Cybercriminals don't always need to hack their way into an optometry practice.
Sometimes, they simply ask.
They send an email that appears to come from the doctor.
They call the front desk pretending to be IT.
They pose as a vendor requesting updated payment information.
They claim to be a patient or another medical office asking for records.
And increasingly, the message may look and sound completely legitimate.
This is social engineering: manipulating a person into providing information, approving access, sending money, or taking another action the attacker wants.
For optometry practices, the challenge is that social engineering attacks are designed to look like normal business.
Your staff answers phones. Your practice works with vendors. Employees receive invoices. Patients request records. Passwords expire. Doctors send messages. IT companies perform maintenance.
Attackers don't need to invent unusual situations.
They imitate the ones your employees see every day.
The Attacker Is Exploiting Trust, Not Just Technology
The first article in our Human Layer series focused on the people who actually work inside your practice.
This article focuses on the other half of the problem:
The people pretending to be them.
An attacker may research your practice before making contact.
Your website may identify your doctor, office manager, and staff.
Social media may show who works in which role.
Practice videos may reveal how people speak.
Public information can help an attacker understand relationships and authority inside the business.
Then comes the impersonation.
The attacker doesn't necessarily need malware or complicated hacking tools.
They may simply need to sound like someone your employee trusts.
The Doctor's Name Can Be a Powerful Weapon
Imagine an employee receives a message appearing to come from the doctor:
"I need you to handle this before the end of the day. I'm tied up and can't talk. Don't bother anyone else with it."
Then comes the request.
Move a payment.
Buy gift cards.
Change payroll information.
Send a patient record.
Reset an account.
What makes this effective isn't the technical sophistication.
It's authority.
Employees naturally hesitate to challenge a doctor, owner, or office manager — especially when the request appears urgent.
Attackers know that.
The safest practices give employees explicit permission to verify unusual requests, even when they appear to come from leadership.
Your staff shouldn't be worried that they'll offend the doctor by checking.
Verification should be expected.
Teach Your Staff the Four Tells
Rather than asking employees to become fraud investigators, give them something simpler to recognize.
Four common warning signs appeared throughout our Human Layer webinar:
Urgency
The request must happen immediately.
"Do this before the end of the day."
"I need this right now."
"The account will be locked in 30 minutes."
Urgency reduces the time an employee feels they have to think.
Authority
The request appears to come from someone the employee doesn't feel comfortable questioning.
That might be the doctor, owner, manager, IT provider, attorney, bank, or another trusted organization.
Secrecy
The employee is told not to involve anyone else.
"Don't bother the doctor."
"Keep this between us."
"There's no need to tell the team."
Secrecy prevents the second opinion that could expose the scam.
Channel Change
A familiar person or company suddenly communicates differently.
A vendor has a new banking account.
An employee asks to change direct deposit through email.
A known contact starts using a new phone number.
A doctor supposedly sends instructions from an unfamiliar address.
Any one of these warning signs should make an employee slow down.
When several appear together, the request should be independently verified before anyone acts.
The Front Desk Is Also a Security Checkpoint
Email isn't the only way attackers reach a practice.
The phone can be just as effective.
Consider some of the situations your front desk handles:
A caller claims to be a patient requesting records.
Someone says they're the patient's spouse.
An attorney calls requesting information.
Another medical office asks for a chart.
A person claiming to be from IT says the practice's system needs maintenance.
A vendor technician shows up and asks for access to a diagnostic device.
Any of these requests could be legitimate.
That's exactly why they're useful to an attacker.
Your employees shouldn't have to decide whether someone "sounds trustworthy."
They need a procedure.
For example, your practice should define how a caller's identity is verified before protected information is released.
Your team should also know that legitimate IT support should not need an employee's password or ask the employee to blindly approve an MFA request.
And vendor visits should be scheduled and confirmed rather than automatically trusted because someone arrives carrying tools and knows the equipment name.
The goal is to replace judgment calls with repeatable processes.
Create an Authority Map
One surprisingly simple security control is to write down who is allowed to authorize sensitive actions.
Who can approve a change to a vendor's payment information?
Who can authorize a patient-record release?
Who can request a password reset?
Who can approve a new employee's access?
Who can authorize a vendor or technician to work on practice equipment?
If nobody knows the answer, authority belongs to whoever sounds convincing.
An authority map removes that uncertainty.
Employees aren't being asked to determine whether a person is telling the truth.
They're checking whether the request follows the practice's established process.
That is much easier to do in the middle of a busy day.
Use the Callback Rule
One of the strongest defenses against social engineering is also one of the simplest:
Verify the request using a communication channel the attacker doesn't control.
Suppose an email from a vendor says their banking information has changed.
Don't call the phone number listed in that email.
Use the vendor's phone number already stored in your records.
If an unusual request arrives by email, verify it through a known phone number.
If a request arrives by phone, verify through an established email address or another trusted method.
This is sometimes called out-of-band verification.
The idea is simple: don't let the person making the request also dictate how you verify them.
That one rule can stop many impersonation and business email compromise attempts.
Make Money Movement Boring
Requests involving money deserve their own procedures because attackers frequently target routine financial changes.
Three situations should always trigger verification:
A vendor changes bank information.
An employee requests a direct-deposit change.
Someone requests an unusual or urgent payment or refund.
Vendor banking changes should be confirmed by calling a number your practice already has on file.
Direct-deposit changes should be verified through an established method rather than simply replying to the request.
And higher-risk payments should require a second approval.
Even in a small practice, two-person approval is possible.
It might simply mean the office manager and doctor both confirm the change.
The purpose isn't bureaucracy.
It's making financial changes predictable and procedural instead of emotional and urgent.
What Happens After Someone Is Fooled?
No security process is perfect.
An employee may eventually enter credentials into a convincing fake login page.
If that happens, speed matters.
An attacker who obtains a valid username and password may be able to sign into the employee's account and begin studying the environment.
They may examine emails and invoices.
They may learn who the practice communicates with.
They may create mailbox rules that hide certain messages.
They may send messages while impersonating the employee.
This is why employees need to report suspicious activity quickly.
If someone realizes they entered a password into the wrong page, they shouldn't wait until tomorrow to mention it.
Fast reporting gives your IT team an opportunity to disable access, reset credentials, terminate active sessions, and investigate what happened.
Don't Ask Employees to Be Suspicious of Everyone
Effective cybersecurity shouldn't make your practice feel paranoid.
Your staff shouldn't spend the day wondering whether every patient, vendor, doctor, or phone call is fake.
Instead, give them simple rules.
Teach them the four tells.
Define who can authorize sensitive requests.
Establish verification procedures.
Use known contact information.
Require a second approval when appropriate.
And make it safe to stop and ask questions.
You're not asking your employees to outsmart cybercriminals.
You're giving them a process so they don't have to.
Protect the Trust Inside Your Practice
Social engineering succeeds because businesses run on trust.
Your employees trust the doctor.
They trust known vendors.
They trust familiar systems.
They want to help patients.
Cybercriminals try to borrow that trust long enough to get what they want.
Technology is still important, but technology can't make every decision for the person answering the phone or reading an email.
That's why the human layer matters.
When your staff knows what warning signs to look for, understands who has authority, and has a clear process for verification, a convincing request becomes much harder for an attacker to exploit.
The goal isn't to make your employees suspicious.
It's to make verification normal.
Because when someone asks your team to move money, release information, approve access, or change something important, the safest answer isn't:
"Does this look legitimate?"
It's:
"Let's verify it."