Florida resident Keith Jones says his Affordable Care Act insurance plan was changed multiple times this year without his permission. Now the 52-year-old is struggling with his health problems while facing large premium bills he says he shouldn’t owe.
The third time, he sought help from an insurance agent, who got Jones on the phone with the federal healthcare.gov call center to sort things out. During that call, “literally, there was someone opening a new policy without my consent,” Jones said.
Despite new rules that went into effect in mid-2024 aimed at thwarting such unauthorized ACA changes, it’s still happening, said Florida-based agent Jason Fine, who is trying to help Jones and dozens of other clients unravel such switches.
The Government Accountability Office, an independent government watchdog, on Dec. 3 issued a sharply critical, though preliminary, report saying that years of similar GAO warnings to federal officials have not produced results needed to better protect against ACA enrollment fraud. Alarms were raised during the Obama and Biden administrations, as well as the first Trump administration.
There were more than 275,000 complaints to the Centers for Medicare & Medicaid Services about unauthorized ACA enrollments and plan-switching in 2024, according to the agency, which also administers Obamacare coverage.
“The absolute bottom line is nothing has changed in terms of risk,” Seto J. Bagdoyan, a co-author of the GAO report, said in an interview with KFF Health News. Bagdoyan is the director of audit services for the agency’s Forensic Audits and Investigative Service team.
The report landed as Congress continues to be embroiled in the issue of whether to extend the more generous tax subsidies that have given consumers extra help paying their Obamacare premiums in recent years. Some ACA critics have said the subsidies fuel enrollment fraud.
Citing fraud concerns, GOP lawmakers included measures in their One Big Beautiful Bill Act that will make it harder to enroll in ACA plans in future years, such as requiring additional eligibility verification. But lawmakers have not adopted legislation introduced by Democrats to impose criminal penalties on brokers who knowingly submit false information on ACA enrollments.
“None of the Republicans making political hay out of this report have co-sponsored that legislation or offered any similar measures,” Sen. Ron Wyden (D-Ore.) said in a statement to KFF Health News. Wyden is one of the sponsors of the legislation.
The GAO inquiry, during which investigators attempted to submit enrollments using false information, was requested more than a year ago by Republicans from three House committees: Energy and Commerce, Judiciary, and Ways and Means.
The lawmakers asked for findings that could be made public now, even though the final report and any recommendations it will contain won’t be completed until the spring or summer of 2026. A hearing to consider the findings was set by House members for Dec. 10.
The report notes that federal officials estimate that $124 billion in tax subsidies were paid in 2024 for nearly 20 million ACA enrollments.
It highlighted some stunning findings. One Social Security number, for instance, was found to have been used for 125 policies in 2023.
However, the number of policies flagged as potentially compromised by rogue sales agents was far smaller than the estimates of some of the program’s biggest critics. The GAO identified about 160,000 cases in 2024, or 1.5% of the ACA applications. Some conservative analysts have broadly estimated that unauthorized enrollments that year numbered in the millions, a finding that has drawn pushback from groups representing insurers, brokers, and hospitals.
The GAO report does not quantify how much fraud there is, Bagdoyan said: “What it’s focusing on are indicators of potential fraud.”
CMS Anti-Fraud Efforts Fall Short
By October 2024, following consumer complaints, CMS suspended about 850 insurance brokers over questions about whether they had been involved with unauthorized enrollment. All were eventually reinstated, CMS told the GAO in May. Also last October, the GAO submitted the first four of its fake applications, seeking coverage for the final months of the year.
A few months earlier, in July 2024, CMS began requiring three-way calls with consumers, the marketplace, and their agents for certain types of changes, such as plan switches. Unauthorized plan-switching nets rogue agents a sales commission, and it can also lead to problems for consumers, such as losing access to their doctors or facing tax bills if they were improperly enrolled with subsidies, as KFF Health News reported in 2024.
However, the GAO reported that many agents told them those rules had a lot of loopholes, such as the federal marketplace taking only “limited steps to verify the identity of the consumer on the three-way call,” for instance asking only for publicly available information such as a name and date of birth.
Also, new ACA applicants were exempt from the three-way call rule, which leaves open the possibility of agents saying it’s a new consumer when it isn’t.
“The three-way call is something CMS has promoted,” Bagdoyan said. “It’s better than nothing, but as we point out in the report, it could be easy to overcome by an unscrupulous broker who starts the process from scratch. Or they could impersonate.”
Fine, the agent in Florida, said he alone has filed dozens of complaints with federal and state officials, often showing clients’ records being accessed or changed by multiple agents, sometimes on the same day, even after the CMS rules on plan-switching went into effect.
In one such fraud complaint, Fine listed three marketplace applications tied to one client’s name in which other agents had changed his coverage and included false income information. The client didn’t recall talking with any of those other agents, Fine wrote.
A marketplace representative who was helping Fine restore that client’s coverage told Fine that he often hears agents pretending to be the consumer, sometimes even faking the voice of an opposite-sex person.
Rogue agents can fake it because questions asked by marketplace representatives to verify identity “are from the application: the person’s name, date of birth, and address,” Fine said. “That’s the ID proofing. It’s a joke.”
Asked about the effectiveness of the three-way call rule and about reports of impersonations, CMS spokesperson Catherine Howden said in a statement that “rooting out waste, fraud, and abuse is one of Dr. Oz’s top priorities,” referring to CMS Administrator Mehmet Oz. The agency “takes allegations of fraudulent or abusive conduct seriously and acts swiftly when concerning behaviors are identified or reported,” she added.
Ronnell Nolan, the president and CEO of the insurance broker lobbying group Health Agents for America, said: “Three-way calling is a bust. It needs to go away.”
Instead, she has long called for two-factor authentication, similar to systems used in banking and other industries, to ensure the person making the change is actually the policyholder or their agent.
That hasn’t happened on the federal marketplace, where the problems with unauthorized switching are concentrated.
In the 20 states, along with the District of Columbia, that run their own ACA marketplaces, such issues are not common. States say that’s because they require more types of authentication — and they also generally use their own websites for sign-ups.
Bagdoyan said the GAO report did not consider what the states might be doing differently.
“That was beyond our scope,” he said.
Devilish Details
The 26-page document outlines the GAO’s probe, in which investigators filed 20 fake enrollments, some through insurance brokers, spanning 2024 and 2025 coverage. Most were approved, even with counterfeit documents.
One attempted application was dropped by investigators when the broker stopped responding — the brokers did not know they were part of the investigation — and another was rejected by the federal marketplace after five months of coverage when required documents were not submitted. But 18 of the plans remain in place and subsidies are being sent to insurers to cover the fake people, according to Bagdoyan.
The investigation also included an analysis of enrollment data from 2023 and 2024 looking for things such as multiple uses of the same Social Security numbers, dead people’s numbers, and cases in which three or more agents submitted enrollment actions for the same person and start date, potentially indicating fraud.
Similar investigations using the filing of fictious enrollments were conducted by the GAO in earlier undercover work that began in 2014, at the start of the ACA.
The new report said that while CMS assessed fraud risks in 2018, it has not updated its assessment since then, even as enrollment in the ACA has grown significantly.
“We have documentary evidence that whatever it is they did, obviously it hasn’t worked,” Bagdoyan said, “because we encountered the same issues as 12 years ago, having to do with identity verification.”
Florida resident Keith Jones says his Affordable Care Act insurance plan was changed multiple times this year without his permission. Now the 52-year-old is struggling with his health problems while facing large premium bills he says he shouldn’t owe.
The third time, he sought help from an insurance agent, who got Jones on the phone with the federal healthcare.gov call center to sort things out. During that call, “literally, there was someone opening a new policy without my consent,” Jones said.
Despite new rules that went into effect in mid-2024 aimed at thwarting such unauthorized ACA changes, it’s still happening, said Florida-based agent Jason Fine, who is trying to help Jones and dozens of other clients unravel such switches.
The Government Accountability Office, an independent government watchdog, on Dec. 3 issued a sharply critical, though preliminary, report saying that years of similar GAO warnings to federal officials have not produced results needed to better protect against ACA enrollment fraud. Alarms were raised during the Obama and Biden administrations, as well as the first Trump administration.
There were more than 275,000 complaints to the Centers for Medicare & Medicaid Services about unauthorized ACA enrollments and plan-switching in 2024, according to the agency, which also administers Obamacare coverage.
“The absolute bottom line is nothing has changed in terms of risk,” Seto J. Bagdoyan, a co-author of the GAO report, said in an interview with KFF Health News. Bagdoyan is the director of audit services for the agency’s Forensic Audits and Investigative Service team.
The report landed as Congress continues to be embroiled in the issue of whether to extend the more generous tax subsidies that have given consumers extra help paying their Obamacare premiums in recent years. Some ACA critics have said the subsidies fuel enrollment fraud.
Citing fraud concerns, GOP lawmakers included measures in their One Big Beautiful Bill Act that will make it harder to enroll in ACA plans in future years, such as requiring additional eligibility verification. But lawmakers have not adopted legislation introduced by Democrats to impose criminal penalties on brokers who knowingly submit false information on ACA enrollments.
“None of the Republicans making political hay out of this report have co-sponsored that legislation or offered any similar measures,” Sen. Ron Wyden (D-Ore.) said in a statement to KFF Health News. Wyden is one of the sponsors of the legislation.
The GAO inquiry, during which investigators attempted to submit enrollments using false information, was requested more than a year ago by Republicans from three House committees: Energy and Commerce, Judiciary, and Ways and Means.
The lawmakers asked for findings that could be made public now, even though the final report and any recommendations it will contain won’t be completed until the spring or summer of 2026. A hearing to consider the findings was set by House members for Dec. 10.
The report notes that federal officials estimate that $124 billion in tax subsidies were paid in 2024 for nearly 20 million ACA enrollments.
It highlighted some stunning findings. One Social Security number, for instance, was found to have been used for 125 policies in 2023.
However, the number of policies flagged as potentially compromised by rogue sales agents was far smaller than the estimates of some of the program’s biggest critics. The GAO identified about 160,000 cases in 2024, or 1.5% of the ACA applications. Some conservative analysts have broadly estimated that unauthorized enrollments that year numbered in the millions, a finding that has drawn pushback from groups representing insurers, brokers, and hospitals.
The GAO report does not quantify how much fraud there is, Bagdoyan said: “What it’s focusing on are indicators of potential fraud.”
CMS Anti-Fraud Efforts Fall Short
By October 2024, following consumer complaints, CMS suspended about 850 insurance brokers over questions about whether they had been involved with unauthorized enrollment. All were eventually reinstated, CMS told the GAO in May. Also last October, the GAO submitted the first four of its fake applications, seeking coverage for the final months of the year.
A few months earlier, in July 2024, CMS began requiring three-way calls with consumers, the marketplace, and their agents for certain types of changes, such as plan switches. Unauthorized plan-switching nets rogue agents a sales commission, and it can also lead to problems for consumers, such as losing access to their doctors or facing tax bills if they were improperly enrolled with subsidies, as KFF Health News reported in 2024.
However, the GAO reported that many agents told them those rules had a lot of loopholes, such as the federal marketplace taking only “limited steps to verify the identity of the consumer on the three-way call,” for instance asking only for publicly available information such as a name and date of birth.
Also, new ACA applicants were exempt from the three-way call rule, which leaves open the possibility of agents saying it’s a new consumer when it isn’t.
“The three-way call is something CMS has promoted,” Bagdoyan said. “It’s better than nothing, but as we point out in the report, it could be easy to overcome by an unscrupulous broker who starts the process from scratch. Or they could impersonate.”
Fine, the agent in Florida, said he alone has filed dozens of complaints with federal and state officials, often showing clients’ records being accessed or changed by multiple agents, sometimes on the same day, even after the CMS rules on plan-switching went into effect.
In one such fraud complaint, Fine listed three marketplace applications tied to one client’s name in which other agents had changed his coverage and included false income information. The client didn’t recall talking with any of those other agents, Fine wrote.
A marketplace representative who was helping Fine restore that client’s coverage told Fine that he often hears agents pretending to be the consumer, sometimes even faking the voice of an opposite-sex person.
Rogue agents can fake it because questions asked by marketplace representatives to verify identity “are from the application: the person’s name, date of birth, and address,” Fine said. “That’s the ID proofing. It’s a joke.”
Asked about the effectiveness of the three-way call rule and about reports of impersonations, CMS spokesperson Catherine Howden said in a statement that “rooting out waste, fraud, and abuse is one of Dr. Oz’s top priorities,” referring to CMS Administrator Mehmet Oz. The agency “takes allegations of fraudulent or abusive conduct seriously and acts swiftly when concerning behaviors are identified or reported,” she added.
Ronnell Nolan, the president and CEO of the insurance broker lobbying group Health Agents for America, said: “Three-way calling is a bust. It needs to go away.”
Instead, she has long called for two-factor authentication, similar to systems used in banking and other industries, to ensure the person making the change is actually the policyholder or their agent.
That hasn’t happened on the federal marketplace, where the problems with unauthorized switching are concentrated.
In the 20 states, along with the District of Columbia, that run their own ACA marketplaces, such issues are not common. States say that’s because they require more types of authentication — and they also generally use their own websites for sign-ups.
Bagdoyan said the GAO report did not consider what the states might be doing differently.
“That was beyond our scope,” he said.
Devilish Details
The 26-page document outlines the GAO’s probe, in which investigators filed 20 fake enrollments, some through insurance brokers, spanning 2024 and 2025 coverage. Most were approved, even with counterfeit documents.
One attempted application was dropped by investigators when the broker stopped responding — the brokers did not know they were part of the investigation — and another was rejected by the federal marketplace after five months of coverage when required documents were not submitted. But 18 of the plans remain in place and subsidies are being sent to insurers to cover the fake people, according to Bagdoyan.
The investigation also included an analysis of enrollment data from 2023 and 2024 looking for things such as multiple uses of the same Social Security numbers, dead people’s numbers, and cases in which three or more agents submitted enrollment actions for the same person and start date, potentially indicating fraud.
Similar investigations using the filing of fictious enrollments were conducted by the GAO in earlier undercover work that began in 2014, at the start of the ACA.
The new report said that while CMS assessed fraud risks in 2018, it has not updated its assessment since then, even as enrollment in the ACA has grown significantly.
“We have documentary evidence that whatever it is they did, obviously it hasn’t worked,” Bagdoyan said, “because we encountered the same issues as 12 years ago, having to do with identity verification.”
