Trying to unpack this. Please confirm and/or correct the sequence of events I'm listing below.
1. You receive a paper invoice for medical services in the US Mail.
2. This paper invoice directs you to a website where you are told you can pay the medical bill.
3. The website, is, in fact, a payment portal for the medical provider you visited? Is this correct? Or is it uncertain?
4. The following might be very important. You said when the payment website asked your husband to download an app to enter the credit card information your husband stopped the process. However, at the start of the process, before the website wanted you to download the credit card payment app, did your husband enter any information, like his name, address, phone number, email address?
If so, this means that website has your husband's personal information but not his credit card information.
5. You call the bank and report the incident.
6. A couple of days later you get a call from social services saying they attempted to visit you. Did you ask what day and time those alleged visits occurred? It would be interesting to see if their visits match up with the times you were, in fact, not at home.
7. Social services said they were checking in on you because someone reported an identity theft involving your husband and even went into detail saying it involved the payment of a medical bill. The only entity that knows about a possible identity theft is your bank and your husband's golf buddy, but both deny calling social services. Is there anyone else that might possibly know about this incident?
At this point it can be assumed the only way that social services can connect your husband with an attempted identity theft involving a medical bill is if:
a.) the bank told them, but bank denies this.
b.) the golf buddy told them, but he denies this.
c.) you told someone else, who told social services
d.) the payment portal website told social services. (This raises red flags.)
e.) social services isn't really social services. Instead they are connected to the (alleged) payment portal service. This is a scary thought.
When you have your in person meeting with social services, before you answer any questions I'd start asking questions--ask them when their workers called at your house. See if those times were when you weren't at home. Ask them for the names of the people that came to your house. If they don't want to give you this information that should be a warning sign. After all, if you had been at home surely they would have given you a business card with their names or otherwise identified themselves.
Ask them again who reported to them. If they are hesitant to name names, ask them if the source of their information is an individual or an organization.
