A voicemail greeting is enough. Three to ten seconds of someone’s voice — a podcast clip, a conference recording, a quick “hi, you’ve reached Dr. Patel’s office” — is now all it takes to clone that voice convincingly. The tools cost less than a streaming subscription, and staff generally cannot tell the difference by ear.
This is vishing 2.0, and it’s already showing up in healthcare.
What’s actually happening in 2026
Deepfake-enabled vishing calls surged more than 1,600% in a single year, and healthcare has become a specific target. Home health and billing departments are attractive because they handle payment instructions, process transfers to Medicare clearinghouses, and take routine calls from physicians, payers, and administrators all day. A convincing cloned voice fits right into that pattern.Attackers also use the same technique to gain remote access: a call that sounds exactly like your IT provider, asking a staff member to “verify” a login or install a remote tool. And on the patient side, telemedicine platforms that authenticate people by camera and microphone are exposed to a newer variant — synthetic identities filing claims for services that were never rendered.
Why this is a HIPAA problem, not just a fraud problem
A vishing call that talks a staff member into resetting a password, granting remote access, or reading back patient information over the phone bypasses every technical safeguard you’ve put in place. MFA, encryption, and access logging don’t help if someone with legitimate credentials was talked into handing over access willingly.
Under the Security Rule, “verify the identity of a person requesting access” is a real requirement, and voice alone no longer satisfies it. Insurers ask the same question in different words: can you demonstrate that your staff verify unusual or high-risk requests through a channel an attacker can’t fake?
What to actually do about it
None of this requires exotic detection technology. It requires a process that doesn’t rely on recognizing a voice.
- Require callback verification for anything unusual: wire transfers, password resets, remote access requests, or PHI disclosures get confirmed by calling back a known number, not the number that called in.
- Set a shared passphrase for high-risk requests: a word or phrase staff and known contacts agree on ahead of time, that a cloned voice won’t know to say.
- Limit what can be authorized by phone alone: wire transfers and access changes should require a second, independent step no matter how convincing the caller sounds.
- Train staff to treat urgency as a red flag: “this can’t wait for a callback” is exactly the pressure these calls are designed to create.
Where ACS fits in
Vishing doesn’t show up on a firewall log, which is exactly why it works. What stops it is a verification process your whole team follows every time, and a partner who helps you build one. ACS’s free 30-minute IT & HIPAA assessment looks at how your practice handles high-risk requests today and where a callback policy, MFA, and staff training need to close the gap.
