Five Hidden Costs of Bots in Your Healthcare Contact Center

Most healthcare organizations know bots are calling, but few have measured what it costs them.

Healthcare contact centers handle millions of interactions a year: members checking benefits, patients booking appointments, providers verifying coverage, caregivers working through insurance for someone they love.

Every one of those calls carries clinical, financial, and legal weight. Organizations have spent years getting them right, from staffing and IVR design to the compliance controls that let sensitive conversations happen at scale.

Almost all of it assumes the caller is a person. That assumption is breaking down.

Pindrop recorded a 1,390% surge in AI voice attacks between Q4 2024 and Q1 2026. At one healthcare organization, bots now drive more than half of all fraud.

Bots are already reaching your organization. The open question is what they cost, and whether anyone is measuring it.

The measurement problem

Each team measures its own lane well. Operations watches volume and handle time. Fraud traces losses. Compliance reviews improper data exposure. The gap opens between the lanes.

But a bot campaign doesn’t stay in one lane. It runs as a single motion across all of them, and in any one team’s view it looks small. Take a campaign that starts as reconnaissance and ends in account takeover:

Every team’s read is accurate, but the campaign as a whole is much harder to see.

Hidden cost #1: You’re paying for every bot call

Every call consumes resources whether a person places it or not: IVR capacity and licenses, authentication compute, agent time, queue slots, escalation paths.

Most healthcare contact centers were sized for human volume. Staffing, IVR design, and licensing were calibrated to a human-paced flow. Automated traffic broke that assumption, and it now arrives in several forms: provider offices verifying benefits and prior authorization, third parties handling billing and scheduling, pharmacy refill systems, and fraud operations probing IVRs at scale.

Some of that automation is legitimate, some unknown, some hostile, and many organizations can’t reliably tell which. So they carry the infrastructure cost for all of it. Bot volume also quietly distorts the numbers leaders rely on: IVR containment looks healthy when bot calls that never reach an agent count as successful self-service, and cost-per-call slips when a share of calls involve no real member.

The question few contact center leaders can answer today: what share of our volume is non-human? Until that baseline exists, every efficiency gain is measured against a denominator that may be inflated.

Hidden cost #2: Your authentication was built for a world that’s gone

Knowledge-based authentication, date of birth, last four of the SSN, member ID, made sense when stolen data was scarce and fraudsters worked one call at a time. That world is gone.

Two things changed at once; the data got cheap: stolen SSNs and account numbers sell for $8 to $35 on dark-web markets, and nearly 60% of organizations report fraudsters using compromised PII to clear KBA. And the scale stopped being human: fraudsters bypass KBA in more than half of attempts and pass OTP challenges about a quarter of the time, while AI lets one attacker run those attempts en masse. By Q1 2026, AI-backed activity reached roughly 8.7% of contact center fraud, up from <1% a year earlier.

When breached data is a commodity and delivery is automated, static challenge questions stop working as identity controls. They become friction for legitimate callers.

The instinct when KBA fails is to add more of it. That makes things worse in three concrete ways:

And it still doesn’t stop the attacker, who holds the same data the questions test against.

Hidden cost #3: The reconnaissance that never trips an alert

This one is easy to underestimate, because it often produces no immediate loss. No claim, no account change, no balance moved. The IVR handles the call, it ends, nothing flags. The point of those calls is intelligence. The theft comes later.

Bot reconnaissance against IVRs follows a recognizable pattern:

HSA accounts are a favorite target. Bots validate an account through the IVR, then socially engineer an agent into a contact change, usually a phone number, which opens the door to a digital password reset and full takeover. In one documented engagement, Pindrop helped a healthcare services organization protect a collective $73M+ million in patient accounts, targeted by >30,000 bot-driven calls over a one year period.³

What makes attacks like this scale is repetition at machine speed. Once bots find a workflow gap, they run it thousands of times a week, a pace human fraud operations cannot match. And the exposure begins at the IVR, in self-service, often before any fraud alert fires. If your detection starts at the agent or the account change, it starts downstream of the attack.

Hidden cost #4: Compliance exposure that’s gone unmapped

Healthcare runs under demanding compliance rules. PHI disclosures must be documented, access decisions must be defensible, and audit trails must show that information was protected and authorization validated. Most of those frameworks assume the interaction happened between two people.

Bot traffic breaks that assumption, and it raises a few questions an auditor may ask:

The policy ground is shifting to cover synthetic actors. NIST’s updated identity guidance, SP 800-63-4, instructs organizations doing remote identity proofing to run presentation-attack detection and to scan media for signs of AI-generated content and deepfakes, and it adds controls to block automated attacks on enrollment. The FBI has warned about AI-cloned voices in impersonation scams, and the AMA has called for protections against deepfake impersonation of physicians. CMS issued a Request for Information (RFI) to inform potential program-integrity measures, including those that shape how CMS and healthcare organizations identify and protect against fraud, waste, and abuse.

Organizations that can answer the audit questions with documentation are building an advantage. The ones that can’t are carrying risk most legal teams haven’t priced.

Hidden cost #5: Real callers foot the bill

When bots consume capacity, the burden lands on everyone else. Wait times climb. Authentication friction grows as teams add verification layers that hit every caller. Agents get tied up by traffic that should have been routed differently. Members who hit friction abandon and call back, adding more volume.

Many patient and member experience programs, like CAHPS, Star Ratings, NPS, etc. are fighting friction from non-human traffic, friction those programs exist to reduce.

Security and experience can improve together. One large national payer deployed passive authentication and cut verification time by 60 to 75 seconds per matched call, matched about 75% of eligible calls, credited roughly $1 per call in savings, and lifted IVR containment by a point, with security improving at the same time.⁴ Those outcomes trace back to one upstream decision: getting the identity call right at the start. When the system knows in real time whether it’s a human, whether they’re risky, and whether they’re the right person, the rest improves with it.

What to measure now

AI-enabled fraud is operating at scale today, in environments that weren’t built to detect or measure it. Human detection of AI-generated content runs about even with a coin flip, so this isn’t a gap teams close by listening harder.

The organizations getting ahead are asking five questions:

The costs of bots in healthcare are growing. The only real question is how long they stay hidden.