A patient paid a scammer who claimed to be your clinic. What do you do now?

A patient calls, upset: they paid someone who said they worked at your clinic, to "confirm" an appointment, and lost money. You never spoke to them. This has happened to real clinics and hospitals across India. Here is what the news reports don't tell you: what your clinic should do about it, today.

How are scammers using clinic names to trick patients?

The pattern repeats across every reported case: a stranger reaches a patient first, claims a connection to a real clinic or hospital, and asks for something small before the loss gets large.

• A fake or wrong number on Google Maps. A patient searches for your clinic, calls a number that shows on the listing, and it isn't yours. Anyone can suggest an edit to a Google Business Profile, and a wrong number sometimes sits there until the owner notices.
• A WhatsApp message posing as clinic staff. The stranger says they're calling to help book the appointment, then moves the conversation to WhatsApp.
• A small "token" or "booking fee." Reported amounts run from ₹2 to ₹10, paid by a link or QR code. The fee itself barely matters. It is there to make the next step feel routine.
• An APK "appointment app." Instead of, or after, the fee, the patient is sent a file ending in .apk and told to install it to complete the booking. Once installed, it can give the fraudster access to the phone, including banking apps and OTPs.

None of these steps needs your clinic's systems to be compromised. The scammer only needs your clinic's name and a patient willing to believe the call is genuine.

What real cases have been reported in India?

These are individually reported cases, not a single trend piece. Amounts and dates below are as stated in each report, checked on 17 Sep 2026.

1. 14 to 17 Apr 2023

   Gurugram: caller poses as Medanta Hospital staff, ₹3.97 lakh lost

   A 70-year-old woman received a call from someone claiming to work at Medanta Hospital, who asked for bank details to 'complete online registration' for an appointment. Four transactions followed over three days. An FIR was filed for cheating and impersonation.

   Read the Deccan Herald report (opens in a new tab)

2. 28 Nov 2025

   The Quint's WebQoof team explains the APK pattern nationally

   A fact-check explainer describing the same script found in the Hyderabad, Mumbai and Agra cases: a call or WhatsApp message offering to book an appointment, followed by an APK file that takes over the phone.

   Read The Quint's WebQoof explainer (opens in a new tab)

3. 24 Jan 2026

   Hyderabad: 'Doctors_Appointment.apk' costs a patient ₹4.58 lakh

   A man called a number he found in a search result, was moved to WhatsApp, sent a file named Doctors_Appointment.apk, and asked to pay ₹10 as a token amount. He noticed the app couldn't be deleted; unauthorised transactions were found the next morning.

   Read The420.in's report (opens in a new tab)

4. Feb 2026 (reported Mar 2026)

   Anupshahr, UP: an ill patient loses ₹18.6 lakh across two accounts

   A man searched Google for a doctor's number while unwell, was directed to install a 'Doctor Appointment' app, and granted it permissions. Fraudulent transactions later ran across both his and his wife's bank accounts.

   Read The420.in's report (opens in a new tab)

5. 29 Apr to 2 May 2026 (reported 12 May 2026)

   Badaun, UP: a ₹2 'confirmation fee' leads to ₹9.7 lakh lost

   A woman's family received a call about confirming a doctor's appointment for a token ₹2. No OTP or PIN was shared, but 19 unauthorised transactions followed over several days.

   Read Medical Dialogues' report (opens in a new tab)

What none of these reports say is what happened next for the clinic or hospital whose name got used. That is the gap this article fills.

What do we do today if a patient says they were scammed?

The patient's money is a police matter, not something your front desk can fix. What your clinic can control, the same day, is your own listing, your own notice, and the record you keep.

1. 1

   Step 1: Check your Google Business Profile phone number

   Sign in and confirm the number shown is yours. Reject any pending suggested edit you did not make.
2. 2

   Step 2: Get the patient's screenshots

   The number that called, the WhatsApp messages, the payment link or QR code, and the APK file name if there was one.
3. 3

   Step 3: Send the patient to 1930 and cybercrime.gov.in

   Call 1930, then file at cybercrime.gov.in (opens in a new tab). The complaint, and any chance of freezing the transfer, has to come from the patient, with screenshots attached.
4. 4

   Step 4: Post a notice today

   On your Google profile, website and WhatsApp status: your clinic never asks for payment by link or an app download to book an appointment.
5. 5

   Step 5: Reply calmly if a review follows

   An upset patient may leave a public review before or after this. Our guide on handling a patient complaint on WhatsApp covers the reply itself.

Every one of those five steps takes under an hour. The reported cases above show why the first hour matters: the Badaun family lost money over several days after the first call, and a fast report is the only thing that gives a bank a chance to stop later transactions.

How do we stop our own listing and WhatsApp from being used?

Two things are worth locking down before a scam happens, not after: who can change what patients see about your clinic, and who can take over the WhatsApp number patients already trust.

For your Google listing, the fix is the one covered in our guide to wrong clinic information on Google Maps (linked below): check pending suggested edits and Google-added changes regularly, not only after a complaint.

If you are still setting your WhatsApp Business number up, our step-by-step setup guide for doctors covers the basics before you get to security settings, and the guide to the verified badge covers what it actually costs and who qualifies.

Are our own habits making the scam easier to believe?

Here is the part most coverage of these scams skips entirely: a scam message only works if it looks like a message your clinic could plausibly send. If your own front desk already asks patients for an advance payment through a UPI ID typed out on WhatsApp, a link that changes each time, or whichever staff member's personal number is handy that day, a fraudster's message looks exactly the same.

Publishing one payment method, in one place your patients can check (your website and your Google profile), costs nothing and does more to protect your clinic's name than any notice posted after the fact. If you want AI replies on WhatsApp to stay this consistent by default, see what an AI receptionist for a clinic in India actually does.