Every October America opens its wallet for health coverage, and every October a bunch of clowns buy the top Google slot for “Medicare.gov” and just wait. The FTC is yelling about it. Google is still cashing the check.
Medicare Open Enrollment runs October 15 through December 7, 2026. The FTC put out its late-September warning that scammers and dishonest businesses are paying to sit at the top of search results for Medicare and Marketplace coverage. The playbook is not new. The volume is. And the part that should make you throw your laptop is that this is not some dark-web magic, it is paid advertising on platforms that know exactly what is happening and keep the revenue anyway.
What happened
The FTC’s September 28, 2026 consumer alert is blunt: before you click a search result for health coverage, remember that scammers and shady shops sometimes pay to appear first. They use lookalike URLs, official-looking logos, and the right keywords so you think you are on Medicare.gov or HealthCare.gov when you are not. Click the ad, call the number, and you either buy a “plan” that is not insurance, or you hand over enough personal data for medical identity theft. Either way you lose.
This sits on top of a bigger fight. On October 1 the FTC published an Advance Notice of Proposed Rulemaking aimed at search engines, social media, and digital marketplaces that keep amplifying government and business impersonation scams through ad optimization. The Impersonation Rule already bans the impersonators. What it does not do is make the platforms eat the cost of optimizing the ads that make those scams work. So the FTC is asking whether it should force that internalization. Translation: the platforms have been treating fraud as someone else’s externality, and the agency is finally looking at the business model.
Separately, earlier in 2026 the FTC warned about a twist where fake “FTC agents” text you a photo of an employee ID to “verify” they can help you recover money from a previous scam. Real FTC employees do not text you. They do not WhatsApp you. They do not send photo IDs. They do not help you recover money by asking you to move it into a new account. If someone does any of those, hang up.
Who is screwed
Older Americans on fixed incomes searching for Medicare Advantage or Part D changes. Marketplace shoppers who just type “healthcare.gov” into Google and click the first blue link. Anyone who trusts a sponsored result more than they trust typing a URL. Also, every victim of a previous scam who then gets hit with the refund-and-recovery sequel, which is the industry’s favorite encore.
And, quietly, every CISO whose org runs benefits enrollment portals or who has employees getting phished with “your Open Enrollment starts now” emails that look almost right. Medical identity theft is not just a grandma problem. It is a credentials-and-claims problem that spills into your HR and benefits stack.
Technical breakdown
The mechanics are boring and effective. Ad platforms sell keyword auctions. Scammers bid on high-intent terms like “Medicare Open Enrollment,” “switch Medicare plan,” “HealthCare.gov login.” They land you on a clone site with a near-miss domain, scrape your Medicare number and bank details, then either sell the data or submit fraudulent claims for services you never received. CMS and the Senior Medicare Patrol have been yelling about this for years. The scam does not need a zero-day. It needs a credit card and a logo.
What is changing is the regulatory pressure on the platforms. The Impersonation Rule already covers the scammers. The October 1 ANPR is the FTC asking whether the platforms that profit from the ads should have a duty to stop amplifying them. That is the interesting fight. Not “are there scams,” of course there are. “Who gets paid when the scam works.”
Red flags that scream “hang up”
- A sponsored search result for Medicare.gov or HealthCare.gov that is not the real .gov domain
- Anyone asking for your Medicare number, bank info, or a payment over the phone unsolicited
- A text or WhatsApp from an “FTC agent” offering to recover your money, complete with a photo ID
- Pressure to enroll “today only” or “your benefits will be cancelled”
- A URL that is one letter off: mediccare.gov, healthcare-gov.com, myhealthcaregov.net, the classics
What to do Monday morning
- Type the URL. Medicare.gov. HealthCare.gov. Do not click the first Google result. Do not click the ad. Ever.
- Call the real numbers: Medicare 1-800-633-4227, Marketplace 1-800-318-2596. Write them down once.
- If someone contacts you claiming to be FTC or Medicare, hang up, then go to ReportFraud.ftc.gov yourself. Do not use any link they sent.
- For CISOs: brief your workforce on Open Enrollment phishing. Spoofed “benefits portal” emails spike every October. Put the real enrollment URL in your intranet and tell people to use that and only that.
- Report the ad. Platforms will shrug, but reports are how patterns get documented for the FTC’s next round of “we told you so.”
Sources
- FTC Consumer Alert, What to know ahead of Open Enrollment (2026-09-28): consumer.ftc.gov
- FTC Advance Notice of Proposed Rulemaking on platform-amplified impersonation scams (Federal Register, 2026-10-01): govinfo.gov
- FTC, A real FTC employee won’t text you their photo ID (2026-06-03): consumer.ftc.gov
- Detroit Free Press coverage of the FTC warning (2026-10-06): freep.com
