Phishing used to be easier to laugh at. You would get an email from “Totally Real Bank Person,” notice three spelling errors, a weird logo, and a promise that your account would explode in 14 minutes unless you clicked a suspicious link. Not exactly subtle.

That version still exists, but phishing has changed. A lot. Today’s attacks are cleaner, better written, more personalized, and much better at blending into normal work. Security agencies and major defenders have warned that modern phishing increasingly relies on impersonation, stolen context, spoofed calls, and trusted login workflows rather than obvious “bad grammar and panic” tactics.

For employees in medical practices, that matters. Your inbox is full of referrals, labs, billing questions, patient messages, vendor notices, fax-to-email alerts, and password resets. In other words, your day is already busy and weird. Attackers know that. They are designing phishing messages to look like just one more normal interruption.

One big change is that phishing emails now look polished. Thanks in part to easy-to-use AI tools and better social engineering, many fake messages no longer scream “scam” on sight. They read like normal business communication. The tone is cleaner. The formatting is better. The sender may appear to be a coworker, manager, vendor, or cloud service you already use. That means “it looked professional” is no longer a useful safety test.

Another tactic getting more common is thread hijacking. Instead of sending a random message out of nowhere, attackers compromise a real mailbox and reply inside an existing email chain. So now the fake message arrives in a conversation you recognize, with the right subject line, and maybe even real names from your workplace. That is much harder to detect than the old “Dear valued customer” nonsense.

Phishing is also moving beyond plain email. Proofpoint reported that URLs are now used far more often than attachments in malicious emails, smishing texts frequently contain malicious links, and QR-code threats surged in 2025. In practice, that means the trap may be a text message about a secure fax, a QR code on a printed notice, or a link to “review a document” rather than a sketchy attachment.

And then there is the “trusted login” problem. Some newer campaigns abuse real authentication workflows so the page or prompt feels legitimate. Microsoft recently described phishing that weaponized OAuth redirection, using trusted sign-in experiences to move users from legitimate pages to attacker-controlled infrastructure. Microsoft also reported an AI-enabled device-code phishing campaign in April 2026 that automated authentication abuse at scale. Translation: attackers are getting better at hiding inside processes that look familiar.

Phone calls are getting smarter too. CISA has warned about phishing campaigns that impersonate supervisors and trusted colleagues and use caller-ID spoofing. The FTC has also warned about voice cloning, where scammers can make a call sound like a real person to pressure victims into acting fast. So yes, “it sounded like my boss” is no longer the reassuring sentence it used to be.

Why does this matter so much in a medical practice? Because a successful phishing attack is not just an IT headache. If an attacker gets into email, an EMR-adjacent account, file storage, or another staff system, that can expose electronic protected health information. HHS OCR has already announced enforcement tied to a phishing attack that exposed unsecured ePHI, and HHS continues to publish healthcare cybersecurity guidance because these risks are very real for covered entities and business associates.

So what should employees watch for now?

Look for urgency, but do not stop there. Check whether the message is trying to get you to log in, approve MFA, scan a QR code, open a shared file, or pay attention right this second. Be suspicious of messages that arrive in familiar threads but ask for something slightly unusual. Treat texts and calls with the same caution you would give email. And if a message wants credentials, payment, or sensitive information, verify it another way before doing anything.

The old phishing red flags have not disappeared. They just got dressed better.

That is the real shift. Modern phishing is not always loud, sloppy, or ridiculous. Sometimes it is calm, polished, and alarmingly normal. Which means the best defense is not spotting bad grammar. It is slowing down, verifying requests, and refusing to trust a message just because it looks like it belongs in your workday.

Because these days, the scammer may not sound like a scammer at all.