Medical Identity Theft
Criminals use your identity to obtain medical treatment, prescriptions, or insurance benefits — leaving you with fraudulent records and unexpected bills.
Last reviewed: 1 June 2026
What this scam is
Medical identity theft occurs when someone uses your personal information — name, date of birth, insurance details, national health number, or social security number — to obtain medical treatment, prescription medications, medical equipment, or healthcare benefits in your name. Unlike financial identity theft, the consequences extend beyond money and can affect the accuracy of your medical records, potentially causing harm in future clinical encounters.
The information used in medical identity theft can be obtained in several ways: data breaches at healthcare providers, insurers, or health apps; phishing or social engineering campaigns that extract insurance or health ID numbers; the purchase of stolen data on criminal forums; or the actions of someone known to the victim, including family members who share an insurance plan.
The immediate consequences include unexpected medical bills, denied insurance claims for services you did not receive but which have exhausted your benefit, and collection demands for debts you did not incur. The longer-term consequence — which is the feature distinguishing this from financial identity theft — is corruption of your medical record. If someone received treatment in your name, their diagnoses, medications, procedures, and test results may now be part of your health history. In an emergency, incorrect information in your record could affect clinical decisions made about you.
Detecting medical identity theft is often delayed because there is no continuous monitoring tool for health records equivalent to credit monitoring services.
How it works
The most common entry point is a data breach. Healthcare records are highly valuable on criminal markets because they contain the combination of personal, financial, and health information needed to commit multiple types of fraud. When a healthcare provider, insurer, or health platform is breached, thousands of patient records may be sold or exploited.
Phishing campaigns targeting patients and healthcare workers use fake appointment confirmations, insurance portals, and patient account alerts to harvest login credentials for health portals, which then expose the detailed information needed.
Once the criminal has your details, they may present your insurance card or health ID at a clinic or pharmacy, obtain prescription medications for resale, receive expensive treatments charged to your insurance, or submit fraudulent insurance claims on your behalf.
Fraudulent insurance claims are a particularly common application: criminal networks submit claims for procedures never performed, using stolen patient and provider details. The money goes to the criminal, but the fraudulent procedure record — and the depleted insurance balance — remains attached to your identity.
Insider fraud is another pathway: employees at healthcare organisations with access to patient records may sell or misuse that information.
Why this scam works
Medical identity theft is effective partly because victims often do not know where to start addressing it. Financial identity theft has well-established mitigation pathways, including credit freezes and dispute processes with credit bureaux. Medical identity theft has less standardised processes and affects records spread across multiple healthcare providers.
The complexity of healthcare billing also disguises the problem. Patients who receive an explanation of benefits showing a service they do not recognise may assume it is a billing code issue rather than fraud, delaying investigation.
Healthcare records contain more categories of information than financial records and enable a broader range of fraud, making them disproportionately valuable to criminals.
A typical pattern
A person receives a bill from a hospital they have never attended for a procedure they have no knowledge of. They contact the hospital, which has a record of a visit under their name and insurance details. Their insurance has paid part of the bill, leaving a balance in collections. Reviewing their insurance statements, they find three further claims for services not received, which have significantly reduced their remaining annual benefit. Their health record at the hospital contains diagnoses and a medication list belonging to someone else.
Common red flags
- Bills from healthcare providers you have not visited
- Insurance explanation of benefits showing services you did not receive
- Denial of a legitimate insurance claim citing a benefit maximum already reached
- Medical debt in collections for unknown services
- Notification from a healthcare provider of a data breach
- Your insurer contacts you about a claim you did not submit
- Medical records showing diagnoses or medications you do not recognise
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
You have a balance of [amount] due for services on [date]. Please contact billing to discuss payment: [fake link]
Your insurance claim for [procedure] has been processed. Please log in to review your explanation of benefits: [fake link]
We noticed unusual activity on your patient portal. Verify your identity to continue: [fake link]
Your annual benefits have been exhausted. To continue coverage, update your plan details at [fake link]
Common variations
- Insurance claims fraud — fraudulent procedures billed to your insurer
- Prescription drug theft — your health ID used to obtain controlled medicines
- Durable medical equipment fraud — equipment billed to your insurance without your knowledge
- Data breach exploitation — records stolen in a breach and used to access care
- Child identity theft — a minor's health ID used because it is unmonitored
- Insider misuse — healthcare worker uses patient data for personal benefit
How to verify before you act
Request a copy of your medical records from your GP, insurance provider, and any hospitals or specialists you have visited. Review them for treatments, diagnoses, or prescriptions you do not recognise. In the UK, you have a legal right to access your NHS records. In the US, the Health Insurance Portability and Accountability Act (HIPAA) gives you the right to access your health records.
Request an explanation of benefits (EOB) statement from your insurer for the past 12 months and review each line item. Contact your insurer's fraud department if you see claims for services you did not receive.
Monitor your credit report for unexpected medical debt collection notices, which may indicate that someone has run up medical bills in your name.
If you receive a bill from a healthcare provider you have not visited, do not ignore it — contact the provider's billing department and their fraud or compliance team.
Payment methods used
- Insurance billing fraud (payment goes to criminal)
- Prescription medication theft for resale
- Durable medical equipment fraud
Who is usually targeted
- People with comprehensive health insurance
- Elderly individuals
- Children (whose records may go unmonitored for years)
- People who have had medical data breached in a known incident
What to do immediately
- Request your full medical records from all providers and review for unrecognised entries
- Request 12 months of explanation of benefits from your insurer and identify all unrecognised claims
- Contact each provider's fraud or compliance department to report inaccurate records
- File a complaint with your insurer's fraud team and request a formal investigation
- Place a fraud alert or credit freeze with credit reference agencies
- File a report with your national identity theft or consumer fraud authority
- Keep a log of every contact made and every response received
How to prevent it
- Review your insurance explanation of benefits statements regularly
- Request and review your medical records annually
- Protect your insurance card, health ID number, and national insurance number carefully
- Be cautious of phishing attempts that request health portal login credentials
- Use unique, strong passwords for all patient portal and health app accounts
- Monitor your credit report for unexpected medical debt
- Set up alerts if your insurer offers them for claims activity on your account
- If notified of a data breach at a healthcare provider, act promptly to review your records
Evidence to preserve
- All medical bills received for services you did not receive
- Explanation of benefits statements showing unrecognised claims
- Written communications with providers and your insurer
- A copy of any medical records showing inaccurate information
- Credit reports showing any associated debt
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
How is medical identity theft different from financial identity theft?
Medical identity theft corrupts your health records in addition to causing financial harm. Incorrect diagnoses, medications, or procedures attributed to you can affect future medical care. This makes it more complex to resolve and potentially more dangerous.
How do I access my medical records to check for fraud?
In the UK, request your NHS records through the NHS app or by writing to your GP practice. In the US, contact each provider directly under your HIPAA right of access. Most insurers also have online portals where you can view claims history.
Can I dispute incorrect medical record entries?
Yes. You have a right to request corrections to inaccurate medical records. Contact the provider's records department with your evidence and a formal written request for amendment. Keep copies of everything.
Will medical identity theft affect my future medical care?
It can. If another person's health conditions, medications, or allergies are on your record, a clinician consulting your records in an emergency may make decisions based on that incorrect information. Correcting inaccurate records is therefore a health priority, not just a financial one.
My child's identity was used — what do I do?
Children's records are particularly at risk because they may not be accessed or reviewed for years. Contact your insurer, file reports with your national fraud authority, and check your child's credit report — children are increasingly targeted because their clean credit makes fraud easier.
I received a data breach notification from a healthcare provider — what should I do?
Review your medical records and insurance statements for the period since the breach. Place a fraud alert with credit reference agencies. Follow the specific steps in the breach notification letter, which should include details of what data was exposed. Do not ignore these notifications.