Scams & Safety

By the Retiree Report Editorial Team · Updated 2026-07-10 · 7 min read

This article is general information, not medical advice. Talk with a licensed clinician before making any decision about your care.

The Medicare card replacement scam in 2026: how to spot fake CMS calls and letters

If someone calls, texts, or emails saying they need to “verify your identity” before sending your new Medicare card, hang up. Real Medicare card replacements never work that way — they arrive in the mail, they’re free, and no genuine representative will phone you out of the blue asking for your Medicare number. The catch this year is that Medicare really is mailing new cards to some people, and scammers know it.

Why are new Medicare cards showing up in 2026?

There’s a real reason behind the mailings, and that’s exactly what makes the scam so effective. After a data incident affecting Medicare.gov online accounts, the Centers for Medicare & Medicaid Services began notifying beneficiaries whose personal information may have been exposed. Roughly 103,000 people got the first round of notices, but the response grew far larger than that.

CMS ended up processing about 1.3 million new Medicare Beneficiary Identifiers — the number printed on your card — with an effective date of April 14, 2026. Affected beneficiaries were mailed replacement cards throughout March 2026, each with a letter explaining why the number changed. According to Kiplinger, the fraud involved criminals creating fake online accounts between 2023 and 2025 using stolen details like names, birth dates, ZIP codes, and existing Medicare numbers.

Here’s the part scammers are counting on: most people have no idea whether they were affected. That uncertainty is the opening.

What a legitimate card replacement actually looks like

A genuine new Medicare card comes one way — by U.S. mail. It’s paper, red, white, and blue, and it costs nothing. If your number was reassigned, the envelope also contains a plain letter from CMS explaining the change. Your coverage, your plan, and your benefits don’t change at all; only the identifier on the card is new.

What Medicare will not do is call you first. As the FTC puts it plainly in its consumer alert, “Your Medicare number is valuable. Protect it” — and Medicare won’t call to verify your card, because your cards are paper (not plastic) and they’re free. CMS staff only contact you if you reached out to them first. Any unsolicited call, text, or email claiming to “activate,” “confirm,” or “upgrade” your card is a red flag, full stop.

One more detail worth knowing: if you were part of the 2026 reissue, your new number simply became active on April 14, 2026. You didn’t need to call anyone, pay a fee, or “register” it. Show the new card at your next appointment and you’re done.

How do the fake calls and letters try to trick you?

The scripts change, but the goal never does — they want your Medicare number, your Social Security number, or a payment. A caller might claim to be a “CMS verification officer” who needs to confirm your details before your replacement card can ship. Another says your old card has been “deactivated” and demands a fee to reissue it. A text from an unfamiliar short code offers a shiny new “plastic Medicare card” or a “flex benefits card” if you’ll just click a link.

Would Medicare ever charge you for a card, threaten to cancel your coverage over the phone, or text you a link to claim benefits? No. The Federal Communications Commission warns that these robocalls and impersonation calls are among the most common scams aimed at older Americans, and the pressure tactics — urgency, threats, a countdown — are the tell. Real agencies don’t rush you.

Watch for these specific claims, all of which are fake:

• “You need a new plastic Medicare card.” Medicare cards are paper. There is no plastic upgrade.
• “There’s a $25 (or $50) processing fee for your replacement.” Replacement cards are always free.
• “Confirm your Medicare number to activate the card we mailed.” No activation call exists.
• “Press 1 now or your benefits will be canceled.” Medicare doesn’t cancel coverage by robocall.

The danger isn’t just losing a few dollars. Hand over your Medicare number and you’re exposed to medical identity theft — someone using your information to bill for care, drugs, or equipment you never received. The FTC notes that Medicare fraud, errors, and abuse cost taxpayers roughly $60 billion a year, and a stolen number can quietly generate bogus claims for months before anyone notices.

What to do if you get one of these calls

Don’t engage, and don’t confirm anything — not even to say “yes, that’s me.” Hang up the phone or delete the text. If you’re genuinely unsure whether a card or letter is real, call Medicare yourself at the number you already trust: 1-800-MEDICARE (1-800-633-4227). Look it up on your own card or on Medicare.gov; never call back a number a stranger gave you.

Then do two things. Check your Medicare Summary Notices and any Explanation of Benefits statements for services or charges you don’t recognize — that’s how medical identity theft usually surfaces. And report the attempt, which helps investigators and protects the next person. You can report suspected fraud to 1-800-MEDICARE, file a complaint at ReportFraud.ftc.gov, and — if you think your information was actually used — start a recovery plan at IdentityTheft.gov.

Because the 2026 breach put Medicare numbers and Social Security details into criminal hands, it’s also a sensible moment to tighten up the rest of your defenses. Our step-by-step guide to freezing your credit walks through how to block new accounts from being opened in your name, and if the caller’s script sounds familiar it’s probably in our roundup of the most common Medicare scams for 2026.

What to remember

New Medicare cards in 2026 are real, but the way you receive one is not up for negotiation: it comes by mail, it’s free, and nobody legitimate calls or texts you first to “verify” it. Treat any unsolicited request for your Medicare number, Social Security number, or a payment as a scam, and hang up. When in doubt, ignore the caller entirely and reach Medicare yourself at 1-800-633-4227 — the quiet, boring channel is the safe one.