Millions of Medicare beneficiaries who recently requested replacement cards or changed their coverage are receiving legitimate new cards in the mail this year. At the same time, scammers are sending a wave of text messages that mimic those official mailings, asking recipients to “activate” a card or pay a fee that does not exist. The collision of real government mail and fake digital outreach has created a narrow window in which a single wrong tap on a phone screen can hand over a Medicare number, and with it, access to a person’s medical identity.
Why the timing makes beneficiaries especially vulnerable
CMS sends replacement cards when a beneficiary requests one or when a Medicare number, name, or coverage type changes. The agency provides a downloadable sample letter so recipients can compare what they receive against the real thing. Legitimate cards arrive only by postal mail, and CMS instructs people to destroy the old card and begin using the new one right away.
Scammers have learned to time their campaigns to overlap with these mailings. According to the New Mexico Aging and Long-Term Services Department, fraudsters specifically target beneficiaries during nationwide reissuance periods, when a text about a “new card” feels plausible rather than suspicious. The state agency warns that official Medicare communications arrive by mail only and that no activation step or fee is ever required.
A separate CMS disclosure adds another layer of risk. Between 2023 and 2025, unauthorized parties used valid beneficiary information to create Medicare.gov accounts without authorization. CMS opened a dedicated call center for affected individuals on May 2, 2025. That breach means some scammers may already hold verified contact details that line up with real card-mailing windows, making phishing texts harder to distinguish from genuine outreach.
What federal agencies say real cards look like and what scammers get wrong
The Federal Trade Commission has published clear markers that separate authentic cards from fakes. Real Medicare cards are paper, and no legitimate plastic Medicare card exists. Any caller, text, or email offering a plastic version is running a scam. The FTC also states that Medicare will not unexpectedly contact people by phone, email, text, or social media to ask for Medicare, Social Security, or bank information, and will never require payment for a Medicare card.
The stakes of handing over a Medicare number go beyond a single fraudulent charge. The HHS Office of Inspector General defines medical identity theft as the use of a Medicare number or personal information to submit fraudulent claims. Once a stolen number enters the billing system, it can generate false medical records, trigger unexpected bills, and complicate a beneficiary’s actual care.
