Fake IT Support and Voice-Clone Scams in Dental Offices (2026)

The phone rings between patients. The caller says he is with your IT company, something is "wrong on the server," and he needs whoever is at the desk to click a link so he can connect. He knows the company's name because he called earlier and asked. An Ohio dental IT provider described that sequence in 2018 after a receptionist caught it: a caller "inquired who their IT vendor was," hung up, and "called back later in the day claiming to be an employee of 3C." The script has not changed; the voices on the line have.

This guide is for the office manager who runs the front desk and has just had one of these calls, or wants a rule in place before one comes. It covers how to tell a real support contact from a fake one, the seven scripts that reach dental offices, what the FBI and FTC counted in 2024 and 2025, how AI voice cloning changes the vendor and doctor-impersonation versions, a verification protocol the desk can follow under pressure, what to do in the first 30 minutes after a slip, and the controls your IT provider should already have in place so that a convincing caller still gets nowhere. Every government and vendor page quoted here was read on 6 November 2026.

How can you tell a real support call from a fake one?

A real support contact is one you started: you opened a ticket, a vendor is calling back about it, and the technician can name the ticket. A fake one starts with them, carries urgency, and asks for a new remote tool, a password, a code or a payment. Caller ID proves nothing either way, because it can be spoofed.

Two of your real vendors publish how they actually work, which is useful at the desk. Dentrix lists its support phone as 800.336.8749 for the United States and says chat "is available Monday–Thursday from 6am-6pm MST, and on Friday from 6am-5pm MST." Open Dental lists (503) 363-5432 for support and says to use its remote connection options only when an Open Dental support technician directs you to. Neither page describes a service that calls offices unprompted to request remote access. If a caller claims to be either company, the right move is the same as for anyone else: hang up and dial the published number yourself.

What do fake IT support scams look like at a dental front desk?

Seven scripts account for almost every fake support contact a dental office receives: the IT-provider callback, the software-vendor "update," the pop-up with a phone number, the emailed remote tool, the sign-in-code "verification," the cloned voice of the doctor, and the vendor banking change. Each has one tell the desk can learn.

The FBI's definition is short: "Tech/Customer Support Fraud: Subject posing as technical or customer support/service." At a dental office the subject usually poses as one of five things: your IT company, your practice management or imaging vendor, Microsoft, your bank, or the doctor. Here is how each script opens and where it gives itself away.

One cousin of script 2 arrives without a call: a search result, advert or pop-up offering a "Dentrix update," a "printer driver" or a "free PDF tool" that is really an installer. The rule is the same as for a caller: updates and new programs reach your computers only through your IT provider or the vendor's own portal, never from a download someone found. Scripts 1 to 5 are about getting onto a computer or into an account. Scripts 6 and 7 are about moving money, and they increasingly use the same voice technology. The next two sections give the size of the problem and then the voice-cloning mechanics.

How much money do tech support scams actually take?

Reported losses to tech support scams in the United States grew from $1.46 billion in 2024 to $2.13 billion in 2025, on 47,794 complaints, according to the FBI's Internet Crime Complaint Center. Business email compromise added $3.05 billion in 2025. These are only the losses people reported, so the real figure is larger.

Where the money went matters for a dental office. The FBI's 2025 report says that, in the ranking of loss, tech support fraud sat behind only investment fraud and business email compromise. It also records that the Bureau's Recovery Asset Team "saw a rise in Tech Support and Account Takeover (ATO) initiations" in 2025, and that it froze $679 million of $1.16 billion in attempted theft across 3,900 incidents, a 58 percent success rate. That number is the reason the "what to do afterwards" section below starts with a phone call to your bank, not to IT.

None of these reports counts dental offices separately. What they do show is that the two scripts that reach a front desk most often, the fake technician and the fake payment instruction, are the second- and third-largest categories of reported loss in the country.

Why does the front desk get these calls?

The front desk is targeted because it is reachable, helpful and powerful: the main number is public, the person answering is trained to solve problems quickly, and that person can see the schedule, the practice software, payer portals and the card terminal. One cooperative call can hand over more than a week of hacking would.

CISA describes the method plainly: "In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems." It adds that the attacker "may contact another source within the same organization and rely on the information from the first source to add to his or her credibility." That is the IT-provider callback in one sentence. The first call collects the vendor's name; the second call spends it.

Three things make a dental office easier than most small businesses:

• • The desk knows every vendor by first name. Practice software, imaging, clearinghouse, phones, the lab, the IT company. A caller who can name two of them sounds like an insider, and the names are on your website, your job postings and your vendors' customer lists.
• • Shared logins and portals. Many offices sign in to payer portals and the clearinghouse with one shared account at the desk, which is exactly the login a caller asks to "verify." The companion guide on shared payer portal logins and MFA in dental groups explains why that habit makes the scam easier and how to end it.
• • Money moves at the desk. Refunds, card-on-file payments, deposits for appliances or equipment. One office manager put the worry into a search engine in October 2026: "how can medical clinics protect their refund process and front desk operations from cybersecurity scams?" The protocol below is the answer.

Caller ID makes it worse. The joint CISA, NSA, FBI and MS-ISAC phishing guide lists among common techniques: "Use voice over internet protocol (VoIP) to easily spoof caller identification (ID) which takes advantage of public trust in the security of phone services, especially landline phones." A call that shows your IT provider's number is not evidence that your IT provider is calling.

How does an AI voice-cloning scam reach the front desk?

A voice-cloning scam uses a short recording of someone the desk trusts, usually the doctor, an owner or a known vendor representative, to generate speech that asks for money or access. The FBI warns that criminals "obtain access to bank accounts using AI-generated audio clips of individuals and impersonating them." The defence is to verify the request, never the voice.

The FBI's December 2024 alert lists what it calls "AI-Generated Audio, aka Vocal Cloning." Two of its examples translate directly to a dental office. First: "Criminals generate short audio clips containing a loved one's voice to impersonate a close relative in a crisis situation, asking for immediate financial assistance or demanding a ransom." Replace "loved one" with the doctor and "crisis" with "I'm in surgery and the equipment deposit is due in an hour." Second: "Criminals obtain access to bank accounts using AI-generated audio clips of individuals and impersonating them." The FBI's 2025 report adds the business version: "Voice cloning can also be used to request wire payment," and records that "businesses reported losses over $30 million to BEC scams involving AI" in 2025.

The source material is not hard to find. Dentists speak on practice websites, patient videos, podcasts, continuing-education recordings and social media. A May 2025 FBI alert about a campaign that used "AI-generated voice messages" to impersonate senior officials notes that for vishing, "malicious actors are more frequently exploiting AI-generated audio to impersonate well-known, public figures or personal relations to increase the believability of their schemes."

The three versions a dental office should expect

1. 1. The doctor between patients. A call or voice message in the doctor's voice: a refund to a patient who "paid twice," gift cards for a staff gift, a deposit to a lab or equipment vendor, "I'll explain later." The number is new, blocked or "my personal cell."
2. 1. The regional manager or new partner. In a group or a practice that has just sold, a voice the desk has heard on two Zoom calls asks for a password reset, a new user "for the consultant," or the Wi-Fi and server details.
3. 1. The vendor representative. The rep from your software, imaging or billing vendor whose voice you know from webinars calls about "a billing problem" and asks for card details or a portal login.

What the FBI says to do, and how to adapt it

The Bureau's advice for families is to "Create a secret word or phrase with your family to verify their identity." A dental office can do the same: the doctor and the office manager agree a phrase that must be given before any payment, password or access request made by phone or voice message is acted on, and that phrase is never written in email or chat. Its other two tips are the backbone of the protocol below: "Verify the identity of the person calling you by hanging up the phone, researching the contact of the bank or organization purporting to call you, and call the phone number directly," and "Listen closely to the tone and word choice to distinguish between a legitimate phone call from a loved one and an AI-generated vocal cloning." The first tip is the one to rely on. The second is a last resort, because the FBI itself notes that cloned and real voices "can sound nearly identical."

What is the front-desk verification protocol?

The protocol is six steps that take about four minutes: pause and take details, hang up, call the number on file, confirm the ticket and the technician's name, connect only through the tool already installed while you are on the line, and log the call. Nobody connects, resets, pays or reads out a code on an inbound call.

Write it on a card, tape it beside the phone, and treat it as a procedure rather than a judgment call. Scammers are good at making a judgment call go their way; they are poor at surviving a four-minute delay.

1. 1. Pause and take details. Ask for the caller's name, company, ticket or case number and a call-back number. Say the office rule out loud: "We call every support request back on our number on file." A real technician expects this. Pressure to skip it is the first tell.
2. 1. Hang up. Do not press any key, click any link or call the number the caller or pop-up gave you. The FBI's tip is explicit: "Do not contact the telephone number provided in a pop-up, text, or email."
3. 1. Call the number on file. Your IT provider's helpdesk number, your software vendor's published support line, your bank's number from the back of the card. Keep these on the same card as the protocol so nobody has to search for them under pressure.
4. 1. Confirm the ticket and the person. Ask whether a ticket is open for your office and who is working it. If the answer is no, the first call was a scam; tell the provider what the caller said and asked for.
5. 1. Connect only through the tool that is already installed, and only while you are on the line. The FBI's rules are "Do not download software at the request of an unknown individual who contacted you" and "Do not allow an unknown individual who contacted you to have control of your computer." If a vendor needs a one-time remote session, it will direct you to its own page during the call you placed, as Open Dental's contact page describes.
6. 1. Log the call, even when nothing happened. Time, number shown, name given, what was asked. Send it to your IT provider the same day. A failed attempt today is often the rehearsal for a better one next week, and the FBI asks for complaints regardless of the amount lost.

Who may approve what: a decision table for the desk

The second row is the one that most often gets argued with. A caller who "just needs the code to lock the account" is finishing a login they started with a password they already have. The code is the last thing between them and your mailbox. The guide to password management for dental teams covers the account hygiene that makes this row easier to hold.

What should you do if someone already let the caller in?

Act in this order: note the time, call your IT provider on the number on file and ask whether to unplug the computer, change any password typed or spoken from a different device, and if money moved, call your bank immediately and ask for a recall. Then report it, and tell your privacy officer if patient information was shown.

Most offices discover a slip within the hour, often because the caller rang back for more. The first 30 minutes decide most of the outcome, and the steps are the same ones on the dental cybersecurity checklist for small practices, which has a printable card for the moment someone clicks a phishing link.

1. 1. Stop and write it down. Time, the number shown, what the caller said, what was clicked, installed, typed or read out. Do not close windows, uninstall anything or restart yet.
2. 1. Call your IT provider by phone, on the number on file. Ask whether to disconnect the computer from the network (pull the cable or turn off Wi-Fi) or leave it connected so they can look. Do not wipe or power it off unless they say so.
3. 1. Change passwords from a clean device. The FTC's advice for anyone who gave a username and password to a tech support scammer is to change that password right away. Do it from a phone or another computer, not the one the caller touched, and ask your IT provider to sign that account out of every session and review its MFA methods.
4. 1. If any money moved, call the bank before anything else. The FBI's instruction: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents." Then: "Regardless of the amount lost, file a complaint at www.ic3.gov."
5. 1. Report the attempt. File at the FBI's Internet Crime Complaint Center (ic3.gov) and at the FTC (ReportFraud.ftc.gov). If the caller posed as Microsoft, Microsoft also takes reports at microsoft.com/reportascam. Reports are what let banks freeze funds and let agencies connect your call to a campaign.
6. 1. If patient information was on the screen or was sent, tell your privacy officer the same day. Whether the event has to be assessed under the HIPAA breach notification rules is a decision for your privacy officer and counsel, with the written timeline from step 1 in front of them. It is not a decision for the front desk, and it is not one to postpone.
7. 1. Tell the team before lunch. The same caller will try the next person. A two-minute huddle ("a caller claiming to be from IT asked for a remote session; nobody connects anyone today without calling the helpdesk") closes the door.

If the incident involved a billing vendor or a clearinghouse rather than your own office, the companion guide on what to do when a billing vendor reports an incident covers the questions to send that vendor.

The IT side: what your IT provider should already have in place

A fake support call should fail even when the front desk is fooled, because the controls that sit behind the desk refuse the request. Those controls are one named remote tool with MFA and session logs, a block on unapproved remote installers, number-matching MFA, email authentication, a support card with real numbers, and dual approval for vendor banking changes.

Awareness training gets most of the attention, but these controls are the difference between a near miss and a breach.

One remote-support tool, named and locked down. Your IT provider should be able to name the single remote tool installed on your computers, show that technicians sign in to it with MFA, and show that every session is logged with the technician's name and time. If staff cannot name the tool, they cannot tell a stranger's tool from the real one.

Unapproved remote installers blocked. The emailed ScreenConnect installer described by a dental IT firm in July 2026 only works if the computer lets a new remote agent run. Application control (allow-listing) on front-desk machines, plus EDR that flags a fresh remote-access agent, stops script 4 without anyone noticing. The companion guide on EDR vs antivirus for dental offices explains what EDR sees that antivirus does not.

MFA that resists the "read me the code" call. The joint phishing guide names "Push-notification MFA without number matching" and "SMS or voice MFA" as weak forms that attackers defeat with exactly this kind of call. Ask for number-matching prompts in Microsoft 365 and, for admin and owner accounts, phishing-resistant methods. It also recommends prioritising "phishing-resistant MFA for administrator and privileged user accounts."

Unique logins everywhere, including the practice software. Open Dental's manual says it directly: "Every person who uses Open Dental should have a unique user name and password for logging on." A shared desk login is the account a caller asks you to "verify"; individual logins mean a stolen one can be disabled without stopping the office.

Email authentication on your domain. The same CISA guide recommends DMARC with DKIM and SPF so that mail pretending to come from your practice (the "invitation from your dentist" email that a patient's partner, a software engineer, took apart in June 2026) is rejected by receiving systems, and so you learn when someone spoofs your domain.

A support card with the real numbers. One laminated sheet by every phone: your IT helpdesk number, your practice software vendor's published support line (Dentrix publishes 800.336.8749; Open Dental publishes (503) 363-5432), your imaging vendor, your clearinghouse, your bank, and the office code phrase rule. Your IT provider should maintain it, because vendor numbers change.

Dual approval for money. Any change to a vendor's bank details, any refund outside the practice software and any wire needs two people and a call-back to a number from a previous invoice. This is a bookkeeping control, but your IT provider should know it exists, because the attacker's email often arrives through a compromised vendor mailbox that email filtering alone will not catch.

A monitored alert when a remote session starts outside hours. Legend provides 24/7 monitoring; whatever your provider offers, ask what alert fires when a remote session opens on a Saturday night and who answers it.

If your current provider cannot show you these, that review is what dental cybersecurity services should cover, and an office that would rather have the whole list run for it than audit it can ask what managed IT services for dental practices include.

How do you train the front desk on scam calls in 15 minutes?

A 15-minute huddle is enough to teach the protocol: read two of the scripts aloud, role-play the IT-provider callback and the cloned-voice request, then put the card by the phone and agree the office code phrase. Repeat for five minutes monthly, and log attendance for your cyber-insurance questionnaire.

Two details make the training stick. First, the owner has to say, in front of the team, "If I call asking for money or access and you make me wait while you call me back, you did the right thing." Without that sentence, the voice-clone script works. Second, keep a one-line attendance log with the date; the companion guide on dental cyber insurance requirements explains why insurers ask for it.

What to ask your IT provider about fake support calls

How Legend Networking can help

Legend Networking is a Dallas-based dental IT company that has served over 3,500 practices since 2004, with 22+ years in dental IT. The helpdesk is staffed 24/7 at 1-800-794-1588, one general number, which is the number a front desk should call back on, and Legend's engineers are in-house, with no outsourced first-level triage. Legend provides 24/7 monitoring.

The author, Ian Lynch, has 22 years in dental IT and oversees the NOC, onsite dispatch and client technology roadmaps. Legend holds a 4.8 rating from 173 Google reviews. For an example of the groundwork behind the controls above, see a technology onboarding that covered network and server review, security, backups, software and user access. Offices outside Dallas can find dental IT in your city on the locations page.