PhishPin / Brands Live Phishing Data / Insurance & healthcare
Insurance & healthcare phishing: which brands are copied the most
27 insurance & healthcare brands are tracked in PhishPin's index. Together they have 37 hostnames in phishing feeds and 97 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated insurance & healthcare
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | Generali | 16% | 30 · Moderate | 6 | 12 |
| 2 | Nationwide | 16% | 21 · Moderate | 6 | 2 |
| 3 | Prudential | 11% | 22 · Moderate | 4 | 4 |
| 4 | AXA | 11% | 19 · Moderate | 4 | 2 |
| 5 | Humana | 8% | 30 · Moderate | 3 | 33 |
| 6 | Allianz | 8% | 28 · Moderate | 3 | 21 |
| 7 | MetLife | 5% | 18 · Moderate | 2 | 4 |
| 8 | Bupa | 5% | 16 · Moderate | 2 | 3 |
| 9 | Allstate | 5% | 13 · Low | 2 | 1 |
| 10 | Anthem (Elevance) | 3% | 14 · Low | 1 | 4 |
| 11 | MyChart | 3% | 14 · Low | 1 | 4 |
| 12 | Manulife | 3% | 9 · Low | 1 | 1 |
| 13 | Blue Cross Blue Shield | 3% | 5 · Low | 1 | 0 |
| 14 | UnitedHealthcare | 3% | 5 · Low | 1 | 0 |
| 15 | Aetna | 0% | 4 · Low | 0 | 1 |
| 16 | Cigna | 0% | 4 · Low | 0 | 1 |
| 17 | Farmers Insurance | 0% | 4 · Low | 0 | 1 |
| 18 | Labcorp | 0% | 4 · Low | 0 | 1 |
| 19 | Quest Diagnostics | 0% | 4 · Low | 0 | 1 |
| 20 | State Farm | 0% | 4 · Low | 0 | 1 |
| 21 | Aviva | 0% | 0 · Low | 0 | 0 |
| 22 | GEICO | 0% | 0 · Low | 0 | 0 |
| 23 | GoodRx | 0% | 0 · Low | 0 | 0 |
| 24 | Kaiser Permanente | 0% | 0 · Low | 0 | 0 |
| 25 | LIC of India | 0% | 0 · Low | 0 | 0 |
| 26 | Liberty Mutual | 0% | 0 · Low | 0 | 0 |
| 27 | Optum | 0% | 0 · Low | 0 | 0 |
Common lures against insurance & healthcare
- A "claim update" or "policy renewal" email with a payment or login link.
- A message offering new benefits, a refund or a free device that asks for your member ID and SSN.
- A fake patient-portal or lab-results notice.
- A call about unpaid premiums that pushes you to a cloned payment page.
Red flags
- You are asked for your member ID, Medicare number or SSN through a link.
- The portal is on a domain that is not your insurer's or provider's.
- Unexpected "refunds" or "benefits" are used as bait.
If you already clicked or entered details
Contact the insurer or provider using the number on your member card, review recent claims and explanation-of-benefits statements for services you did not receive, and consider a credit freeze if your SSN was shared.
Is your insurer or healthcare provider being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which insurance & healthcare brands are impersonated the most?
Generali leads with 6 hostnames in phishing feeds, followed by Nationwide (6) as of 1 Nov 2026.
How can I spot phishing that targets insurance & healthcare?
You are asked for your member ID, Medicare number or SSN through a link. The portal is on a domain that is not your insurer's or provider's. Unexpected "refunds" or "benefits" are used as bait.
What should I do if I fall for a fake insurer or healthcare provider page?
Contact the insurer or provider using the number on your member card, review recent claims and explanation-of-benefits statements for services you did not receive, and consider a credit freeze if your SSN was shared.