Medicare Scam Calls, Texts and Ads During Open Enrollment

Medicare Scam Calls, Texts and Ads During Open Enrollment

Between 15 October and 7 December 2026 Medicare beneficiaries are permitted to review and amend their plans. During this window, legitimate insurers and Medicare itself will contact users via phone, email, text, and social-media messages. Scammers exploit the same channels, inserting urgency and plausible deadlines to harvest personal, financial and medical data.

Attack Path and Exposure

1. Initial Contact – Scammers call, text, email or post a Google ad that mimics an insurer’s branding. The message references the December 7 deadline or claims a new benefit is available.
2. Social-Engineering Tactic – The contact stresses that failure to act will result in loss of benefits or higher premiums. The urgency is amplified by the real enrollment deadline.
3. Data Harvesting – Once trust is established, the attacker requests Medicare number, SSN, DOB, address, phone, email, bank or credit-card details, and sometimes prescription or provider information.
4. Monetization – Collected data can be used for identity theft, fraudulent Medicare claims, or to manipulate enrollment for commissions.

Evidence and Indicators

• Unsolicited Contact – Legitimate insurers only reach out after a beneficiary initiates a request.
• Requests for Sensitive Data – No legitimate insurer will ask for SSN or bank details over the phone.
• Fake Logos and Language – Ads and emails often use official logos but with spelling errors or mismatched URLs.
• Urgency Claims – Phrases such as "you have only days left" or "your benefits will be lost" are common.

Attribution and Context

The campaign is not tied to a single threat actor; it follows a common social-engineering pattern used by various fraud rings. The FinCEN report of $17.5 billion in suspicious healthcare-related activity in September 2026 indicates a broader industry problem that this campaign fits into.

Mitigation Steps for Engineers and Administrators

1. Validate Contact Source – Cross-check any caller or email against the insurer’s official contact list.
2. Block Known Phishing Domains – Update email filtering rules to block domains that host fake Medicare ads.
3. Educate Users – Deploy a short, clear message to beneficiaries: "Do not provide personal data over the phone or via email unless you initiated the call."
4. Monitor Account Activity – Flag any sudden changes to Medicare enrollment or new claims that appear after a suspicious contact.
5. Report Suspicious Activity – Forward phishing emails to the FTC and report fraudulent calls to the Medicare hotline.

Technical Controls

• Email Filtering – Use SPF, DKIM, and DMARC to reduce spoofed emails.
• Phone Call Blocking – Deploy caller ID verification and block numbers that match known scam patterns.
• Web Filtering – Block access to domains that host counterfeit Medicare ads.
• Endpoint Detection – Monitor for scripts that auto-populate forms with harvested data.

Open Question

While the campaign leverages legitimate enrollment dates, the exact coordination between scammers and the broader fraud ecosystem remains unclear. Further analysis of call logs and email headers could reveal whether a single group orchestrates the outreach or if multiple independent actors are involved.

Conclusion

The Medicare Open Enrollment period presents a predictable window for scammers to exploit legitimate outreach channels. By focusing on verification, user education, and technical controls, organizations can reduce the risk of data compromise and fraudulent claims.

Related coverage

• How SMB Cybersecurity Complexity Threatens Advanced Protection Goals
• FBI Ransomware Negotiation Arrest Highlights Industry Risks
• GlassWorm VS Code Themes and Ransomware Affiliate Betrayal Highlight Weekly Threat Brief

Explore more on this topic

• More medicare coverage