# Email security for veterinary clinics: protect your practice, pharmacy and clients

URL: https://iblockspam.com/blog/email-security-for-veterinary-clinics
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Phishing & threats
Author: iBlockSpam Team

> Email risks for vet clinics: fake DEA and board emails, supplier invoice fraud, practice software phishing, client card payments and a front-desk checklist.

## Short answer

Veterinary clinics are targeted by email because they order controlled drugs, pay distributors, take client card payments and run practice software through web logins. Protect them with personal logins and MFA, phone call-backs for supplier bank changes, no card numbers by email, independent checks of any DEA or board email, and DMARC on your domain.

A veterinary clinic handles more kinds of risk by email than most small businesses. You order controlled substances, pay distributors and labs, take card payments from pet owners, run cloud practice management software and receive messages from regulators, all through a front desk that changes shift several times a day. This guide covers the email threats that are specific to veterinary practices, what the DEA and other agencies say about them, and a checklist your practice manager can work through this month.

There isn't a reliable public count of email attacks on veterinary clinics, so this guide doesn't quote one. It sticks to what the agencies that regulate and advise practices have published.

## Why are veterinary clinics targeted by email attacks?

Veterinary clinics are targeted because one front desk inbox gives access to card payments, supplier accounts, drug ordering and client records, and it's usually run by busy staff who share devices and logins. Criminals don't need to know much about veterinary medicine; they need a clinic that pays invoices, holds a DEA registration and answers email quickly.

Several features of a practice make email fraud easier:

- **Regulated drug ordering.** Clinics that hold a DEA registration are a natural target for criminals who pose as the DEA.
- **Regular supplier payments.** Distributors, labs, crematoriums and equipment lessors send invoices every month, which makes fake invoices blend in.
- **Card payments from the public.** Clients pay for treatment, boarding and prescriptions, and some try to pay by email.
- **Cloud software logins.** Practice management, lab results, online pharmacy and reminder systems each have a web sign-in that can be phished.
- **Shared front desk accounts.** One password used by many people is the easiest account to steal.

Losses from this kind of fraud are large across all industries. The FBI's [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) recorded 24,768 business email compromise complaints with $3,046,598,558 in reported losses in 2025. **Business email compromise (BEC)** is fraud where a criminal impersonates or takes over a trusted email account to get money sent to them.

## What email threats do veterinary clinics face?

Veterinary clinics face seven main email threats. The table shows what arrives and the control that stops it.

| Threat | What arrives | Who it targets | Control that stops it |
|---|---|---|---|
| Fake DEA or law enforcement contact | "Your registration is under investigation," a fine or a demand for payment | Veterinarians, practice manager | Verify independently; the DEA never demands money |
| Fake state board or license email | Renewal, complaint or "verify your license" messages | Veterinarians, technicians | Go to the board's site yourself |
| Fake supplier invoice or bank change | A distributor or lab "changing banks," or a fake invoice | Practice manager, bookkeeper | Call your rep on a known number |
| Practice software or portal phishing | A fake sign-in for practice management, lab or distributor portals | Front desk, managers | MFA; sign in from bookmarks only |
| Client overpayment and refund scams | A "new client" overpays for boarding or transport and wants a refund | Front desk | Refund only after funds clear, to the original method |
| Card numbers sent by email | A client emails their card number to pay | Front desk | Send a payment link; don't reply with the number |
| Ransomware by email | A malicious attachment or link | Anyone | Filtering, updates, offline backups |

### Fake DEA and law enforcement emails

Criminals pose as DEA staff to frighten registrants into paying or handing over personal details. The DEA Diversion Control Division's [June 23, 2025 scam alert](https://www.deadiversion.usdoj.gov/pubs/docs/SCAM-Letter.pdf) says scammers "impersonate DEA personnel and notify registrants that they are under investigation," using false letters and phone calls. It states that "DEA personnel will never contact registrants or members of the public to demand money or any other form of payment, will never request personal or sensitive information," and will only notify people of a real investigation "in person or by official letter."

Treat an email that tells the same story exactly the same way, even when it carries an official-looking PDF. Here's an example of the kind of message to report and delete:

> Example: "DEA Diversion Notice: Registration #BX0000000 has been flagged for irregular Schedule II purchases. To avoid suspension, contact Agent R. Miller within 24 hours and settle the administrative penalty. Case file attached."

The DEA asks you to report these contacts to the FBI at [ic3.gov](https://www.ic3.gov), and you may also report them at ReportFraud.ftc.gov. If anyone at the clinic gave out a Social Security number or DEA registration number, the DEA points victims to identitytheft.gov.

### Fake state board and regulator emails

Licensing boards are also impersonated, and occasionally their real accounts are compromised. On July 16, 2026, the Texas Board of Veterinary Medical Examiners [announced](https://veterinary.texas.gov/announcements/security-notice/) it had "recently experienced a successful phishing attack affecting one of our email accounts," and asked licensees not to open suspicious emails that appear to come from the board. Its advice applies to every state: to check whether a message is real, contact the board using the contact information on its website. A real board address can still send a malicious link if the account has been taken over, so verify any request to sign in, pay or update details.

### Fake supplier invoices and bank changes

Distributors, labs and service vendors bill you every month, which gives criminals a steady stream of real invoices to copy. The email may come from a lookalike domain or from the supplier's own hacked mailbox, inside an existing thread. The FTC's [Cybersecurity for Small Business](https://www.ftc.gov/cybersecurity) guidance tells businesses to "require your employees to call and confirm wire transfer requests that they receive through email." Call your rep on a number from your account records, and read our guide to [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) for a full call-back procedure.

### Practice software and portal phishing

Your practice management software holds client names, addresses, phone numbers and pet records, and your distributor portal can place orders on your account. Fake "password expired," "new message from the lab" or "invoice ready" emails lead to copied sign-in pages. Sign in to every portal from a saved bookmark, never from an email link, and turn on MFA wherever the software offers it. Our guides to [fake password expiry emails](https://iblockspam.com/blog/fake-password-expiry-emails) and [file-sharing notification phishing](https://iblockspam.com/blog/file-sharing-notification-phishing) show the common lures.

### Client overpayment and refund scams

A "new client" books boarding, surgery or a pet transport by email, pays more than the bill by check or card, then asks the front desk to refund the difference. The FTC's [fake check guidance](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-fake-check-scams) explains why this works: "By law, banks have to make deposited funds available quickly," but "Fake checks can take weeks to be discovered and untangled," and by then the clinic owes the bank. Refund overpayments only after your bank confirms funds have truly cleared, and only to the original payment method.

## Can a veterinary clinic take card payments by email?

No. Don't ask clients to email card numbers, and don't send them by email yourself. The PCI Security Standards Council's [FAQ 1085](https://www.pcisecuritystandards.org/faq/articles/Frequently_Asked_Question/can-unencrypted-pans-be-sent-over-e-mail-instant-messaging-sms-or-chat) says PCI DSS Requirement 4.2.2 "prohibits the sending of unprotected primary account numbers (PANs)" via end-user messaging technologies. **PCI DSS** is the card industry's security standard that card-accepting businesses agree to follow, and a **PAN** is the long number on the card.

For remote payments, send a payment link from your card processor or practice software, or take the card by phone through your terminal. If a client emails a card number anyway, don't reply with it or forward it. Delete it according to your processor's guidance and tell the client how to pay safely.

## Does HIPAA apply to a veterinary clinic's email?

Generally not, but other rules do. HIPAA's definitions in [45 CFR 160.103](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103) are built around people: "Individual means the person who is the subject of protected health information." Animal patients aren't individuals in that sense. If your practice also provides human health services, the answer may differ; our [HIPAA email security guide](https://iblockspam.com/blog/hipaa-email-security-requirements) covers those rules.

That doesn't leave client data unprotected. Your obligations around email usually come from card industry rules for payments, your state's data breach notification law for clients' personal information, and your state veterinary practice act or board rules on records. This is general information, not legal advice; ask a local attorney or your state board what applies to your practice.

## How should a clinic handle a suspicious DEA, board or supplier email?

Verify the request through a channel you already trust, never through the email, before anyone pays, signs in or sends information. Post this procedure at the front desk and in the pharmacy area.

1. **Don't reply, click or open attachments.** CISA's [phishing guidance](https://www.cisa.gov/secure-our-world/recognize-and-report-phishing) says to contact the company or person through a verified website or another known method.
2. **Check the full sender address,** not just the display name. See [display name spoofing](https://iblockspam.com/blog/display-name-spoofing).
3. **Verify independently.** For the DEA, go to the Diversion Control Division website yourself. For your board, use the contact details on its website. For suppliers, call your rep on a known number.
4. **Never pay a "fine" or "settlement" by email, wire or gift card.** The DEA says federal law enforcement officers "are prohibited from demanding cash or gift cards from a member of the public."
5. **Report it.** Use your mail app's report button, then report DEA impersonation to [ic3.gov](https://www.ic3.gov). Our guide to [reporting phishing emails](https://iblockspam.com/blog/report-phishing-email) shows where the buttons are.
6. **If someone clicked or signed in,** change the password from a clean device, sign out all sessions and check for new forwarding rules. Follow [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).

## How do you stop criminals pretending to be your clinic?

Publish SPF, DKIM and DMARC for your domain and move DMARC to enforcement, so fake emails using your exact domain are rejected by pet owners' mail providers. **SPF** lists the servers allowed to send your mail, **DKIM** signs each message, and **DMARC** tells receivers what to do when both checks fail. Include every service that emails clients as you: appointment reminders, your practice software, online pharmacy notices and review requests. A record at enforcement looks like this example:

```
_dmarc.example-vet.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-vet.com"
```

Start at `p=none`, check reports for a few weeks, then tighten. Our [DMARC from none to reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) covers the steps, and [authenticating third-party senders](https://iblockspam.com/blog/authenticate-third-party-senders-spf-dkim-dmarc) explains how to bring reminder and software senders into line. DMARC can't stop lookalike domains, so check yours with the [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator).

## Is Microsoft 365 or Google Workspace protection enough for a vet clinic?

For a single-site practice, Microsoft 365 or Google Workspace configured properly is a reasonable baseline. Both filter spam and malware, support MFA and can tag external senders. If you haven't reviewed the settings, start with [Microsoft 365 preset security policies](https://iblockspam.com/blog/microsoft-365-preset-security-policies) or [Google Workspace advanced phishing and malware protection](https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection).

An MX-level filter adds a checkpoint in front of your platform. **MX-level filtering** means your domain's MX records point to a filtering service that checks mail before your platform delivers it. It helps when phishing keeps reaching the front desk, when staff need to release a held lab or supplier email from a quarantine digest without calling IT, and when a group runs several clinic domains. iBlockSpam prices per domain with unlimited mailboxes; see [email security for small businesses](https://iblockspam.com/solutions/small-business) for how it fits a practice.

## Veterinary clinic email security checklist

1. Give every staff member their own login with MFA; use a shared reception mailbox opened by named users.
2. Turn on MFA for practice management software, distributor and lab portals, your card processor and your bank.
3. Bookmark every portal and sign in only from bookmarks.
4. Post the rule: any DEA, board or "fine" email is verified independently and never paid by email.
5. Call suppliers on a known number before any bank change, with a second approver.
6. Never request or send card numbers by email; use payment links or the terminal.
7. Refund overpayments only after funds clear, to the original payment method.
8. Publish SPF, DKIM and DMARC, including reminder and practice software senders.
9. Keep computers updated and keep backups of practice data that ransomware can't reach.
10. Train new front desk and technician staff on phishing in their first week, and remove access on each leaver's last day. See our [offboarding checklist](https://iblockspam.com/blog/employee-offboarding-email-security).

## Next steps

- Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your clinic's domain to see your MX, SPF and DMARC setup.
- Print the DEA warning and pin it in the pharmacy area, with your state board's real phone number.
- Read [business email compromise prevention](https://iblockspam.com/blog/business-email-compromise-prevention) for the wider set of payment controls.
- If you want inbound filtering the front desk can handle from a digest email, see [email security for small businesses](https://iblockspam.com/solutions/small-business). Pricing is per domain, not per mailbox.

More threat guides are in our [phishing and threats topic](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Does the DEA email veterinarians about investigations or fines?

The DEA says it is not its practice to call registrants about investigations, that its staff will never demand money or request sensitive information, and that it notifies people of a real investigation only in person or by official letter. Treat any email that threatens your registration or asks for payment as a scam and report it at ic3.gov.

### Does HIPAA cover veterinary records?

Generally not. HIPAA's definitions are written around people: an individual is the person who is the subject of protected health information. That doesn't mean vet records are unregulated. Many states have veterinary record confidentiality rules and data breach laws that cover clients' personal and payment details. Ask a local attorney or your state board what applies.

### Why would a new client overpay a vet clinic and ask for a refund?

It's usually a fake check or stolen card scam. The 'client' pays more than the bill, for boarding or a pet transport, then asks you to refund the difference. The FTC warns that banks must make deposited funds available quickly, but fake checks can take weeks to be discovered. Refund only after funds truly clear, and only to the original payment method.

### Should a vet clinic front desk share one email login?

No. A shared front desk password is copied, rarely changed and can't use MFA well. Give each person their own login with MFA and let them open a shared reception mailbox. You can then see who did what, remove a leaver on their last day and stop one stolen password exposing every client conversation.

### How can a veterinary clinic tell if a supplier invoice email is fake?

Look for new bank details, an unusual total, urgency or a sender domain that's one letter off your distributor's. Then check it without using the email: sign in to your distributor's portal from a bookmark, or call your rep on a number you already have. Never change where you pay a supplier on an email request alone.

## Sources

- [DEA Diversion Control Division: New Scam Letters and Calls Target Medical Practitioners (scam alert, June 23, 2025)](https://www.deadiversion.usdoj.gov/pubs/docs/SCAM-Letter.pdf)
- [Texas Board of Veterinary Medical Examiners: Security Notice (July 16, 2026)](https://veterinary.texas.gov/announcements/security-notice/)
- [FTC: Cybersecurity for Small Business (September 2025)](https://www.ftc.gov/cybersecurity)
- [PCI Security Standards Council FAQ 1085: Can unencrypted PANs be sent over e-mail, instant messaging, SMS, or chat?](https://www.pcisecuritystandards.org/faq/articles/Frequently_Asked_Question/can-unencrypted-pans-be-sent-over-e-mail-instant-messaging-sms-or-chat)
- [FTC Consumer Advice: How To Spot, Avoid, and Report Fake Check Scams](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-fake-check-scams)
- [eCFR: 45 CFR 160.103, HIPAA definitions](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103)
- [FBI IC3: 2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator): See typo, look-alike character and other-ending versions of your domain, and which of them exist in DNS or have a mail server.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-veterinary-clinics (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt