Medicare scam calls: how to spot them

Scammers copy Medicare because millions of people use it. Here's how to tell a fake Medicare message from a real one, and what to do if you already clicked.

A woman working through her inbox on a laptop
Photo: Aleksei Zhivilov / Unsplash

In short

Most common fake: You need a new or updated Medicare card, just confirm your Medicare number.

Safest check: Hang up and call 1-800-MEDICARE (1-800-633-4227) yourself.

Where to report it: Call 1-800-MEDICARE (1-800-633-4227) or report Medicare fraud online through the HHS Office of Inspector General.

Example · fake Medicare messageIllustrative, links disabled
Medicare Alert: Your Medicare card is expiring. To keep your benefits, confirm your Medicare number and pay the $9.95 card fee today at medicare-card-renew[.]net/update
An example fake Medicare message with the warning signs highlighted.

What Medicare says

Medicare says it will never call you to sell you anything or come to your home, and it only phones in limited cases, such as returning a call you made. The FTC adds that real Medicare will not call, text or email out of the blue to ask for your Medicare number or a payment, and Medicare cards are free. Source: Medicare.gov

Common fake Medicare messages

These are the 5 shapes a fake Medicare message usually takes. They are listed in the order we see them most often, and none of them is something Medicare itself does.

  1. You need a new or updated Medicare card, just confirm your Medicare number
  2. Pay a small fee to keep your Medicare coverage active
  3. Free back brace, genetic test or medical supplies if you share your Medicare number
  4. Pushy call during Open Enrollment to switch you to a new plan
  5. Caller who already knows some of your details and asks for bank or card information

Medicare's real web addresses

Genuine Medicare links and emails use these domains. Look at the part just before the first single slash: medicare.gov is real, but medicare-support-center.com or medicare.gov.account-check.top are not.

  • medicare.gov
  • cms.gov

Scammers can also hide a fake link behind real-looking text. Learn how to read a web address.

How to check a Medicare message safely

  1. Hang up and call 1-800-MEDICARE (1-800-633-4227) yourself
  2. Never give your Medicare number to someone who contacts you unexpectedly
  3. Compare plans at Medicare.gov or with your local State Health Insurance Assistance Program (SHIP)
  4. Check your Medicare statements for services or equipment you never received

How to report a fake Medicare message

Also report it to the official fraud service in your country. See the worldwide list.

If you clicked, paid or shared details

Act quickly. It makes a difference.

  1. If you entered card or bank details, call your bank now using the number on your card, and ask them to block the card.
  2. If you entered a password, change it at medicare.gov, typed into your browser yourself, and turn on two-step verification. Do not use any link from the message.
  3. Expect follow-up calls or messages pretending to help, sometimes claiming to be from Medicare security. Never share one-time codes and never move money to a "safe account".
  4. Call 1-800-MEDICARE (1-800-633-4227) or report Medicare fraud online through the HHS Office of Inspector General, then delete the message.

More help: Phishing links and fake login pages and what to do after a scam.

How to protect yourself next time

Use a password manager

It only fills in your password on the real website, so a look-alike login page gets nothing. It also makes a different password for every account, so one leak doesn't open the rest.

Free: Bitwarden has a free plan, and even the password manager built into your phone or browser beats reusing one password everywhere.

  • NordPass Partner link Password manager with a free plan and a family plan for up to six people.

Turn on two-step verification, ideally with a security key

With two-step verification, a stolen password isn't enough on its own. A hardware security key goes further: it simply doesn't work on a fake site, so it can't be phished.

Free: Two-step verification is free. Switch it on in the security settings of your email, bank, WhatsApp and social media accounts today.

  • YubiKey (Yubico) Partner link A small USB or NFC key you tap when you log in. It will not work on a fake site.

Compare the tools that help, and what each costs

Links marked Partner link may earn us a commission, at no cost to you. It never changes our advice, and the free option always comes first. Affiliate disclosure.

Questions people ask

Does Medicare send messages asking for payment or personal details?

Medicare says it will never call you to sell you anything or come to your home, and it only phones in limited cases, such as returning a call you made. The FTC adds that real Medicare will not call, text or email out of the blue to ask for your Medicare number or a payment, and Medicare cards are free.

How can I check if a Medicare message is real?

Hang up and call 1-800-MEDICARE (1-800-633-4227) yourself. Never give your Medicare number to someone who contacts you unexpectedly. Compare plans at Medicare.gov or with your local State Health Insurance Assistance Program (SHIP). Check your Medicare statements for services or equipment you never received.

How do I report a fake Medicare message?

Call 1-800-MEDICARE (1-800-633-4227) or report Medicare fraud online through the HHS Office of Inspector General. Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov. Get free help from your Senior Medicare Patrol on 1-877-808-2468.

I clicked a link in a fake Medicare message but did not enter anything. Am I at risk?

Opening a link is far less serious than filling one in. Close it, and if you need your account, reach it by typing medicare.gov yourself. Clicking does tell the sender your number is live, so expect more messages for a while: call 1-800-medicare (1-800-633-4227) or report medicare fraud online through the hhs office of inspector general.

Was this page helpful?

Have you had this one?

Tell other people what the message said and how it reached you. It helps someone recognise it before they tap.

Leave out your own phone number, email and bank details. A person reads every comment before it appears. Phone numbers and web addresses are hidden when it's published. Scammers pretend to be real companies, so a company named in a comment is almost always being impersonated, not accused. See our privacy notice.

Official sources and further reading

We check our pages against official advice from the organisations themselves and from government agencies.