Is That Really Your Supervisor? How to Spot the “Quick Question” Email Scam Targeting Clinicians

Two Friendly Emails, Zero Red Flags (at First)

Earlier this week, a clinician in our community opened an email that appeared to come from her clinical supervisor. It was short and polite. The sender wanted to clarify a few details before a meeting later that day and asked which number was best for reaching her. A second email repeated the request, asking her to confirm her direct contact details and her primary work number. Both were signed with her supervisor’s name. Nothing felt alarming. Supervisors do ask these things. But she paused and checked the sender’s address, and it did not match her supervisor’s. Both emails were phishing attempts. Her quick instinct stopped a scam before it started, and it is worth sharing what she noticed. She also did what too few people do, which is tell others about it, and that generosity is why we are writing this article.

What This Scam Is Called, and How It Works

Security professionals describe this as an impersonation scam, a form of business email compromise or spear phishing. It is a close cousin of what people often call social engineering, which means manipulating trust instead of breaking into a computer. The first email is usually harmless on purpose. Its only job is to get a reply, which confirms your address is active and that you respond to authority. Once you answer, the scammer may study your signature, request your cell number so they can move the conversation to text where filters cannot see it, and eventually ask for something with real consequences, such as gift card purchases, a payment, a login code, or client information.

The numbers show why this is worth your attention. The FBI’s Internet Crime Complaint Center received more than one million complaints in 2025, with reported losses of almost $21 billion. Phishing and spoofing made up about 19 percent of those complaints. Business email compromise alone accounted for roughly $3.05 billion in reported losses across 24,768 complaints, an increase of 15.5 percent in complaints from the year before.

Why Clinicians Are Especially Vulnerable

Therapists and other private practice clinicians are trained to be responsive, warm, and trusting. Those are wonderful qualities in a session room and exactly the traits scammers count on in an inbox. Many clinicians also work in small settings without an IT department. Pre-licensed clinicians may feel extra pressure to answer a supervisor quickly, since supervision hours and professional standing depend on that relationship. Add the fact that your email holds protected health information, and a single careless reply can become a compliance problem as well as a security one. Supervision relationships are also public in many ways. A supervisor’s name may appear on a licensing board directory, a group practice website, or a professional profile, which gives scammers an easy way to find names to borrow.

Healthcare data supports the concern. In a 2026 survey of 170 U.S. healthcare IT leaders, Paubox reported that 58 percent of organizations had been breached through email in the previous 24 months. An earlier Paubox survey found that 68 percent of healthcare leaders had experienced a phishing attack in the past year, yet only 5 percent of known phishing attacks were reported by employees. In other words, many attempts go unreported, so others in the same practice never get a warning.

The Business Case for a Two-Minute Pause

A scam like this can cost a practice money, client trust, and time. If a scammer reaches your email account, they can read client messages, impersonate you to your own referral sources, or lock you out of the tools you use to run your practice. Recovering from that takes far longer than two minutes. Building a simple verification habit protects your license, your clients, and the reputation you have worked hard to build. It also costs nothing, which matters when every dollar in a small practice is accounted for. Just as important, sharing what you see helps colleagues in your network avoid the same trap.

Your Action Plan: 6 Steps to Stay Safe

1. Pause before you reply. Messages that ask a quick question, create mild urgency, or ask for discretion are designed to make you act without thinking. Take a breath and read the email again. Ask yourself whether this person would normally contact you this way.
2. Check the real sender address. Look past the display name to the actual email address. Watch for free email accounts, look-alike domains with swapped or added letters, and any warning banner from your email provider.
3. Notice what is being asked. Requests for your phone number, login codes, payments, gift cards, or client information in an unexpected message deserve extra scrutiny, even when they sound routine.
4. Verify through a second channel. Call or text your supervisor using a number you already have, or ask in person. Never use contact details provided in the suspicious email.
5. Agree on a verification habit. Talk with your supervisor or practice owner about how you will confirm urgent or unusual requests, such as a quick call or a code word. A shared habit removes the guesswork.
6. Report it, then delete it. Tell your supervisor or practice leader, forward the email to reportphishing@apwg.org, and report it at ReportFraud.ftc.gov. Then delete the message. If you already replied or clicked, change your passwords, turn on two-factor authentication, and ask your compliance contact whether client information could be involved.

Download a FREE PDF to help you know how to spot a Phishing email and what to do about it.

The Bottom Line

You do not need to become a cybersecurity expert to protect your practice. You only need a pause, a second look at the sender, and a quick check through a different channel. The clinician who spotted these emails did exactly that, and her story is a reminder that attention is a powerful defense. Scammers rely on speed and politeness, so slowing down is the simplest way to take away their advantage. We have created a printable checklist to keep near your desk. Share it with your supervisor, your colleagues, and anyone on your team.

Ready to grow your practice and connect with like-minded clinicians?

Sign up for free and connect with other clinicians in your city: https://sananetwork.com/join/

Photo by CHUTTERSNAP on Unsplash

Written by AI & Reviewed by Clinical Psychologist: Yoendry Torres, Psy.D.

Disclaimer: Some blog posts may contain affiliate links, earning Sana Network a commission at no additional cost to you. These recommendations reflect our honest opinions about products or services we find helpful and trustworthy. This content is informational and not legal nor medical advice; consult an attorney or healthcare provider for personalized guidance.