Open enrollment is peak season for Medicare fraud – how to tell real outreach from fakes and keep your details safe

ESET Expert

6 hours ago

6 min read

Scammers love a pretext. And with Medicare Open Enrollment, they have a perfect opportunity to exploit victim expectations, masking their fraud under the cover of legitimate activity.

From October 15 to December 7 beneficiaries are able to review and amend various parts of their plan. There’ll be ads, emails, messages and calls from genuine insurers at this time. Some might even ask for personal and health details.

That provides great cover for fraudsters, and enough plausibility for even skeptical consumers to drop their guard. Here’s what to look out for.

How do these Medicare scams work?

There are various ways scammers could approach you. They could call, message, email, or send a note on social media. They might also place an ad on Google, mocking up a website with official-looking logos and language to appear as if it’s a legitimate insurer, a specialist agency, or even Medicare itself.

The pretext for getting in touch, or posting the ad, could vary. Common ones include:

You should compare/change your plan by the December 7 deadline
Your Medicare card needs updating or replacing
You could qualify for additional benefits or lower premiums
Your existing coverage (or specific prescription coverage) is changing
You could be eligible for a new plan
They need to verify your account details
Your account has been linked to fraudulent activity

All seem plausible. But the scammer will usually employ some tried-and-tested social engineering techniques to pull you into their deceit. Urgency is a common tactic. It fires our synapses in specific ways that make us stressed and less likely to think logically, while possibly also triggering a fear of missing out. The real deadline of December 7 adds an element of truth to the lie that makes it more plausible still.

If you were told by an official-sounding representative that you could lose your benefits if you don’t act, or that you have just days to claim a lower premium offer, would you stop and think?

If they’re successful, the scammer will move on to the next stage: harvesting your personal, financial and/or medical information. They might ask for your:

Medicare number
Social Security number
Date of birth
Phone number
Email and home address
Account passwords
Health information such as doctors, prescriptions and medical records
Insurance information including provider, plan, member ID and policy details
Bank details and/or credit card information

Once you’ve handed some or all of the above over, you’re unlikely to ever hear from the scammers again. But in the background, they’ll be working hard to monetize your information for their own gain.

What do they want with your data?

There are various ways they might do this, depending on what data they’ve tricked you into handing over. They might want to commit various forms of identity fraud, using your personal and financial details to access your bank and personal accounts, or take out new credit lines in your name.

Alternatively, they may try to use your information to submit fraudulent Medicare claims in your name, for services, equipment or prescriptions that you never received. Or to actually obtain these goods and services. Scammers might even try to manipulate your Medicare enrollment in order to generate fraudulent commissions or compensation.

In September 2026, the Treasury’s Financial Crimes Enforcement Network (FinCEN) identified around $17.5 billion in suspicious financial activity that may be linked to healthcare fraud like this.

Depending on exactly what avenue the scammers explore, an incident could leave you out of pocket, impact your coverage, impair your medical records, and plunge you into a bureaucratic nightmare that leaves you in severe emotional and mental distress.

How to spot and avoid Medicare scams

All of which makes it more important than ever that you’re able to spot the tell-tale signs of a Medicare scam at this time of year. You should be extremely dubious of any unsolicited contact, especially if the individual asks for personal, financial or health details. And even more so if they try to pressure you into handing over this information, or promise benefits that seem too good to be true.

Figure 2. The sender’s email address is grounds enough for being skeptical of the ‘refund’ (source: California Health Advocates)

Yes, genuine insurers might get in touch seemingly out of the blue. But this will usually not be without your prior consent. And they should never try to strong-arm you into handing over details.

The best approach to steering clear of Medicare scams during open enrollmentseason is to:

Spot the warning signs listed above, and if in doubt, put down the phone or don’t reply to the message. You can always verify separately with the caller/sender to check if they are legitimate (using contact details sourced separately from the inbound contact).
Be very careful about online searches. Don’t click through on any Google ads, and if you’re looking for official Medicare sites be sure the address has a .gov ending.
Type the name of the site you want to visit directly into the search/address bar. Medicare is at Medicare.gov (800-633-4227), while HealthCare.gov (800-318-2596) is where to check if you qualify for savings. Help is also available from your State Health Insurance Assistance Program (SHIP), or local Senior Medicare Patrol.
Report any suspicious contact.

What a real call looks like

Some insurers and other third parties may pick up the phone to get in touch during the Open enrollment period. But you should be able to tell them apart from fraudsters because they will clearly identify themselves and their organization and give a detailed explanation of why they’re calling. They won’t use pressure tactics or offer too-goo-to-be-true gifts and benefits. And they won’t try to force you to hand over sensitive information straight off the bat.

They should be courteous and provide you with ways to verify who they say they are, even if it means hanging up. And they’ll often be calling because you initiated contact with their organization.

What to do if you’ve already been scammed

If you feel like you’ve fallen victim to a Medicare scammer, don’t panic. Work through the following steps:

Call or contact Medicare at Medicare.gov or 800-633-4227 to report the incident. Also tell the FTC at ReportFraud.ftc.gov and your state attorney general
If you have handed over your bank account/card details, contact your bank and check if you can freeze your card
If you’ve handed over other identity-related information, consider reporting the incident to IdentityTheft.gov
Check your Medicare claims and records for any unusual activity or charges
Contact your healthcare provider/insurer if you have seen any fraudulent activity
Change any passwords you might have handed over to the scammers, across any sites you reuse them on
Don’t fall for recovery fraud. If anyone gets in touch after an incident promising to get your money back or sort everything out on your account for a fee, it’s another scam

Your health is important. But so is your personal information. So slow down this Open enrollment season and verify every request for personal and medical details.

Frequently Asked Questions (FAQs)

When is Medicare Open Enrollment?

It runs from October 15 to December 7 each year, during which time you can make some changes to your coverage.

Would Medicare or my insurer ever call me during open enrollment?

A representative from Medicare, your insurer or a third party may call. But put the phone down if they start pressuring you into handing over your details, asking for financial information, or promising too-good-to-be-true benefits. Call them directly to double check, eg 1-800-MEDICARE (1-800-633-4227).

What are the main red flags for a Medicare scam?

Watch out for unsolicited contact, especially if the individual asks for personal, financial or health details. And even more so if they try to pressure you into handing over this information, or promise benefits that seem too good to be true. Contact could come via email, phone, social media, or text. Scammers might also buy Google ads to lure you.

What do Medicare scammers want?

They want your medical, financial, personal and possibly your insurance details. They might want this to commit identity fraud, access your bank account, submit fraudulent Medicare claims or obtain goods and services in your name, or manipulate your enrollment.

Can a Medicare scam affect my healthcare?

Yes. Fraudulent claims or misuse of your medical identity could impact your insurance coverage, medical records, prescriptions and access to healthcare. It may also land you with plenty of distressing administrative work to clear your name.

How do I know if a phone call is a Medicare scam or not?

They should clearly identify themselves and their organization and give a detailed explanation of why they’re calling. They won’t use pressure tactics or offer too-goo-to-be-true gifts and benefits. And they won’t try to force you to hand over sensitive information straightaway. They should allow you to hang up and verify their identity. Usually they’ll only call because you have requested it.

What should I do after falling for a Medicare scam?

Call or contact Medicare at Medicare.gov or 800-633-4227 to report the incident. Also tell the FTC at ReportFraud.ftc.gov and your state attorney general. If you’ve handed over your bank account/card details, contact your bank and check if you can freeze your card. Check your Medicare claims and records for any unusual activity or charges. Contact your healthcare provider/insurer if you have seen any fraudulent activity. Change any passwords you might have handed over to the scammers, across any sites you reuse them on. Don’t fall for recovery fraud scammers who promise to get your money back.