ESET warns of Medicare fraud surge during Open Enrollment season
Scammers exploit the October 15 to December 7 window to harvest sensitive health and financial data from beneficiaries.
Key points
- Medicare Open Enrollment runs from October 15 to December 7, creating a high-risk period for fraud.
- Scammers use urgency and fake deadlines to pressure victims into revealing personal health information.
- FinCEN identified roughly $17.5 billion in suspicious activity linked to healthcare fraud in September 2026.
ESET Research has published a new advisory warning that Medicare Open Enrollment is the peak season for fraudsters targeting beneficiaries. The period runs from October 15 to December 7, during which legitimate insurers contact enrollees about plan changes. This legitimate outreach provides scammers with a plausible pretext to mask their fraudulent activities under the cover of official business.
According to the ESET report, attackers employ various channels to reach victims, including phone calls, text messages, emails, and social media notes. They also place deceptive advertisements on platforms like Google, using official-looking logos and language to mimic legitimate insurers or Medicare itself. These ads often direct users to cloned websites designed to appear authentic, further blurring the line between real outreach and scams.
Common Tactics and Pretexts
Scammers use several common pretexts to initiate contact, all of which exploit the natural expectations of beneficiaries during this enrollment window. According to ESET, these include claims that beneficiaries must compare or change their plans by the December 7 deadline, or that their Medicare card needs updating or replacing. Other frequent lies involve promises of additional benefits, lower premiums, or warnings that existing coverage is changing or linked to fraudulent activity.
Urgency is a primary social engineering technique used in these campaigns. The ESET analysis notes that pressure tactics trigger stress and reduce logical thinking, making victims more likely to comply with requests. The real December 7 deadline adds an element of truth to the deception, making the urgency feel legitimate. Victims are often told they will lose benefits or miss out on lower premiums if they do not act immediately.
Data Harvesting and Financial Impact
Once a scammer establishes contact, the goal is to harvest personal, financial, and medical information. ESET lists specific data points attackers seek, including health information such as doctors, prescriptions, and medical records. They also target insurance details, including provider names, plan types, member IDs, and policy numbers. After obtaining this data, scammers typically cut off contact to monetize the stolen information in the background.
The stolen data can be used for identity fraud, allowing criminals to access bank accounts or open new credit lines in the victim's name. Alternatively, attackers may submit fraudulent Medicare claims for services, equipment, or prescriptions that were never received. In some cases, they may manipulate enrollment to generate fraudulent commissions. The financial scale of this threat is significant, with the Treasury’s Financial Crimes Enforcement Network identifying around $17.5 billion in suspicious activity linked to healthcare fraud in September 2026.
What should you do?
ESET advises beneficiaries to remain extremely dubious of any unsolicited contact, particularly if the individual asks for personal, financial, or health details. The advisory highlights that pressure tactics and promises of benefits that seem too good to be true are strong indicators of a scam. Victims should verify the legitimacy of any communication through official channels rather than responding to the initial contact.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: ESET
- Treat all unsolicited calls, texts, or emails requesting Medicare details as suspicious and do not provide personal information.
- Verify any claims about plan changes or card updates by contacting your insurer directly using phone numbers from official documents.
- Monitor bank statements and Medicare Explanation of Benefits for unauthorized transactions or claims for services you did not receive.
- Be wary of urgency tactics, especially those referencing the December 7 deadline, and take time to think before acting.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When does Medicare Open Enrollment occur?
According to ESET Research, Medicare Open Enrollment runs from October 15 to December 7 each year.
What data do scammers typically target during this period?
Scammers seek health information like prescriptions and medical records, as well as insurance details such as member IDs and policy numbers.
How much suspicious activity was linked to healthcare fraud recently?
FinCEN identified around $17.5 billion in suspicious financial activity linked to healthcare fraud in September 2026.
