My mother called me earlier this week with a postcard in her hand. Cream-colored, official-looking, with a little Medicare-style logo in the corner that wasn't quite the right shade of blue. The postcard said her Medicare card was being upgraded to a new "chip-enabled" version for 2026, and she needed to call an 800-number within 14 days to verify her information or her benefits would be paused.
She was already reaching for the phone when I got there.
I took the postcard out of her hand. Drove out to my parents' place outside Detroit specifically because she didn't want to text me a picture of it. "It looks real," she kept saying. "It says Medicare." I get it. I really do. The thing is sitting on my kitchen counter as I type this — a little glossy rectangle of fraud, and the only reason it didn't work is because she called me first instead of the number printed on it.
This scam has been around since 2018, but the 2026 version is more sophisticated, the scripts are tighter, and the postcards look better than they did even two years ago. So I want to walk through what's happening, the actual scripts these people use on the phone and in texts, and what to do — and not do — if one of these lands in your mailbox or on your phone.
What the Scam Actually Claims
The pitch is some version of this: Medicare is mailing out "new" cards. Maybe with a chip. Maybe with a QR code. Maybe a "plastic" version to replace your paper one. They need to verify your identity before they can mail it. They want your Medicare Beneficiary Identifier, your Social Security number, your bank account, your address. Sometimes a small "processing fee" charged to a credit card.
None of that is real. Medicare cards have not changed since the 2018 rollout that replaced the old SSN-based HICN with the Medicare Beneficiary Identifier — that eleven-character mix of letters and numbers on the card you already have. There is no chip card. No plastic upgrade for 2026. No fee for getting a Medicare card replaced. If you actually need one (lost, damaged, stolen), it's free, and you order it through your account at medicare.gov or by calling 1-800-MEDICARE yourself.
One wrinkle worth knowing for 2026: Medicare actually has been mailing some people new cards this year — but it's the same paper card with a new ID number, not a chip, and it has nothing to do with the postcard above. After data breaches at Medicare contractors, CMS reassigned new Medicare Beneficiary Identifiers to about 1.3 million people, with the new numbers taking effect in mid-April 2026. Here's the tell: those replacements arrive in the mail automatically. No call to "verify" first. No fee. No website to confirm your identity. Your coverage doesn't change. So if a new card simply shows up, it may well be the real thing — but anyone phoning, texting, or postcarding you to "activate," "pay for," or "verify" a new card is running the scam.
The Senior Medicare Patrol — the federally funded program that tracks this stuff — has been flagging variants every year since the MBI rollout. Their 2026 fraud alert lists it among the highest-volume Medicare-related scams SMP counselors are fielding this year, alongside genetic testing fraud and fake hospice enrollments — the three SMP staff in our region brought up unprompted at the last counselor briefing I sat in on.
The Phone Script (Word for Word)
My father got one of these calls in 2024 and was savvy enough to put the guy on speaker. The script goes something like this:
"Good afternoon, this is [name] from the Medicare Coordination Office. I'm calling about your new Medicare card for 2026. Our records show you haven't activated your chip card yet, and I need to verify some information before we can mail it out. Can you confirm the last four digits of your Social Security number?"
That's the opener. Friendly. Specific-sounding office name ("Medicare Coordination Office" doesn't exist). Urgency without aggression. They start with the smallest ask — last four of your SSN, which they probably already have from a data breach. Once you confirm, they escalate: full SSN, then MBI, then bank routing number for "a refund of overpaid premiums." That's where the theft happens.
The Text Message Version
The phone version is the most common, but the text variant has been climbing fast. My mother's friend Tita Luz forwarded one to her last month. It read:
"MEDICARE: Your 2026 chip card is ready to ship. Confirm your address and ID at [shortened URL] within 24 hours to avoid coverage interruption. Reply STOP to opt out."
The shortened URL goes to a page that looks remarkably like medicare.gov — the same blue header, similar fonts, a stock photo of a smiling senior. But the actual domain is something like medicare-update-2026.com or my-medicare-card.org. Real Medicare uses medicare.gov. Period. No subdomains for special programs. No hyphenated variants. No .org or .net versions. If the URL isn't medicare.gov, it isn't Medicare. Medicare's own fraud and abuse reporting guidance, along with the FTC's separate consumer alerts on imposter scams, flag this exact pattern. The volume spikes every fall and again every January, when scammers know people are paying attention to their Medicare paperwork.
If you've ever wondered how to tell if a text message is a scam in general, this one hits four warning signs in a single message: urgency, a shortened URL, a request to verify info, and a sender that isn't actually identified beyond the word "Medicare."
The Mail Version (My Mom's Postcard)
This is the newest twist, and it's the one that almost got my mother. The postcard format works because mail still feels official to the generation that grew up with it. A text message can be ignored. A phone call can be hung up on. A piece of paper that arrives in your physical mailbox with a logo? That feels like the government.
The postcard I'm looking at right now has:
- A logo that's almost-but-not-quite the Medicare red-white-and-blue
- The phrase "Important: Time-Sensitive Medicare Notice" in red
- A return address in Washington, D.C. (a P.O. box, of course)
- An 800-number that is not 1-800-MEDICARE
- Fine print buried in 6-point gray type: "This is a notification service, not affiliated with the Centers for Medicare & Medicaid Services"
That last line is the legal cover.
The Four Words That End the Call
If you find yourself on the phone with someone claiming to be from Medicare and you're not sure, here's what I tell my parents to do. You don't have to be clever. You don't have to outwit them. You just have to say one of two things:
"Send me that in writing."
Or:
"I'll call Medicare directly."
Then hang up. That's it. A real Medicare-related call — and they are rare, because Medicare almost never calls you out of the blue — will not have a problem with either of those responses. A scam will. The scammer needs to keep you on the line because once you hang up, the spell breaks. The whole script is engineered around momentum.
My mother actually used the second line on a follow-up call she got two days after the postcard. The guy started getting irritated, then said, "Ma'am, by hanging up you're forfeiting your benefits." She hung up anyway. Granted, it wasn't funny in the moment — she was rattled — but by the next day she was telling the story to her sister on Viber and adding her own embellishments. That's the marker of someone who's processed it.
What Medicare Actually Does (and Doesn't Do)
This is the part I wish more people knew. Medicare communicates with you almost entirely by mail — real mail, the kind that comes in an envelope with a return address from the Centers for Medicare & Medicaid Services in Baltimore, Maryland (not Washington, D.C., interestingly). They send the quarterly Medicare Summary Notice. They send open enrollment packets. They mail your card when you first enroll. There's a longer breakdown of what real Medicare communications look like in how to spot a Medicare scam in 2026, if you want to keep building the muscle memory.
Medicare does not:
- Call you to verify information before mailing a card
- Charge a fee for a replacement card
- Send chip card upgrades (these don't exist)
- Text you links to "verify" anything
- Email you to confirm your benefits
- Show up at your door
The one legitimate phone number you need is 1-800-MEDICARE — that's 1-800-633-4227. The only number to verify anything. If something in your mail or on your phone is making you nervous, hang up or set the mail aside, then call 1-800-MEDICARE yourself and ask. The hold time is usually 20 to 40 minutes, which is annoying but solvable. Have a cup of coffee and put it on speaker. If a caller is pretending to be your insurance plan or your doctor's billing office and the conversation has taken a strange turn, the same rule applies. Hang up. Find the number on your card or on a recent bill. Call them yourself.
If You Already Gave Them Information
This is the part nobody wants to think about, but I'm going to walk through it anyway because it's where most people freeze. If you, or your mom, or your dad, gave any of this information to a scammer, here's the order of operations:
- Call your bank or credit card company first. Today. Within the hour if possible. Ask them to flag the account, change the number if a card was given, and watch for unusual activity
- Call 1-800-MEDICARE (1-800-633-4227) to report suspected fraud and get your MBI flagged. They can issue a new one if needed
- Report it to the Senior Medicare Patrol at smpresource.org — they have a state-by-state hotline and they track these reports for federal investigations
- File a report with the HHS Office of Inspector General at 1-800-HHS-TIPS (1-800-447-8477)
- Place a fraud alert with the credit bureaus — Equifax, Experian, TransUnion. Call one; they're required to notify the others
- Consider a credit freeze if SSN was given — more aggressive than a fraud alert, free since 2018
In any case, do not feel embarrassed. The system is designed to make you feel ashamed so you don't report it. Report it anyway.
A Word About AI Voice Cloning
One quick note, because this is starting to show up in the Medicare scam space too. Some of the more advanced versions of this scam now use AI voice cloning to impersonate someone you know — your doctor's office assistant, a Medicare counselor you spoke to before, a friend who "recommended" the service. I wrote about AI voice cloning scams more broadly here, but the short version is: if anyone, even someone whose voice you recognize, asks for any of the information above over the phone, you still call them back at a number you already have. Voice is no longer proof of identity. That ship sailed about two years ago.
The same goes for the IRS refund scam version of this — the playbook is identical, just with a different agency on the letterhead.
The Quiet Prevention Stuff
A few things I've set up for my parents that have made a real difference. Not glamorous. Just useful.
I turned on call screening on my mother's iPhone — Settings, Phone, Silence Unknown Callers. Calls from numbers not in her contacts go straight to voicemail. She didn't like it for the first two weeks because she missed a few doctor's office calls, but I added the regulars to her contacts and now she barely notices.
I added two-step verification to her Medicare account at medicare.gov. If anyone tries to log in, she gets a text. If she gets a text she didn't request, she knows someone has her password.
I taped a small index card to the fridge that says, in her handwriting because I wanted her to write it: "If anyone calls about Medicare, hang up and call Nino, then 1-800-633-4227." Nothing fancy. It's been there for two years and has stopped at least three calls cold.
And I check her physical mail every other Sunday when I'm there. Not because she can't, but because a lot of these postcards arrive on Saturdays, and catching them before she does means I can throw them out before they create a moment of doubt. She knows I do this. She thinks it's overkill. She's also the one who almost called the number on Tuesday's postcard, so we've reached a quiet truce on it. The four-second pause between picking up the mail and reading it is, weirdly, the most valuable security measure in the whole house.
What I'd Do This Week
If you have a parent on Medicare, do three things.
Write 1-800-633-4227 on a Post-it and stick it to their fridge. Tell them out loud: this is the only Medicare number — anything else is fake.
Tell them what Medicare doesn't do. Doesn't call to verify before mailing a card. Doesn't charge for replacements. Doesn't text links. Doesn't send postcards from a P.O. box.
Give them the four words. "Send me that in writing." Or: "I'll call Medicare directly." Practice it once.
The postcard from Tuesday is going in the shredder this weekend. My mother wants to keep it as a reminder. I told her she can keep it taped to the inside of her filing cabinet, behind the door, where it can't accidentally get picked up and called. She's already added a sticky note to it: "This is fake. Almost called. Didn't." That's the win I'll take.
