Federal regulators are telling Medicare beneficiaries to stop clicking on ads that promise a loaded “flex card” for groceries, gas, or household bills. The Federal Trade Commission issued a consumer alert in November 2024 calling such offers “probably a scam,” and in December 2024 the agency sent warning letters directly to healthcare plan marketers and lead generators accused of using deceptive tactics during open enrollment. The ads, which often skip the name of any actual insurance plan, violate existing Medicare marketing rules and can expose seniors to medical identity theft.
Federal crackdown on deceptive Medicare flex card ads
The core problem is simple: flashy online ads promise hundreds or even thousands of dollars on a prepaid card if a viewer calls a number or fills out a form. The ads rarely name a specific Medicare Advantage plan, which violates federal marketing standards that prohibit plans from advertising without identifying themselves by name. Instead, the ads collect personal information, including Medicare numbers, and funnel it to third-party marketing organizations that sell leads to insurance agents or, in some cases, to outright fraudsters.
The FTC’s November 2024 consumer alert was blunt. Ads offering “free phones or cash cards for gas, groceries, or bills” in exchange for enrolling in a health plan are “probably a scam,” according to the agency’s Spanish-language consumer alert. The alert urges people not to share Medicare, Social Security, or bank account numbers with anyone who contacts them out of the blue, and to hang up on unsolicited calls that pressure them to switch plans or claim a limited-time benefit.
Weeks later, FTC staff warning letters went out to healthcare plan marketers and lead generators, signaling that enforcement actions could follow if the practices continue. The letters cite concerns about ads that mimic government communications, hide or misstate plan sponsors, or exaggerate the availability of flex cards and other supplemental benefits. Recipients were told to review their advertising and lead-generation arrangements and to respond with details on how they plan to bring their operations into compliance.
The HHS Office of Inspector General has separately warned that handing over a Medicare number to an unknown caller or website can lead to medical identity theft. Fraudsters use stolen identifiers to bill Medicare for services never provided, which can corrupt a beneficiary’s medical records and create billing headaches that take months to resolve. The OIG directs victims to report suspected medical identity theft through 1‑800‑MEDICARE, their local Senior Medicare Patrol, or the OIG hotline, and to request copies of their Medicare Summary Notices to spot unfamiliar charges.
New CMS rules tighten third-party marketing controls
Regulators did not stop at warnings. The Centers for Medicare and Medicaid Services finalized two rounds of rule changes aimed at the marketing practices that make flex card scams possible. The 2024 Medicare Advantage and Part D Final Rule, numbered CMS‑4201‑F, prohibited ads that do not mention a specific plan name and restricted the misleading use of Medicare words, imagery, and logos. It also clarified that plan sponsors are responsible for the conduct of their contractors, including call centers and online lead generators.
The Contract Year 2025 regulation, numbered CMS‑4205‑F, went further by tightening oversight of Third‑Party Marketing Organizations, or TPMOs, and requiring prior express written consent before a TPMO can share a beneficiary’s personal data. Under these rules, seniors must clearly agree-on a recorded line or in writing-to be contacted about specific products, and they cannot be automatically signed up for a barrage of calls from multiple unrelated agents.
These consent requirements change how lead generators operate. Before the new rules, a single online form could route a senior’s information to multiple brokers and call centers, triggering a wave of unsolicited pitches. Now, TPMOs must document exactly which entities may contact a consumer, for what purpose, and by which communication channels. CMS has also stressed that a person’s decision to request information about one Medicare Advantage plan does not constitute permission to be marketed every plan in the region.
CMS paired these privacy protections with stricter content standards for advertising. Flex card promotions must accurately describe the underlying supplemental benefit, including eligibility limits, dollar caps, and any requirement to stay in-network or use the card only for approved services. Ads cannot imply that every enrollee will receive the maximum amount or that the card can be spent like unrestricted cash. Plans must also ensure that Spanish-language and other non‑English ads are as clear and complete as their English counterparts.
How beneficiaries can protect themselves
For Medicare beneficiaries, the safest approach is skepticism toward any unsolicited promise of free money. Regulators advise consumers to initiate contact themselves using trusted phone numbers on the back of their insurance card or on official government websites, rather than responding to ads in social media feeds or search results. People should refuse to share their Medicare number, Social Security number, or bank information with anyone who will not clearly identify their company and the specific plan they represent.
Experts also recommend working with local, unbiased counselors-such as State Health Insurance Assistance Programs or Senior Medicare Patrols-during open enrollment. These organizations can help beneficiaries compare plans, verify whether a flex card or other supplemental benefit is genuinely available in their area, and report suspicious marketing to regulators. By combining tougher federal oversight with informed consumer choices, officials hope to shrink the market for deceptive flex card pitches and keep seniors’ personal data out of the hands of scammers.
Free tool for readers: Built for Americans 55 to 80: a free, plain-English retirement check. See your Retirement Safety Score — your 0–100 number and a few steps — in about five minutes, no account needed.
