Identity Thieves Don't Want Your Password Anymore — They Want Your Medicare Number

Last updated: 2026-07-14

Here's a question almost nobody asks: what happens if someone steals your medical identity instead of your bank password?

Most security advice for seniors circles the same handful of targets — your bank account, your credit card, your email password. Lock those down, the thinking goes, and you're safe. But that advice is protecting the wrong thing. There's a piece of your identity that's harder to monitor, harder to freeze, and in many cases harder to even find out has been stolen: your Medicare number.

This isn't a smaller risk dressed up to sound scary. It's a real gap, and it exists because the tools built to protect you — credit freezes, fraud alerts, bank monitoring — were never designed with medical identity in mind.

Why Your Medicare Number Is Worth More Than Your Credit Card

If a thief steals your credit card number, the damage has a ceiling. You report it, the bank cancels the card, you get a new one in the mail, and in most cases you're not on the hook for a dime. It's a well-worn process. Everyone involved — you, the bank, the merchant — knows the playbook.

Medical identity theft doesn't work that way.

When someone uses your Medicare number, they're not buying a television. They're billing your coverage for equipment you never received, appointments you never had, or prescriptions you never filled. That fraud doesn't show up on a credit card statement — it shows up buried inside a government benefits system that most people never read closely, if they read it at all. It can take months, sometimes years, before anyone notices, and by then the fraudulent claims are tangled up with your real medical history in a way that's genuinely difficult to untangle.

That's precisely why your Medicare number holds more value to a criminal than your card number. A stolen credit card gets canceled the day you notice. A misused Medicare number can generate fraudulent claims quietly, for a long time, before anyone catches it.

Here's a fact worth sitting with: for decades, your Medicare card displayed your full Social Security number printed right on the front. It wasn't until 2018 that the Centers for Medicare & Medicaid Services began replacing those numbers with randomly generated Medicare Beneficiary Identifiers specifically because the old system was such an easy target. That change tells you something important — the government itself recognized this was a real design flaw, not a theoretical one.

The Blind Spot: You Can Freeze a Credit File. You Can't "Freeze" Medicare.

If you've done any homework on protecting your identity, you've probably heard of a credit freeze. Contact the three credit bureaus, lock your file, and no one can open new credit in your name without your say-so. It's free, it's effective, and it's become common advice.

Now ask yourself: what's the equivalent for Medicare?

There isn't one. There's no button you can press that locks your Medicare number the way a credit freeze locks your credit file. The system simply wasn't built with that kind of consumer control in mind. Your main line of defense is closer to an honor system — you're expected to read your quarterly Medicare Summary Notice, compare it against the care you actually remember receiving, and flag anything that looks unfamiliar.

That's a reasonable ask in theory. In practice, most people skim that notice, if they open it at all. It's dense, it's mailed on its own schedule, and nothing about its design makes an unfamiliar charge jump off the page. Fraud can sit there for months, technically visible, practically invisible.

This is the real blind spot: the danger isn't that you're careless. It's that the tool you'd need to catch this kind of theft quickly simply doesn't exist in the form you'd expect.

How the Scam Actually Works

The methods criminals use to get a Medicare number are almost disappointingly low-tech, which is part of why they still work.

A caller claims to represent Medicare and says your card is being "reissued" — they just need to confirm your number first. A booth at a health fair offers a free genetic screening or a "diabetic testing kit," and all they need is your Medicare information to process it. A supposed durable medical equipment company calls offering a free back brace or knee brace, no doctor visit required, just your Medicare number to bill it.

Real Medicare never calls you asking you to confirm your number, and legitimate medical equipment always requires a doctor's order. But these offers are built to sound like a benefit you're entitled to, not a request that should raise suspicion. The obvious question is "how do I spot a scam call?" The better question is "why does anyone need my Medicare number over the phone at all?" The honest answer is: almost never.

There's also a quieter version of this scam that doesn't involve a phone call at all. Health fairs, "free" wellness screenings at a community center, or a friendly flyer at the pharmacy asking you to "verify your benefits" for a giveaway — these settings feel safe precisely because they don't feel like a scam. Nobody's pressuring you, nobody's on the phone sounding urgent. That's what makes them effective. Ask the same question here too: not "does this feel like pressure," but "does this person actually need my Medicare number to do what they're offering." A blood pressure check doesn't need it. A free giveaway doesn't need it. If the number is required before anything else happens, that's the signal, not the friendliness of the person asking.

Some versions of this fraud don't even need you to hand over your number at all — they buy it. Medical information changes hands on data broker lists the same way your address and phone number do, often bundled from old paperwork, hacked provider systems, or previous fraud schemes. That means you can do everything right in the moment — refuse every call, ignore every booth — and still end up exposed because your number was already sitting in a dataset that had nothing to do with you personally. This is precisely why a defense built only around "don't fall for the call" is incomplete. You need a way to catch what happens after your number has already leaked, not just a way to avoid handing it over in the first place.

What This Actually Costs You — Beyond the Money

With a stolen credit card, the damage is financial and it ends. With a stolen Medicare number, the damage can follow you into the exam room.

Here's what almost never gets mentioned when people talk about medical identity theft: the fraudulent claims don't just cost money — they get written into your permanent medical record. If someone uses your Medicare number to bill for a procedure you never had, that procedure now shows up in your history. If they use it to obtain medication, that prescription can appear in your record too. Untangling a false claim from a benefits system is one problem. Untangling it from the medical chart your own doctor relies on is another, and a much harder one.

Picture a straightforward version of this: you switch doctors, or end up in an emergency room, and the new physician pulls your history. Mixed into your real records is a surgery you never had, or a medication you've never taken. Nobody flagged it as fraud at the time — it just looks like part of your history. Your new doctor has no way to know it's not real unless you catch it and say so. That's the quiet cost of this particular scam: it doesn't just take your money, it can quietly corrupt the one record that's supposed to keep you safe in a medical emergency.

The obvious frame is "identity theft costs money." The overlooked frame is "identity theft can rewrite your medical file, and no one will proofread it for you." That reframing changes what "protecting yourself" actually needs to mean here — it's not just about your wallet, it's about the accuracy of the record a doctor might be reading while making a fast decision about your care.

Building a Real Defense

Since there's no freeze button, protection here looks different — closer to routine and layered monitoring than a single fix.

Guard the physical number. Keep your Medicare card in a safe place rather than your everyday wallet, and only hand over the number to a provider you contacted, never one who contacted you first.

Read the Summary Notice on purpose. Set a recurring reminder — quarterly is enough — to actually sit down with your Medicare Summary Notice and check every listed service against what you remember. If something doesn't match, call Medicare directly using the number on their official mailings, not a number provided by whoever contacted you.

Add identity monitoring that covers more than your credit file. Traditional credit monitoring won't catch medical identity fraud, because it isn't a credit event. A broader identity monitoring service that watches for your personal information circulating in places it shouldn't — including alerts tied to how your identity is being used beyond just credit — closes part of that gap. Aura is one option built around this kind of layered monitoring, watching for your information across a wider range of exposure points than a credit bureau alone tracks, and flagging activity early enough that you can act on it instead of finding out months later.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

Think about what sits behind the number. Your Medicare number is tied to the same Social Security number your entire financial identity runs through. It's worth asking whether every part of your savings should depend on that single digital thread. It's one reason some retirees choose to hold a portion of their savings in a form that isn't tied to an online account or a nine-digit number at all — a physical asset like gold, held through a retirement account. Augusta Precious Metals walks through how a Gold IRA works for people exploring that kind of diversification. It won't stop medical identity theft, but it does mean your entire financial picture isn't resting on the same identity that a thief is trying to steal.

What To Do This Month

You don't need to overhaul everything at once. Start here:

Find your Medicare card and move it out of your everyday wallet.
Pull your last Medicare Summary Notice and actually read it line by line.
Set a recurring reminder to repeat that check every three months.
Look into an identity monitoring service that tracks more than just your credit file.
If you regularly use a patient portal from home Wi-Fi, add a VPN to that habit.

None of these steps require becoming a different kind of person, or distrusting people you love. They just require pointing your attention at the target that's actually valuable — not the one everyone assumes.

Don't miss the next scam alert. Join our free newsletter and get plain-English warnings about new scams, straight to your inbox — before they reach your phone. Subscribe here.