... By calling from an unfamiliar number, many applications are now installed.

But a person is asked not just to “wait for a call”, but to assist a scammer who will call in a minute. Psychologically, this shifts the victim from the passive role of the “victim of deception” to the active role of “participant in the process.” She's already in the game.

Stage Two: Public Services Calling

In a few minutes, a call comes up. At the end is the agitated voice of a “public services security officer”: We have detected a suspicious entrance to your personal account. I'm about to get an SMS with a code to your number. Dictate him so that we block the burglar.”.

The real code comes in. It's from the real Public Services. But it is not intended to “block hacking”, but to confirm the fraudster’s login to the victim’s account. Dictating the code, a person opens the door to the robber.

In Lobna, a 77-year-old pensioner became a victim of a similar scheme. She got a call from a “polyclinic employee” and offered to sign up for a medical examination. For the recording was asked to dictate the code from the SMS. Then there’s the classic “finishing” scenario. After receiving the code, a “false investigator” called. He told about the hacking of the account and power of attorney issued on the “person in the federal wanted list.” Sent a picture of a fake document. Then the “employee of Rosfinmonitoring” joined – and the woman was persuaded to withdraw all savings, lay jewelry in a pawnshop and transfer the proceeds to “safe accounts”.

As a result, more than a million rubles were lost. One of the recipients of the money is a 19-year-old visitor from Central Asia who, for a fee, issued bank cards and handed them over to fraudsters. Note the mechanics: the nurse was just a seed. She didn't ask for money. She blunted her guard. Everything else was done by “investigators” and “finmonitoring” in the wake of the contact that had already arisen.

What Official Structures Say

The General Directorate of Regional Security of the Moscow Region emphasizes that real clinics do not collect card data in instant messenger chats. Moreover, by phone from the clinic can specify only the date of birth and name. The rest is exclusively in person.

As for “public services”, support operators never request passwords and codes from SMS. Never. Under no circumstances. If you call “from public services” and ask for a code – this is a scammer. Period.

We asked to comment on the scheme of social engineering specialist Alexei Demidov.

- What is the main psychological feature of this scheme?

- Changing context. When a person calls from the bank and talks about stealing money, he is already alert. And when he writes a “nurse” and asks about his health, a social reflex works. We used to trust doctors. He is a figure with high credit. Fraudsters exploit it. They don't push, they care. And then, when trust has already been established, "Public Services" enter the case - and the person does not feel the gap. For him, it's one story: "nurse" - "confirmation" - "security.".

- Why don't victims hang up when they hear about "account hacking"?

- Because we had our first contact. The victim’s brain perceives this not as a “sudden call from a fraudster,” but as “continuing dialogue with the clinic.” Fraudsters use the principle of consistency: if a person agreed to a small step (told about his health), it is psychologically harder for him to refuse the next one (dictate the code).

- What's the most dangerous thing about this scheme?

- That it works on people who are basically cautious. They are not naive grandmothers who believe everything. These are normal people who know about scammers, but relax because “it’s about health, not money.” When they understand what is happening, it is too late.

How not to get caught: non-banal tips

1.Get a "Medical Secret Rule." A real clinic never writes first to the messenger with the question “how do you feel?” If you did not make an appointment, did not leave an application, did not wait for the results of tests - any message from the "medical" messengers is automatically considered suspicious. Delete and block.

2. Use the “callback rule.” If you call from the “polyclinic” or “public services” and asked to confirm something – hang up. Don't argue. Don't explain. Just disconnect. Then call the official number yourself: to the clinic - by the number from your policy or from the site, to the Public Services - through the application or on the number 122. Check it out.

3. Never send the “incoming call number.” This is the main red flag of the new scheme. If you are asked to provide a number from which to call, these are scammers. Real organizations don’t ask to “verify” their own calls through you. Never.

4. Talk to your family about a “stop word.” Make a rule: if someone close to you receives a call “from the bank” or “Public Services” and becomes nervous, he must interrupt the conversation and call you. Fraudsters often prohibit the victim from “telling to family,” another marker of deception. Your "stop-word" ruins their script.

5. Set a "cooling period." If you have already started a conversation and feel pressure ("urgently", "now", "otherwise it will be late"), say: "I'll call you back in 10 minutes." Fraudsters don't like pauses. A real employee of the bank or public services will not mind if you take a break. The fraudster will push. Pause is your best detector.

6. Don’t confuse “care” with “safety.” Medicine takes care of health. Security is about money and data. It's different. If a "nurse" suddenly starts talking about "codes," "hacks," or "account protection," it's not a nurse. Change the topic and end the conversation.

Fraudsters get smarter. They move away from direct threats to imitation care. They don't scare -- they sympathize. But the goal remains the same. Remember, a real nurse won’t ask you for a code. Real public services won't be the first to call. And real safety starts with hanging up the phone.