On November 18, 2022, the U.S. Department of Justice (“DOJ”) announced charges against ten defendants across Georgia, South Carolina and Virginia, resulting from a scheme that allegedly targeted Medicare, state Medicaid programs, private health insurers and numerous other victims with multiple Business Email Compromise Schemes (“BEC”) and resulted in more than $11.1 million in total losses.

The alleged schemes primarily involved the fraudulent diversion of payments intended for hospital providers. The defendants created spoofed email accounts resembling those associated with legitimate businesses and hospitals in order to pose as their business partners to unwitting victims. Using these spoofed email accounts, the defendants contacted both public and private health insurance programs and requested that future reimbursement payments be sent to new bank accounts.

As a result of these schemes, five state Medicaid programs, two Medicare Administrative Contractors and two private health insurers unknowingly made reimbursement payments to accounts controlled by the defendants or their co-conspirators instead of accounts that belonged to hospitals. These alleged schemes resulted in more than $4.7 million in losses to Medicare, state Medicaid programs and private health insurers, and another $6.4 million in losses to other federal government agencies, private companies and individual victims.

As part of the DOJ’s announcement, U.S. attorneys from various districts spoke to their commitment to prosecute persons who exploit and defraud the Medicare and Medicaid programs. BEC compromise schemes have become increasingly common in all industries, including the health care sector. Companies should be proactive in monitoring for cyber threats and engage in regular training designed to raise internal awareness and minimize the risk of a BEC incident.