Then you'd be surprised to hear about the income tax return scam back in the day where even lay people were able to achieve just that, for 2 million bucks specifically ^.^
And they didn't need any medical records to do it!
... which was pretty much my point.
If they can steal money out of doctors' bank accounts, or redirect it on its way in, they don't need patient data. The doctors already have patients. And payments coming in. This isn't like income tax refunds where the payer pays each individual.
In fact, if they have patient data, it's stupid to use it. What insurer isn't going to notice some doctor suddenly getting a thousand new patients all in the course of one week?
Sorry man, it still doesn't add up. If you're equipped to do this at all you're equipped to do it without needing patient data.