The front desk is checking tomorrow’s schedule when the browser fills with a warning. It uses a familiar software logo, says the computer is infected, and displays a support number. The phones are ringing. A patient is waiting. Calling the number can feel like the fastest way to get back to work.
That is exactly the decision a fake support alert is designed to provoke.
The Federal Trade Commission says tech support scams often begin with a bogus computer warning, including a fake pop-up that looks as if it came from a known company and urges the user to call for help.[1] Once the call starts, the impersonator may ask for remote access and pretend to scan the device.[1]
Dental employees should not have to decide whether the warning is technically genuine. They need a short response that protects patient information, keeps the report useful, and gets the computer to the right person.
Give staff one response card
Put a plain-language card beside each reception and business-office workstation. Keep the steps short enough to use while the screen is noisy:
- Do not call the number, select a link, pay a fee, or approve remote access.
- Stop typing and do not open the practice-management system, email, banking site, or password manager on that computer.
- Use another known-safe device or the office phone to contact the practice’s approved IT support number.
- Tell the practice manager what appeared and what you did before it appeared.
- Leave the computer in place for the approved support person unless your written procedure says to disconnect a specific cable or take another step.
The first line has a strong factual basis. The FTC says legitimate technology companies will not contact someone by phone, email, or text to announce a computer problem, and a real security pop-up will not ask the user to call a phone number.[1]
The remaining steps are a local procedure, so the practice should review them with its IT provider. For example, turning off a computer may remove useful short-lived information, while leaving a device connected may allow harmful activity to continue. Staff should not improvise that decision during a patient check-in. The response card should name who has authority to isolate or shut down a device and how to reach that person.
Separate the suspicious message from the support path
A fake alert often supplies its own solution: a phone number, chat box, download, or remote-access prompt. Do not use the contact path inside the warning.
The approved support path should come from somewhere the attacker does not control. Print the number on the response card, place it in the employee handbook, and store it in the office phone directory. If the practice uses a managed service provider, list the exact company name and normal verification method. CISA advises verifying an unknown person’s claimed identity directly with the organization they say they represent.[2]
This matters when the incident moves from screen to phone. A caller may know the dental software’s name, the provider’s name, or the office address. That information can make the story sound credible, but it does not prove the caller is authorized. Staff should end the conversation and start a new call through the approved number.
The same rule applies to search results. An employee who searches for a vendor’s support number may encounter an advertisement or imitation page. The response card should point to a known number or bookmarked support page rather than asking a hurried employee to search.
Report actions, not conclusions
“The computer has a virus” is a conclusion. “A full-screen alert appeared after I opened an email attachment, and I called the number but did not approve remote access” is a useful report.
Ask the employee to tell the practice manager or support contact:
- which workstation was involved;
- when the warning appeared;
- what was happening immediately before it appeared;
- whether anyone called, chatted, downloaded a file, entered a password, made a payment, or approved remote control;
- whether patient, financial, email, or administrative systems were open;
- the phone number, company name, or wording shown, if it can be recorded without further interaction.
Do not ask staff to click through the alert for a better screenshot. If the approved procedure allows a photo of the screen from another device, make sure it does not capture patient names, appointment details, or other sensitive information. The person receiving the report can decide what evidence is needed and how to collect it.
CISA recommends reporting possible disclosure of organizational information to the appropriate people, including network administrators.[2] The HIPAA Security Rule also requires covered entities and business associates to maintain security incident procedures that identify and respond to suspected or known incidents, mitigate harmful effects where practicable, and document incidents and outcomes.[4] Whether a particular event is a reportable breach or security incident requires a facts-and-circumstances review; the response card should route the facts, not make that legal determination.
Change the instructions when someone interacted
A staff member who only saw the pop-up needs a different response from someone who called the number, installed software, revealed a password, or allowed remote control.
Add a bold sentence to the card: “Tell us what happened, even if you clicked or called.” Blame slows reporting. A quick, accurate report gives the practice and its support team more options.
If remote access was approved, a password was entered, or a payment was attempted, staff should use a different known-safe device to make the report. The manager can activate the practice’s incident procedure and coordinate technical, privacy, legal, insurance, banking, or law-enforcement contacts as the facts require. Do not direct the employee to clean the system, uninstall a remote-access tool, or reset every password from the possibly affected workstation.
A response card is not an incident response plan. It is the first handoff into that plan.
Rehearse the handoff without tricking people
Show the team a fictional pop-up during a short staff meeting. Use a training image with no live links, phone numbers, scripts, or downloads. Ask each person to point to the approved IT number, describe what they would stop doing, and make a sample report.
Then change one fact. In the second version, the employee called but hung up before granting access. In the third, the employee approved remote control and had the scheduling system open. The exercise should test whether the report reaches the right person and whether that person knows who can make containment decisions.
NIST’s current learning-program guidance is written for large and small organizations and centers behavior change rather than one-time information delivery.[3] The HIPAA Security Rule requires a security awareness and training program for the workforce, including management.[4] A five-minute rehearsal tied to the practice’s real support path is more useful than asking employees to remember a slide from annual training.
After the exercise, fix the card. Replace an unanswered number. Add an after-hours route. Clarify whether staff may disconnect a network cable. Remove a step that assumes everyone has access to a second computer. Note who records the event and where.
The goal is modest: when an alarming message takes over a busy workstation, the employee already knows how to stop the conversation and start a trusted one.
For practical guidance on cyber risk and safer AI use, subscribe to Cyber & AI Insights.
If your dental practice wants help turning its support contacts and incident procedure into a short staff response exercise, schedule a conversation with Your Data Guardian.