Fake patient portal alerts can steal passwords, card details and infect your PC with malware. Here’s how to spot the scam before you click.