How This Actually Works, Step by Step

Before you ever see a payment portal, a sequence of events should have already happened. If a payment link arrives without these steps, that itself is a red flag.

First, you submit medical records. A real hospital or a legitimate coordinator reviews them. A doctor or department head confirms that your case is treatable. You receive a written treatment plan. You might have a video consultation. Only then does billing appear.

The billing step itself follows a pattern. The hospital’s international department or billing office issues an invoice. That invoice contains the hospital’s official name, a patient ID, a breakdown of estimated costs, and payment instructions. The instructions usually list bank transfer details or a link to the hospital’s own payment page. Some hospitals use third-party payment processors. Some accept card payments through their WeChat or Alipay official accounts. But the payer always verifies the recipient.

Here is the sequence we recommend:

• Confirm the sender’s email domain matches the hospital’s official domain exactly.
• Call the hospital’s international department using the phone number from the official website — not the number in the email.
• Ask the billing office to confirm the invoice number and amount.
• Check the payment URL character by character against the hospital’s published payment page.
• Never pay through a link sent via WhatsApp, WeChat, or SMS unless you independently verified it.

That last point matters. Scammers love messaging apps because links are harder to inspect on a phone screen.

Is a Payment Portal Phishing? Find Out with These Checks

Phishing attacks against medical travelers are more sophisticated than generic bank scams. Attackers often intercept real email threads. They register domains that look nearly identical to hospital domains. They copy invoice templates. They know the patient’s name, diagnosis, and quoted price. That level of detail makes the phishing email feel legitimate.

So how do you actually determine whether a payment portal is phishing? Start with the sender.

Look at the full email header. The display name might say “Peking Union Medical College Hospital Billing.” But the actual address could be [email protected] instead of the real domain. One missing letter. One added word. That is enough.

Next, look at the link itself. Hover over it on a computer. On a phone, press and hold to preview the URL. Does it start with https://? Does the domain match the hospital’s official site? A real hospital payment portal for a Chinese public hospital will almost always live on the hospital’s own domain or a clearly affiliated payment subdomain. It will not be a random link-shortener. It will not be hosted on a generic platform like payment-gateway.xyz.

Also check the language. Real Chinese hospital billing emails often include both Chinese and English. But broken English alone is not proof of fraud — many legitimate hospitals have imperfect translations. What matters more is the payment path. If the email asks you to wire money to an individual’s personal bank account, stop. That is not how hospitals bill. If the email asks you to pay in cryptocurrency, gift cards, or through a money transfer agent, it is a scam. No legitimate Chinese hospital accepts those methods.

One more check: the amount. If the invoice amount differs from what the hospital quoted, even by a few hundred dollars, verify before paying. Scammers sometimes alter the amount on a real invoice. A small change is easier to miss.

But what if the portal itself looks real? Some phishing portals are perfect copies of the hospital’s login page. The only difference is the URL. That is why the domain check matters more than the design.

A Realistic Timeline

Paying for medical care in China does not happen in one click. Even after you verify the portal, the process takes time. Here is a realistic timeline from first contact to confirmed payment.

The step people forget is verification. You will spend at least a day or two confirming the payment details. That is not wasted time. It is the difference between funding your surgery and funding a criminal.

And the timeline shifts. Some hospitals issue invoices within a week. Others take three weeks. Some patients pay a deposit first, then the balance after admission. The key is that no legitimate hospital pressures you to pay within hours.

What Can Go Wrong — and What Happens Then

Several things can go wrong even when you are careful. The most common is a spoofed email that arrives in the middle of a real conversation. You have been emailing the hospital for two weeks. Then a slightly different address replies with a payment link. You pay. The money is gone.

What happens then? If you wired funds to a fraudulent account, recovery is difficult. Banks can sometimes freeze the receiving account if you act within 24 to 48 hours. After that, the money often moves through multiple accounts and disappears. You should report the fraud to your bank, to the hospital, and to local law enforcement. But the realistic outcome is that the funds are not recovered.

Another failure mode: the hospital’s payment portal itself is legitimate, but your card is declined. Chinese payment gateways sometimes reject foreign cards. In that case, the hospital may offer an alternative: a bank transfer, a different processor, or payment through a coordinator. Verify any alternative just as carefully as the original.

Sometimes the invoice contains an error. Wrong patient ID. Wrong amount. Wrong procedure code. If you pay an incorrect invoice, the hospital may not match the payment to your file. That delays admission. Always confirm the invoice number and patient ID before paying.

And there is the uncomfortable scenario where a patient pays a deposit, then the hospital postpones admission. It happens. Hospitals in China are busy. A bed may not be available on the promised date. In that case, the deposit is not lost — it is held. But you may need to adjust your travel dates. Working with a coordinator who can communicate with the hospital in Chinese helps resolve these delays faster.

How to Evaluate a Payment Portal Before You Pay

Beyond the basic URL and sender checks, there are structural signals that separate real hospital billing from phishing.

Real Chinese hospitals invoice through their official financial systems. The invoice usually includes a hospital logo, an invoice number, a tax registration number, and a breakdown of charges. The payment portal is either a page on the hospital’s own website or a link to a bank’s verified payment page. If the portal asks you to create an account with a password before showing any invoice details, be suspicious. If it asks for your passport number, bank login, or credit card CVV on the first page, stop.

Legitimate portals do not ask for your bank’s online login credentials. They do not ask you to download a remote-access app. They do not ask you to confirm a code sent to your phone as a condition of viewing the invoice. Those are classic phishing techniques.

Also consider the payment method. Chinese public hospitals generally accept bank transfer, UnionPay, Alipay, WeChat Pay, and sometimes international credit cards through specific processors. Private international hospitals in China — such as United Family or Jiahui — often have more Western-style billing and may accept direct insurance billing. You can see the difference in how they present payment options. A hospital that only accepts payment through a single unfamiliar third-party website is a warning sign.

If you are working with a medical coordinator, ask how they handle payments. Do they ask you to pay the hospital directly? Or do they ask you to pay them, and they pay the hospital? Both models exist. But if the coordinator asks you to wire money to a personal account, walk away. Legitimate coordinators use business accounts and provide invoices.

The same logic applies to deposits. Some hospitals require a deposit to secure a surgery date. The deposit might be 10 to 30 percent of the estimated cost. But the deposit should be paid to the hospital, not to an individual. And the invoice should clearly state that it is a deposit against a specific treatment plan.

Practical Considerations: Records, Visa, Payment, and Follow-Up

Before you pay anything, you need your records in order. Hospitals in China require recent imaging, lab results, and a referral or summary from your home doctor. If your records are not in English or Chinese, you will need certified translation. That takes time and costs money. Budget for it.

Visa matters too. For medical treatment in China, the applicable short-stay category is the S2 visa, annotated for medical purposes. Family members accompanying you also apply for S2. The S2 visa requires supporting documents from the hospital, including an invitation or treatment confirmation letter. You cannot get the visa without hospital documents. And you should not pay the full treatment cost before your visa is approved. A deposit may be necessary, but the full payment can usually wait until visa confirmation.

Insurance is another layer. Most international insurance plans reimburse after treatment rather than paying the hospital directly. That means you pay out of pocket first. Public hospitals in China generally require prepayment or a deposit before admission. Private international hospitals may bill your insurer directly. Check your policy before you commit.

Language is the final practical issue. When you call the hospital to verify a payment portal, the billing office may not have English-speaking staff. That is one reason patients use a bilingual medical companion or coordinator. The companion can call the billing office, confirm the invoice, and translate the payment instructions. That service typically starts around $300 per day. It is a fraction of what a phishing loss would cost.

After payment, keep every receipt. You will need proof of payment for the hospital, for your visa application, and for insurance reimbursement. Store the invoice, the bank confirmation, and the email thread in one place.

Frequently Asked Questions