ESET Research details Medicare Open Enrollment social engineering tactics

ESET Research published an analysis of Medicare fraud trends coinciding with the annual Open Enrollment period. The report highlights how attackers mimic legitimate insurers to steal personal information from beneficiaries.

What happened

The Open Enrollment window runs from October 15 to December 7, allowing beneficiaries to review their plans. This period generates a high volume of legitimate communications from insurers. Scammers exploit this noise to mask fraudulent outreach. They pose as official representatives, specialist agencies, or even Medicare itself. Attackers contact victims via phone calls, text messages, emails, and social media notes. Some also place deceptive advertisements on platforms like Google. These ads feature official-looking logos and language to appear credible.

Common pretexts include claims that a beneficiary must change their plan by the December 7 deadline. Others allege that a Medicare card needs updating or replacing. Scammers also promise additional benefits, lower premiums, or warn of account fraud. These scenarios are designed to create a sense of urgency. The tactic pressures victims into acting quickly without verifying the source. The real deadline adds plausibility to the deception.

Why it matters

Once a victim engages, the goal is harvesting sensitive data. Attackers request health information such as doctors, prescriptions, and medical records. They also seek insurance details including provider names, plan types, member IDs, and policy numbers. Victims rarely hear from the scammers again after providing this information. The stolen data is then monetized in the background.

Scammers may use the data for identity fraud, accessing bank accounts or taking out new credit lines. They can also submit fraudulent Medicare claims for services never received. Alternatively, they might obtain actual goods or prescriptions using the victim's identity. Some attackers manipulate enrollment records to generate fraudulent commissions. The Treasury’s Financial Crimes Enforcement Network (FinCEN) noted around $17.5 billion in suspicious activity linked to healthcare fraud in September 2026.

What to watch

• Verify the source of any unsolicited contact regarding Medicare changes.
• Check for urgent demands to provide personal or financial details.
• Look for promises of benefits that seem unusually generous or immediate.
• Confirm deadline claims against official Medicare communications.

Signals worth monitoring

Security operations teams should monitor for spikes in inbound communications referencing Medicare deadlines. Look for alerts on outbound data transfers containing health records or insurance identifiers. Check for unusual login patterns from beneficiaries accessing sensitive portals. Verify if multiple accounts are being modified or enrolled in new plans rapidly. Investigate any requests for verification codes or personal data via unofficial channels. Ensure logging captures the source IP and user-agent of incoming calls or messages. Correlate these signals with known scam pretexts such as card updates or benefit changes.

Background: Social engineering

Social engineering manipulates psychological triggers like urgency and authority to compel victims into bypassing security protocols. It succeeds not because of technical flaws, but because humans are wired to trust familiar patterns and helpful colleagues. Defending against it requires verifying identity through out-of-band channels and treating unexpected requests as suspicious regardless of their source.

Read the full guide: Social Engineering: How Manipulation Bypasses Technical Defenses

What to do and how to stay safe: ESET

• Report suspicious calls or messages to the Federal Trade Commission.
• Contact Medicare directly using official phone numbers to verify plan changes.
• Monitor bank and credit statements for unauthorized transactions or inquiries.
• Review Medicare Summary Notices regularly for claims you did not authorize.

Step-by-step guide: Security Awareness Training for Small Business: Real Defense

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When does the Medicare Open Enrollment period occur?

The period runs from October 15 to December 7 each year.

What types of data do scammers typically request?

They ask for health information, insurance details, member IDs, and financial data.

How much suspicious activity did FinCEN identify in September 2026?

FinCEN identified around $17.5 billion in suspicious financial activity linked to healthcare fraud.