Stop patient-portal takeover
and prescription fraud
Patient portals, e-prescription systems and telehealth logins are taken over with the same tooling as bank accounts: leaked passwords replayed through residential proxies, sessions replayed in fake browsers. Maskbreak tells your login and reset endpoints who is really connecting, in under 150 ms — and public and non-profit providers get it with no hourly cap.
What hospitals and health systems face in 2026
Credential stuffing against patient portals
Leaked email-and-password pairs are replayed against the portal through rotating residential proxies, one attempt per address, under any per-IP limit you can set. A taken-over portal account exposes the record, the prescriptions and the insurance details behind it.
Password-reset hijacking
Reset needs no password. A request from a fresh device through a proxy, a link opened on a different machine, a completed reset that locks the patient out — every step looks legitimate to a flow that checks only the token.
Prescription and insurance fraud through taken-over accounts
Controlled-substance refills requested from a hijacked account, claims redirected, contact details changed so the patient never sees the notice. The takeover is quiet; the damage arrives weeks later as a pharmacy call or a denied claim.
Appointment and vaccine-slot bots
Scarce slots are scraped and booked by automation within seconds of release, then resold or simply hoarded. Real patients see a full calendar and a headless browser sees an inventory.
What Maskbreak does for you
- See the network behind every portal login and reset request — residential proxy, VPN, cloud server or Tor — with the service named when known
- Detect fake browsers and automation on the login and booking pages before a session is issued, so a headless browser never holds a slot
- Link one device to the many patient accounts it touches — the shape of a stolen list being worked, not a family sharing a tablet
- Catch the new-device, proxy and automation combination on an established patient account — the takeover pattern — and route it to a phone code, not a CAPTCHA
- Never see a record: the API receives a connection token, an IP address and device signals from the page, nothing from the chart behind it
Public and non-profit providers: no hourly cap
Every Maskbreak key starts at 1,000 visitor checks an hour, which a hospital reaches the morning flu-clinic bookings open. Hospitals and health systems, public health agencies, laboratories, registries and medical research qualify for the public-interest program, which removes that cap from the key you already have. Institutional email domains such as .nhs.uk, .gov and .edu are fast-tracked, everyone else is verified by registry and website within a business day, and a provider under attack gets the cap lifted first and verified afterwards.
[ See who qualifies and apply ]
hand over an account, and the portal login is only the first. Password reset, MFA enrolment, contact changes, session refresh and token creation are quieter and worth more. The endpoint-by-endpoint guide gives the rule for each — what to do on block, on review, on a first-seen device, and when the API is down.
[ Read the guide ]Where the check goes
The two call sites that matter most in healthcare: portal login, after the account lookup and before the password compare, and password reset, at the request and again at completion, with the reset token bound to the device that asked for it. Re-evaluate at the actions a takeover cashes out on — prescription requests, contact and insurance changes. On review send a code to the phone on file; never lock a patient out on a VPN alone.
// Patient-portal login: after the account lookup, before the password compare const verdictRes = await fetch('https://maskbreak.com/v1/evaluate', { method: 'POST', headers: { 'Authorization': 'Bearer ' + process.env.SENTINEL_KEY, 'Content-Type': 'application/json' }, body: JSON.stringify({ token: req.body.monocle, fingerprintEventId: req.body.sentinel_fp, accountId: patient.id }) }); const risk = await verdictRes.json(); // A blocked attempt answers exactly like a wrong password. A VPN alone is 'review', // which sends a code to the phone on file instead of locking anyone out. if (risk.decision === 'block') return res.status(401).json({ error: 'Invalid login' }); if (risk.decision === 'review' || risk.device?.times_seen === 1) return sendPhoneCode(patient, res); issueSession(patient, res);
The signals that matter for healthcare
Network context on every login and reset. Stuffing runs against portals rent rotating residential proxies precisely so every attempt arrives on a clean home address. Maskbreak classifies the network behind each request — residential proxy, VPN, cloud server, Tor — so a run reads as what it is: hundreds of never-seen devices arriving through rotating residential exits, not hundreds of returning patients.
New device on an established account. A patient who has used the same tablet for two years and suddenly signs in from a first-seen device over a proxy is the takeover shape. A first-seen device alone is not proof — people replace phones — which is why the right response is a code to the number on file rather than a refusal.
Replayed sessions, exposed by the environment. A stolen session cookie is genuine; the fake browser replaying it is not. Antidetect browsers importing a victim’s cookies leave measurable artifacts that surface as device.antidetect and the tampering score, and a session-refresh check catches the machine that was never issued the session.
An audit trail a privacy officer can read. Every verdict carries its reasons, so a held prescription request or a step-up on a login can be explained to the patient it affected and to the review board. Retention is published, IP addresses are hashed after seven days, and the DPA is self-serve.
Common questions
review, never block. Your portal decides what review means; the recommended response is a one-time code to the phone on file, which a patient passes in seconds and a credential list does not.Protect the portal
Free: 1,000 checks an hour, no card, no expiry. Public and non-profit providers can apply to have the cap removed.