The Medicare card scam: why the 'new card' call is a lie

A polite voice calls. It claims to be from Medicare, or "the Medicare benefits department," or sometimes the more generic "your coordinator." There is a new card on the way — plastic, chip-enabled, with new fraud protections — but before it ships, the caller needs to verify a few details. Your Medicare number. Your date of birth. The address on file. Maybe a bank account, "just to confirm the no-cost enrollment fee is waived for you specifically."

None of it is real. Medicare does not call you out of the blue. The script is engineered to sound bureaucratic and reassuring because that is what works on the people it is aimed at.

What the caller actually wants

Two things, sometimes a third.

The first is your Medicare number. Until 2018, that number was your Social Security number — the federal government has since switched to a randomized 11-character identifier called the MBI, but the new format is just as valuable. It is the key to billing fraud: a bad actor with a Medicare number, a name, and a date of birth can submit fake claims for equipment, tests, or services that never happened. The victim usually finds out months later when a denial letter or a Medicare Summary Notice arrives in the mail.

The second is your bank or card details. The framing is often a "small one-time processing fee" — five dollars, twenty, never enough to alarm — and once the number is captured, the scammer either runs charges directly or sells the details on.

The third, when the scammer has time, is a soft profile of you: whether you live alone, who handles your bills, who your primary doctor is. All of this gets logged. It makes the next call from the same operation — or whoever buys the lead list — far more effective.

The tells

Real Medicare communication is almost entirely by mail. There is one narrow exception: if you yourself called 1-800-MEDICARE and left a callback request, an agent may call you back. Every other unsolicited inbound call claiming to be from Medicare is, by policy and in practice, not Medicare.

A few patterns repeat across the calls our community reports flag as Medicare impersonation:

• The caller already knows your name and approximate age. They do not know your Medicare number, which is the only thing they actually need.
• There is artificial urgency: the new card ships today, the benefit window closes this week, the open-enrollment deadline is tomorrow.
• They volunteer numbers that sound official — a case ID, an agent badge, a "CMS reference." None of these are things you can verify.
• They ask you to stay on the line and not hang up to call anyone. That sentence appears in almost every script. Real agencies are happy for you to hang up and call back through a published number.

What to do when one of these calls lands

The short version: hang up. You do not have to be polite about it. The longer version, if you want a defensible script:

1. Do not confirm anything, including your name or that you are on Medicare. A flat "I don't take calls from numbers I don't recognize" is enough.
2. Hang up and look the number up. A repeat Medicare-impersonator number will usually have community reports on it within a day or two of going live.
3. If you are unsure whether a real notice is in flight, call 1-800-MEDICARE (1-800-633-4227) directly. Use the number on the back of your Medicare card or on medicare.gov — not a number the caller offered.
4. Report the call. The Senior Medicare Patrol (smpresource.org) is the program that exists for exactly this. The FTC's reportfraud.ftc.gov is the general-purpose channel. Both feed back into enforcement data even when no money was lost.

Nobody who actually represents Medicare will ever ask you to verify your Medicare number over an unsolicited phone call. There is no scenario in which that is the real process.

If you already gave the number

It is recoverable, but treat it like a small fire and not a small embarrassment. Call 1-800-MEDICARE directly and tell them the number may be compromised. Watch your Medicare Summary Notices for claims you do not recognize, and dispute any you find. If you also gave a bank or card number, call the bank's published fraud line — not any number the caller mentioned — and freeze the account. The faster you move in the first day, the less ground there is to recover later.

The scam is old, the script is tired, and the people running it are counting on the call landing during a moment when a real official-sounding voice would be reassuring instead of suspicious. Reverse the default. Hang up first, verify second.