Recognise the verification trigger
Slow down when a message says that a coordinator, hospital, insurer, or payment desk has changed its account, needs an urgent deposit, or requires an immediate “verification.” A message can copy a real name, signature, logo, language style, or a genuine appointment detail and still be unauthorised. The trigger is not the tone; it is the request to act before you can independently check it.
Do not open an unexpected attachment, scan an unfamiliar code, install remote-control software, or move the conversation to a private account merely because the sender says it is faster. Keep the message, sender address, time, and requested action as evidence. Remove passport numbers, full card details, and medical information from any screenshot before sharing it for review.
Pause the conversation without confirming secrets
Reply only with a neutral boundary if a response is necessary: you will verify the request through the contact details already on your appointment letter, invoice, or official website. Do not disclose whether a code has arrived, what your account balance is, or which bank you use. A genuine staff member should be able to wait for an independent check rather than demanding proof in the same chat.
Never share a one-time password, card security code, online-banking password, or screen-sharing view with a coordinator or an alleged bank representative. The National Financial Regulatory Administration identifies these credentials as sensitive information and advises consumers to verify through official customer-service channels. This article does not label a particular person or organisation as fraudulent; it gives a process for checking identity.
Verify through two known records
Use a contact route you already possessed before the new message: the hospital’s published switchboard, the billing contact printed on an issued invoice, or the coordinator address saved from an earlier confirmed exchange. Ask whether the message was sent, whether the payment details changed, and which authorised department owns the request. Do not use a phone number or link copied from the suspicious message to perform the check.
For a payment change, seek confirmation from both sides when practical: the authorised hospital cashier or billing office confirms the beneficiary and invoice, while your card issuer or bank confirms its own security requirements. Ask for written confirmation that states the legal or registered payee name, amount, currency, reference, and expiry of the instruction. A coordinator may relay information but should not be the sole authority for a changed bank account.
Respond if access or money may be exposed
If you entered a password, approved a payment, exposed a screen, or disclosed a code, stop communicating with the unknown sender and contact the relevant bank or payment platform through its official channel immediately. Ask what protective steps are available, such as blocking a card or reviewing activity; follow the institution’s instructions rather than trying to reverse a transaction through a stranger. Preserve chat logs, headers, receipts, and screenshots.
If money moved or an account was taken over, report it promptly to the bank and the appropriate local authorities, using the emergency route they publish. An article published on the CAC website warns against fake customer-service contacts that solicit sensitive details or transfers. Do not pay a second “recovery fee,” and do not publish case details containing identity documents or financial credentials.
Keep a trusted communication map
Maintain a small list created before travel: the hospital website, official billing desk, confirmed coordinator address, card issuer number, insurer contact, and the person at home who can help compare messages. Note when each route was independently checked. When a real administrative change is confirmed, archive the old and new details with the date and the confirming role, without retaining unnecessary personal data.
A useful final check asks: who initiated the change, which known record confirms it, what exact service or invoice does it relate to, and what happens if you wait? If those answers are not clear, pause. This boundary protects your consent and information; it does not assess the quality of medical care, guarantee a payment outcome, or replace the hospital’s own identity and billing controls.
