calls from the surgery center to verify that I was ready to pay my $221 for the surgery the day of. It was annoying to me. I don't need to be reminded so many times.

Got the surgery, and three weeks later I get a well written email with a two links in it. One to my bill for $221 saying I owed this amount, and the other link was how I can pay for it.
Generally, when you get these types of emails, you can look at the url and other like things to validate the email chain. This one was very, very close to what you'd think the email url should be. You can also look at the wording and it will be poorly written, formed, or something like that. This wasn't.
But I'd already paid the bill.
So instead of clicking on the "to pay link" I verified through my cc statement that the payment went through. It had. And then I called the center where they verified that I had paid.

The sophistication of these online scams is such that, we are going to be in a world of hurt her soon with a lot of people unwittingly falling for them.

General rule of thumb, if you get an email saying you owe some business money. Go through the following steps.
1) did you do business recently with said business?
2) is the amount correct
3) verify that you either already paid or didn't.
4) don't use the link in the email to go to the payment site. You should already have set up your log in to their site independently of the email.
5) call them if you still have questions before paying.