The Centers for Medicare and Medicaid Services began mailing new Medicare cards to tens of millions of beneficiaries starting in April 2018, replacing Social Security number-based identifiers with a randomly assigned Medicare Beneficiary Identifier, or MBI. The change was required by the Medicare Access and CHIP Reauthorization Act of 2015, and CMS completed the distribution ahead of its statutory deadline. But the rollout has also given scammers a fresh script, and federal agencies are warning beneficiaries that Medicare will never call to sell a card or request personal information.
Why the MBI card switch created a new fraud opening
Stripping Social Security numbers from Medicare cards was designed to reduce identity theft. The old cards printed a beneficiary’s SSN directly on the front, making every lost wallet or stolen envelope a potential fraud event. CMS replaced that system with a unique, randomly assigned Medicare number that cannot be traced back to a Social Security number. Cards were mailed between April 2018 and April 2019, and beneficiaries did not need to apply or call to receive one.
The transition itself, though, handed con artists a believable pretext. Scammers began calling beneficiaries with offers to help “activate” new cards, sell plastic replacement versions, or verify personal details before a card could ship. The Federal Trade Commission documented these tactics and warned that callers requesting fees, SSNs, or bank account numbers were running a scam. A stolen Medicare number can be used to submit fraudulent claims, creating medical identity theft that can distort a person’s health records and trigger bills for services never received.
No public data from CMS or the FTC quantifies how many beneficiaries reported card-related scam contacts during or after the mailing window. That gap makes it difficult to measure whether people who updated their addresses through the Social Security Administration before the rollout experienced fewer fraudulent calls than those whose records were outdated. The hypothesis is plausible on its face: an accurate address means the real card arrives quickly, leaving less time for a scammer’s pitch to seem credible. But without published complaint volumes or address-update completion rates, that connection stays unconfirmed.
What CMS and the FTC have said on record
CMS has repeated the same core message across multiple releases: Medicare will never call uninvited to request personal or private information, and new cards arrive automatically and for free. A CMS job aid directed at community organizations helping beneficiaries states plainly that no action is needed beyond keeping an address current. Beneficiaries who need a replacement can request one by calling 1-800-MEDICARE.
The FTC reinforced that guidance from the consumer-protection side. The agency’s published alerts specify that Medicare will not call, email, text, or message on social media to sell anything or to request payment for a Medicare card. Scam scripts documented by the FTC include offers of plastic cards for a fee and requests for bank details disguised as “verification” steps. The agency’s advice is direct: hang up.
CMS also issued follow-up guidance after the initial mailing concluded, urging beneficiaries to continue guarding their new numbers. The HHS Office of Inspector General separately warns that medical identity theft can lead to incorrect diagnoses or treatments if a thief’s medical history becomes mixed with a victim’s records. That warning aligns with CMS’s emphasis that the new MBI should be treated like any other key piece of health or financial information: shared only with trusted providers, Medicare Advantage or Part D plans, and other entities that legitimately bill Medicare.
How the new cards are supposed to work
The redesigned cards feature a new layout and a different look intended to make them easier to recognize and harder to misuse. CMS highlighted the updated format in a preview of the card design, noting that the MBI uses a mix of numbers and uppercase letters that does not include easily confused characters. The card still lists the beneficiary’s name and coverage information, but not a gender marker or signature line, further limiting the value of a stolen card to an identity thief.
According to official Medicare guidance, beneficiaries should carry the new card when they go to the doctor, hospital, or other health care provider. Providers are expected to accept either the old Health Insurance Claim Number or the new MBI during a transition period, but the long-term goal is to use only the new identifier. Beneficiaries who misplace a card can log into their online Medicare account or call Medicare directly to request a replacement, rather than turning to third parties.
Practical steps to avoid card-related scams
Federal agencies consistently recommend a few simple precautions. First, beneficiaries should never give their Medicare number or other personal information to anyone who contacts them unexpectedly by phone, email, or text. If a caller claims to be from Medicare and pressures someone to act immediately or pay a fee, that is a red flag. Second, people should check their Medicare Summary Notices and other statements for unfamiliar charges and report anything suspicious to Medicare or the HHS OIG hotline.
Advocates who work with older adults are also encouraged to share these messages in community presentations and one-on-one counseling sessions. The goal is to ensure that beneficiaries understand both sides of the card change: the security benefit of removing Social Security numbers, and the new set of fraud schemes that have emerged around the transition. With clear information and a healthy skepticism of unsolicited contacts, beneficiaries can take advantage of the new cards’ protections without becoming targets for scammers.
