You open your mailbox and there’s an envelope stamped with the Department of Health and Human Services seal. Inside, a letter says an audit turned up “improper payments” on your account. Fix your banking information within a few days, it warns, or Social Security will start clawing back your benefits.
A few weeks later, your phone rings. The caller ID says Medicare. This time the voice is friendly: you’re owed a refund because of the new, lower prescription drug cap, and all they need is your bank routing number to send it over.
Both of these are real scripts scammers are running on seniors right now, and both borrow credibility from genuine 2026 rule changes. The letter and the call sound plausible because there really was a Part D cap change this year, and Social Security really does send overpayment notices. Here’s how to tell the fake from the real one.
Table of contents
The fake “clawback” letter
This one usually arrives by mail, though copies show up by email and text too, carrying SSA, Medicare or Department of Health and Human Services logos to look official. Some versions cite actual sections of the Social Security Act to sound like they came from a lawyer’s desk instead of a scam operation. The letter claims a recent audit turned up “improper payments” on your account and gives you a short window, often just a few days, to verify your banking details or the government will begin clawing back money directly from your benefits.
The letter is built to look like paperwork you’d expect from a federal audit, right down to a case number or reference code and a return address that looks close enough to a real agency to pass a quick glance. What it asks you to do is different from anything a real overpayment notice asks for: hand over your bank account number, sometimes through a QR code or a link, before anyone has actually reviewed your case or given you a chance to respond.
The Medicare “refund” call
This version flips the emotion from fear to reward. Medicare Part D, the piece of Medicare that covers prescription drugs, now caps what beneficiaries pay out of pocket at $2,100 a year, up slightly from $2,000 the year before and down from no cap at all before 2025. Scammers call, sometimes spoofing the real Medicare number on your caller ID, and say you overpaid under the old rules and are owed a refund, or that you need to call in and “activate” the new cap yourself. Either script ends the same way: they ask for your bank routing and account number so they can supposedly deposit your money.
There is no refund check tied to the cap and no activation step to take. The $2,100 limit applies automatically once you hit it at the pharmacy counter, and after that your covered prescriptions cost you nothing for the rest of the year, without a phone call, a form, or your bank information involved.
Why these scams work so well
A scam built from nothing is usually easy to spot, but one stitched onto a real policy change is a different problem. The $2,100 Part D cap and Social Security’s overpayment process are both real, and scammers borrow the real dollar figures, real agency logos and sometimes real statute numbers to get past your skepticism before you notice what’s actually being asked of you: your bank account and routing numbers.
Fear and reward work as a matched pair here. The clawback letter threatens to take money away from someone who may be living on a fixed income and can’t absorb the loss. The Part D call promises to hand money over instead. Either version puts you on a clock, whether it’s a deadline printed in the letter or a caller who won’t get off the phone, and being on a clock is exactly when people skip the step of calling the agency directly to check.
The signs that give a scam away
Real Social Security and Medicare business does not move at the speed of a phone call. If you actually owe money or are due a refund, Social Security sends that information as a mailed notice explaining the amount and the reason, and it will wait at least 30 days after mailing that notice before it starts collecting anything, giving you time to request a waiver or file an appeal. Nobody calls you first and asks for your bank account number to fix it the same day.
A few other tells hold up no matter how the contact arrives. Social Security will never tell you your number has been suspended, because Social Security numbers cannot be suspended. Neither agency demands gift cards, wire transfers or cryptocurrency, and neither asks for your bank information over the phone or by email to release money it already owes you. There is no Medicare “refund department” that processes drug cap payments by phone, since the cap applies automatically with no signup required.
What to do if one of these reaches you
Don’t engage with the letter or the call on its own terms. Set the letter aside instead of scanning a QR code or calling the number printed on it, and hang up on the call instead of answering its questions, even to argue.
Then check for yourself, using a number or account you already trust rather than anything the message gave you. Log into your own Social Security or Medicare online account to see whether an overpayment or refund actually shows up on record. If you’d rather talk to a person, call Social Security or 1-800-MEDICARE using the number on your card or a past statement, never a number the letter or the caller gave you. If nothing shows up in your account and no one at the agency has a record of contacting you, you have your answer, and you can stop worrying about the letter or the call entirely.
If you’re helping a parent or an older relative through this, the same rule applies to you. Sit with them while they make the callback, and let them dial it themselves if they’re able. Scammers count on isolation as much as urgency, so a second set of eyes on the letter or the call often ends it before any money moves.
Report it instead of just deleting it
Social Security remains the government agency scammers impersonate most often, and government impersonation complaints reached more than 330,000 in 2025, a 25 percent jump from the year before. Total fraud losses reported by adults 60 and older reached $2.4 billion in 2024, up from about $600 million in 2020.
Reporting a scam attempt does not undo a loss, but it helps investigators trace and shut down the operations running these scripts. File a report with the Federal Trade Commission, and separately report the Social Security impersonation to the agency’s inspector general. If the contact involved Medicare specifically, the federally funded Senior Medicare Patrol can also walk you through it by phone, state by state, at no cost. None of these reports take more than a few minutes, and none of them will ask for your bank account number.
