Medicare Phishing Scams

Medicare phishing scams: what members need to know

Medicare phishing scams are designed to pressure you into sharing personal or financial information by pretending to come from a trusted government service.
Scammers often contact people by text message or email, claiming there is an issue with their Medicare account. These messages are designed to look legitimate and create urgency, encouraging you to act before you have time to question whether they’re genuine.
Common claims used in these scams include:
  • You have an unclaimed Medicare payment or rebate
  • Your Medicare services have been frozen, stopped or suspended
  • Your Medicare account needs to be updated
  • Your Medicare card has expired
  • Your Medicare insurance details are missing or incomplete
The message will usually ask you to click a link, copy and paste a web address into your browser, or scan a QR code to “fix” the issue. These links can take you to fake websites designed to steal your information.
Once scammers have your personal details, they may attempt identity theft, access your bank accounts, or use the information to commit further fraud.

Warning signs to watch for

Be cautious if you receive unsolicited messages about Medicare, particularly if they include links or demand immediate action. Scam messages often rely on fear or urgency to prompt a response.
Red flags include:
  • Requests to click links in text messages or emails
  • Instructions to scan QR codes or copy a URL to log in
  • Requests for payment details, credit card information, or fees
  • Messages that threaten service cancellation if you don’t respond
  It’s important to know that legitimate Medicare communications don’t operate this way. For example, if your Medicare card is nearing expiry, a replacement card is usually issued automatically and sent out weeks in advance — no action is required from you.

What to do if you receive a suspicious message

If you think a message claiming to be from Medicare might be a scam:
  • Don’t click links, scan QR codes, or reply to the message
  • Don’t provide personal or financial information
  • Delete the message once you’ve reported it
If you’ve already clicked a link or shared information, act quickly. Contact your bank or financial institution straight away so they can help protect your accounts.
Even if you haven’t lost money, reporting suspected scams can help protect others and reduce the impact of these attacks across the community.