A new scam warning is doing the rounds for Medicare providers and broader health professionals: attackers are trying to trick people into handing over access to Provider Digital Access (PRODA) accounts.
Speech Pathology Australia has shared the alert, and the Australian Government has published an official factsheet explaining what to look for and where to report suspicious activity. SPA alert and factsheet page.
This update is written for clinics, practices, and individual clinicians who want a clear, calm summary of what’s happening — and how to respond using official sources.
Key Summary – at a glance
- What’s happening: Scammers are targeting health professionals to gain access to PRODA accounts. (Health factsheet)
- How it usually starts: Email/SMS/social messages asking you to “verify” or “update” PRODA details via a link (often to a fake sign-in page). (Health factsheet/Services Australia)
- Common script: A message saying you should expect a call about “suspicious activity”, followed by a call asking for passwords or access. (Health factsheet/Services Australia)
- Big red flag: Anyone asking for access to your accounts or devices. (SPA/Health factsheet)
- Why it matters: Stolen PRODA credentials may be used for financial gain (including Medicare benefits). (AMA)
What These PRODA Scams Typically Look Like
The Government factsheet and Services Australia guidance describe a consistent pattern: scammers impersonate trusted organisations and use urgency to get you to click, share, or approve access. Factsheet (PDF) and Services Australia guidance.
1) “Verify your PRODA details” messages (with a link)
You may receive an email, text message or social media message asking you to update or verify PRODA information — usually with a link that leads to a fake PRODA sign-in page. Source.
2) “Expect a call” followed by a call about “suspicious activity”
Another common approach is an initial message telling you to expect a call, followed by a phone call claiming there’s suspicious activity or problems with your account. Services Australia notes scammers do this to make the contact feel more legitimate. Source.
3) Requests for passwords, personal details, or device access
The Speech Pathology Australia alert and Government factsheet both flag a key red line: scammers may ask for access to your accounts or devices, or ask for credentials. SPA source.
What to Do If You Receive a Suspicious PRODA Message (General Guidance Only)
We won’t provide personalised advice here — but we can point you to what official sources say and how clinics typically handle these messages in a safe, consistent way. For the most direct guidance, use the official factsheet and Services Australia PRODA scam page. Factsheet (PDF) and Services Australia.
Use official pathways (not the link in the message)
The Government factsheet encourages providers to only sign in to PRODA through the genuine website (via Services Australia) and to be cautious of links to “sign-in” pages sent via messages. Source.
Report suspicious contact using official reporting channels
Services Australia states you can report scams pretending to be from PRODA via reportascam@servicesaustralia.gov.au. The Government factsheet also lists this reporting option for PRODA impersonation scams. Services Australia source and factsheet source.
Basic principle: If the message creates urgency and tries to route you to a link, a password request, or a “quick verification” step — treat it as suspicious and use the official sites/contacts instead. (Health factsheet/Services Australia)
Practice-Level Safeguards Clinics Can Consider (Without Getting Too “Instructional”)
The goal is to reduce the chance that one busy moment (a rushed click between patients, or a phone call to reception) becomes a bigger security incident. The official factsheet points to strong credentials and not sharing access as best practice, and the AMA highlights the financial motivation behind stolen PRODA credentials. Factsheet and AMA summary.
1) Make “official links only” a clinic norm
- Encourage staff to access PRODA via official websites (not links from messages). (Health factsheet)
- Keep a single internal reference page (or shared bookmark list) that points staff to official Services Australia and Health Department pages. (Services Australia/Health factsheet)
2) Set a simple escalation pathway for suspicious contact
- Decide who staff should notify first (practice manager, IT, compliance, director). (Internal policy — varies by workplace)
- Use the official reporting channels when relevant (Services Australia reporting email is listed on their PRODA scam guidance). (Services Australia)
3) Security hygiene: keep it consistent, not complicated
The Government factsheet highlights strong passwords and extra security options, noting the best protection is linking PRODA with a ‘Strong’ MyID credential. Source.
Why attackers bother: The AMA notes stolen PRODA credentials can be used by scammers to gain financial benefits they’re not entitled to, including Medicare benefits. (AMA)
Conclusion
The PRODA scam alert is a timely reminder that health professionals are being targeted with increasingly believable phishing and impersonation tactics. The safest approach is to stay calm, avoid following “verification” links, use official websites and contact points, and report suspicious messages through the channels listed by Services Australia and the Health Department.
Disclaimer: This blog is a general overview and should not be construed as professional legal, financial or medical advice.
FAQs
- What is PRODA and why are scammers targeting it?
PRODA is Provider Digital Access used to access health-related online services. Official guidance warns scammers are targeting health professionals to obtain PRODA credentials. The AMA notes stolen credentials may then be used to seek financial benefits (including Medicare benefits) fraudulently.
- What are the most common PRODA scam red flags?
Official sources flag messages asking you to update/verify PRODA details via a link (often to a fake sign-in page), messages telling you to expect a call about “suspicious activity”, and any request for account details or device access.
- How do scammers make their calls seem legitimate?
Services Australia notes scammers may send a message first so the phone call doesn’t feel unexpected, then ask for personal information such as passwords. Official guidance treats this as a scam tactic.
- Where can health professionals report PRODA impersonation scams?
Services Australia states scams pretending to be from PRODA can be reported via reportascam@servicesaustralia.gov.au. The Government factsheet also lists this reporting option for PRODA impersonation scams.
- What does the Government factsheet describe as “best practice” protection?
The factsheet describes measures such as signing in via the genuine PRODA website, using strong passwords and extra security options, and never sharing account information or giving access to devices. It notes the best protection is linking PRODA with a ‘Strong’ MyID credential.
Information Sources
- Speech Pathology Australia — PRODA Scam Alert for Medicare Providers (3 Dec 2025)
- Australian Government Department of Health, Disability and Ageing — Protecting health professionals from scams (factsheet page)
- Australian Government Department of Health, Disability and Ageing — Protecting health professionals from scams (PDF factsheet, Nov 2025)
- Services Australia — How to avoid scams targeting Provider Digital Access (PRODA) accounts (last updated 10 Nov 2025)
- Australian Medical Association — Health department warns doctors to be on alert for scammers (Published 27 Nov 2025)
