How to Spot a Phishing Payment Request Before You Wire a Cent

According to the FBI’s Internet Crime Complaint Center, business email compromise and phishing scams cost victims over $2.9 billion in 2023 alone. Medical travelers are a growing target. You are already navigating an unfamiliar healthcare system, dealing with time pressure, and often communicating across languages and time zones. A phishing payment request exploits exactly that confusion. The email looks legitimate. The invoice looks real. And the money disappears into an account that has nothing to do with the hospital you thought you were paying.

Our team at China Medical Services has seen the damage up close. A patient once forwarded us an “updated payment instruction” that arrived days before her scheduled surgery in Shanghai. The sender used the hospital’s logo, a plausible email address, and even referenced her real patient ID. The only difference? The bank account belonged to a shell company in a third country. She nearly wired $18,000 to a fraudster. That is why we wrote this guide. You need to know what a phishing payment request looks like, how it reaches you, and what to do the moment something feels off.

The Problem: Medical Travelers Are Prime Targets for Payment Fraud

Think about what a scammer needs to succeed. They need a victim who is under stress, facing a deadline, and not entirely sure what the legitimate process looks like. International patients check every box. You are arranging treatment in a country where you may not speak the language. You have a surgery date approaching. You have already paid deposits for flights, hotels, and consultations. One more wire transfer feels routine. That is the trap.

The FBI’s 2023 Internet Crime Report recorded 21,489 complaints of business email compromise with adjusted losses of $2.9 billion. But those are just the cases reported by American victims. Medical travelers from the UK, Australia, the Middle East, and Southeast Asia face the same schemes. Scammers know that a patient scheduled for cardiac surgery in Beijing or oncology treatment in Guangzhou has a lot on their mind. They also know that international bank transfers are difficult to reverse. Once the money moves, it is usually gone.

How do scammers get your information? Sometimes they hack a hospital’s email system. Sometimes they target a travel agency or medical facilitator. Sometimes they simply scrape public forums where patients discuss their plans. The details they cite do not prove they are legitimate. They prove they did their homework.

Why Medical Payment Scams Succeed

The mechanics of these scams are not sophisticated. The psychology is. Here is what makes a phishing payment request work so well against medical travelers.

Urgency Overrides Caution

A legitimate hospital in China will typically require payment before admission. That is standard practice for international patients. Scammers exploit this. Their emails say things like “Your surgery slot will be released if payment is not received within 48 hours.” Or “We have a cancellation and can move you to an earlier date, but the deposit is due today.”

When you have waited months for a procedure, the fear of losing your slot is real. So you act. But that urgency is a red flag. Real hospitals want your payment, yes. But they do not threaten to cancel your treatment within hours over a banking delay. They understand international transfers take time.

Authority Looks Convincing

Scammers impersonate people you already trust. Your doctor. Your coordinator. The hospital’s international patient department. They use real names, real job titles, and sometimes real email signatures copied from previous correspondence. A patient who has been emailing a coordinator named “Li Wei” for months will not question an email signed “Li Wei” requesting an updated payment method.

But look closer. The email address might be [email protected] instead of [email protected]. The signature might have a slightly different phone number. The logo might be pixelated. These details are easy to miss when you are reading on a phone at 2 a.m.

Language Barriers Create Cover

If you do not read Chinese, you cannot easily call the hospital’s main line and verify a payment instruction. You rely on the person who contacted you. Scammers know this. They often target patients from English-speaking countries precisely because the verification path is harder. A fraudster pretending to be a hospital billing clerk can send an email in polished English and count on the fact that you will not call the hospital’s Chinese-language switchboard to double-check.

How to Spot a Phishing Payment Request: The Red Flags

This is the section you came for. Here are the specific signs that a payment instruction is fraudulent. None of these alone proves a scam. Two or more together should stop you from sending any money.

Changed Bank Account Details

The single most common phishing tactic is the “updated banking information” email. You receive a message saying the hospital’s account has changed, or that their primary account is under audit, or that you should send payment to a different account “to avoid delays.”

Hospitals do not change bank accounts casually. A major public hospital in China has banking relationships that have been stable for years. If you receive a change-of-account notice, treat it as a phishing payment request until proven otherwise. Call the hospital directly using a phone number from their official website — not from the email you just received.

Personal or Third-Party Account Names

Legitimate hospital payments go to accounts held by the hospital itself. The account name will match the hospital’s legal name. A request to wire money to an individual’s name, a trading company, a travel agency, or a “processing agent” is a massive red flag. We have seen phishing requests that ask patients to send money to accounts in Hong Kong, Singapore, or Turkey — never to the hospital’s account in mainland China.

Ask yourself: why would Peking Union Medical College Hospital ask me to pay a company in another country? They would not.

Pressure to Use Untraceable Methods

Wire transfers are standard for international medical payments. But scammers increasingly ask for payment via cryptocurrency, gift cards, or peer-to-peer apps. No legitimate Chinese hospital accepts Bitcoin for a surgery deposit. If someone asks you to pay in a way that cannot be traced or reversed, that is a phishing payment request. End the conversation.

Spoofed Email Addresses and Domains

Look at the sender’s email address character by character. Scammers register domains that look almost right. A legitimate email from Fuwai Hospital might come from @fuwaihospital.org. A fake might come from @fuwai-hospital.org or @fuwaihospital.net or @fuwaihospital.org.cn. The difference is one character.

Also check the reply-to address. Some phishing emails are sent from a legitimate-looking address but have a different reply-to field. When you hit reply, your message goes to the scammer.

Requests for Full Payment Upfront

Chinese hospitals typically require a deposit to secure a surgery date, then the balance upon admission. The exact structure varies. But a request for 100% of the treatment cost before you have even arrived in China is unusual. It is even more suspicious if the request comes with a discount for “early payment in full.” Legitimate hospitals do not offer flash-sale pricing on surgeries.

Verification Checklist: What to Do Before You Send Money

You do not need to be a cybersecurity expert to protect yourself. You need a process. Here is the one we recommend to every patient we work with.

First, slow down. A phishing payment request depends on speed. The scammer wants you to act before you think. Tell yourself: no legitimate hospital will cancel my surgery because I took 24 hours to verify a payment instruction.

Second, verify through an independent channel. If the payment instruction arrived by email, do not verify by replying to that email. Call the hospital’s international patient department using the phone number on their official website. If the instruction arrived by WhatsApp, do not verify by messaging back on WhatsApp. Send an email to the address you have used throughout your correspondence. Independent channels are the key.

Third, check the account details. The account name must match the hospital’s legal name. The bank must be a real, verifiable institution. The account location should make sense. A hospital in Chengdu should not be asking you to wire money to a bank in Dubai.

Fourth, ask for a formal invoice on hospital letterhead. Legitimate hospitals issue receipts and invoices with their tax registration numbers. A phishing payment request often comes with a generic invoice that lacks these details.

What a Legitimate Payment Process Looks Like in China

Understanding the normal process helps you spot the abnormal. When you arrange treatment at a top-tier Chinese hospital, here is what typically happens.

The hospital’s international patient department or VIP clinic issues a formal cost estimate. This estimate lists the procedure, the expected hospital stay, and the estimated total. You pay a deposit — usually a portion of the estimate — to the hospital’s official bank account. The account name matches the hospital. The bank is in mainland China. You receive a receipt with the hospital’s official stamp.

When you arrive, you complete registration and pay the remaining balance at the hospital’s cashier desk or through their official payment portal. Some private international hospitals in China, such as those listed on our private hospital directory, accept international credit cards and offer direct insurance billing. Public hospitals generally require bank transfer or cashier payment.

If a payment process deviates from this pattern, ask why. If the explanation is confusing, vague, or urgent, stop.

Real-World Scenarios: Phishing Payment Requests We Have Seen

Here are three scenarios based on actual cases our team has encountered. The names are changed, but the patterns are real.

Scenario 1: The Hijacked Coordinator Account

A patient from London was scheduled for orthopedic surgery at a hospital in Shanghai. She had been emailing with her coordinator for six weeks. One day, she received an email from the coordinator’s address saying the hospital’s bank account was “under audit” and she should send her $15,000 deposit to a different account. The email looked exactly like all the others. Same signature. Same tone.

What she did not know: the coordinator’s email had been compromised. The scammer was reading the entire conversation and chose the perfect moment to strike. The patient wired the money. It was never recovered.

The lesson: even a legitimate-looking email from a known contact can be a phishing payment request. Always verify account changes through a second channel.

Scenario 2: The Fake Cancellation Threat

A patient from Australia was waiting for a cardiac procedure at Fuwai Hospital in Beijing. He received a text message claiming to be from the hospital’s billing department. The message said his surgery date had been moved up by two weeks due to a cancellation, but he needed to pay the full balance within 48 hours to secure the new slot.

The text message included a link to a payment portal. The portal looked professional. The patient clicked the link, entered his payment details, and authorized a transfer of $22,000. The portal was fake. The money went to a fraudster’s account.

The lesson: hospitals do not move surgery dates forward and demand immediate payment via text message. A real scheduling change comes through official channels with paperwork.

Scenario 3: The “Discounted Package” Offer

A patient from the United States was researching cancer treatment options in China. She received an email from someone claiming to be a “medical tourism consultant” offering a package deal: treatment, hotel, and translation services for $35,000 — a “special rate” if she paid within 72 hours.

The email looked professional. The consultant’s name sounded legitimate. But the payment was requested to a personal account in the Philippines. The patient contacted us before sending money. We confirmed the offer was fraudulent.

The lesson: be wary of unsolicited offers that bundle medical treatment with travel services at a discount. Legitimate hospitals and facilitators do not operate this way.

Practical Considerations: Protecting Yourself Before, During, and After Payment

Here are the concrete steps you should take at each stage of your medical travel journey.

Before You Pay Anything

Research the hospital independently. Look for the hospital’s official website and verify the contact information there. If you are working with a facilitator, check their credentials. Ask for references. A legitimate medical travel coordinator will be happy to provide them. Our team at China Medical Services always encourages patients to verify our hospital partnerships independently before committing to anything.

Set up a dedicated email address for your medical travel correspondence. Do not use your primary email. If that address is compromised, the damage is contained. Enable two-factor authentication on that email account.

Tell your bank about your plans. Banks have fraud detection systems. If you tell them you will be wiring money to a hospital in China, they can flag unexpected transactions. If a scammer tries to redirect your payment to a different account, your bank may catch it.

During the Payment Process

Always double-check the account details character by character. A single digit wrong in a bank account number can send your money somewhere else. Scammers sometimes use account numbers that differ from the real one by one or two digits, hoping you will not notice.

Use a wire transfer, not a peer-to-peer app. Wire transfers leave a paper trail. They can sometimes be recalled if you act quickly. Peer-to-peer transfers are usually irreversible.

Keep records of every communication. Save emails, text messages, and screenshots. If something goes wrong, these records are your evidence.

After You Pay

Confirm receipt with the hospital directly. Call the international patient department and ask them to confirm they received your payment. Do not rely on an email confirmation — call.

Monitor your bank account for unusual activity. If you shared any payment information with a suspicious source, alert your bank immediately. They can freeze your account or reverse a transaction if you act fast enough.

Report any suspected phishing payment request to your local law enforcement and to the hospital. Hospitals want to know about scams using their name. They may issue warnings to other patients.

Frequently Asked Questions