Florida resident Keith Jones says his Affordable Care Act insurance plan changed several times this year without his permission. Now the 52-year-old is battling his own health problems and is facing large bills for insurance premiums that he says he shouldn't have to pay.
The third time, he sought help from an insurance agent, who called Jones at the federal health.gov call center to sort things out. During that conversation, “someone literally opened a new policy without my consent,” Jones said.
Despite the new rules that have come into force will come into effect mid-2024 aimed at preventing such unauthorized ACA changes are still happening, says Florida agent Jason Fine, who is trying to help Jones and dozens of other clients unravel such changes.
The Government Accountability Office, an independent government watchdog, published on December 3 a sharply critical, albeit preliminary, report stating that years of similar GAO warnings to federal officials have not produced the results needed to better protect against ACA enrollment fraud. Alarms were raised during the Obama and Biden administrations, as well as the first Trump administration.
Was more than 275,000 complaints The agency, which also administers Obamacare coverage, reported unauthorized ACA enrollment and plan switches to the Centers for Medicare and Medicaid Services in 2024.
“The absolute bottom line is that nothing has changed from a risk perspective,” Seto J. Bagdoian, co-author of the GAO report, told KFF Health News. Bagdoyan is the director of audit services for the agency's Forensic Sciences and Investigations Service.
The report reached Congress continues to be involved on whether to expand the more generous tax subsidies that have given consumers additional help paying Obamacare premiums in recent years. Some critics of the ACA have said subsidies encourage registration fraud.
Citing concerns about fraud, GOP legislators included in their One Big Beautiful Bill measures that would make it more difficult to enroll in ACA plans in future years, such as requiring additional compliance check. But legislators did not accept legislation introduced by Democrats impose criminal penalties on brokers who knowingly provide false ACA registration information.
“None of the Republicans who took political advantage of this report co-sponsored this legislation or proposed any similar measures,” Sen. Ron Wyden (D-Ore.) said in a statement to KFF Health News. Wyden is one of the authors of the law.
The GAO investigation, in which investigators tried to apply for registration using false information, was requested more than a year ago by Republicans on three House committees: Energy and Commerce, the Judiciary and Ways and Means.
Lawmakers asked for findings that could be made public now, although the final report and any recommendations it contains won't be completed until the spring or summer of 2026. Hearing Worth Considering The results were released by members of the House of Representatives on December 10.
The report notes that federal officials estimate that $124 billion in ACA tax subsidies have been disbursed in 2024 for nearly 20 million ACA students.
He highlighted some stunning results. For example, in 2023, it was discovered that one Social Security number was used for 125 policies.
However, the number of policies flagged as potentially compromised by fraudulent sales agents was much lower than estimates by some of the program's biggest critics. In 2024, GAO identified about 160,000 cases, or 1.5% of ACA filings. Some conservative analysts have estimated that the number of unauthorized enrollments that year was in the millions, a finding that has drawn opposition from groups representing insurers, brokersAnd hospitals.
The GAO report does not quantify the extent of fraud, Bagdoian said: “The focus is on indicators of potential fraud.”
CMS's anti-fraud efforts are failing
By October 2024, following consumer complaints, CMS the activities of about 850 insurance brokers were suspended on questions about whether they were involved in unauthorized registration. All were ultimately reinstated, CMS told GAO in May. Also last October, GAO filed its first four false claims seeking coverage for the final months of the year.
A few months earlier, in July 2024, CMS began requiring three-way calls with consumers, the marketplace and their agents for certain types of changes, such as plan changes. Unauthorized plan switching results in fraudulent agents receiving sales commissions and can also lead to problems for consumers such as losing access to their doctors or faced with tax bills if they were incorrectly enrolled in subsidies, like This was reported by KFF Health News. in 2024.
However, GAO reported that many agents told them there were many loopholes in the rules, such as the federal marketplace taking only “limited steps to verify a consumer's identity in a three-way call,” such as asking only for publicly available information such as name and date of birth.
Additionally, new ACA applicants were exempt from the three-way call rule, which leaves open the possibility for agents to claim they are a new consumer when they are not.
“The three-way call is what CMS is pushing,” Bagdoyan said. “It's better than nothing, but as we note in the report, an unscrupulous broker could easily circumvent this problem by starting the process from scratch. Or they could impersonate someone else.”
Fine, the Florida agent, said he alone has filed dozens of complaints with federal and state officials, often showing that clients' records were accessed or changed by multiple agents, sometimes on the same day, even after CMS's plan switch rules took effect.
In one such fraud complaint, Fine listed three marketplace applications tied to one client's name in which other agents altered his coverage and included false income information. The client does not remember speaking with any of these agents, Fine wrote.
A marketplace representative who helped Fine restore coverage for that client told Fine that he often hears agents pretending to be consumers, and sometimes even imitating the voice of someone of the opposite sex.
Fraudulent agents can spoof it because the questions marketplace representatives ask to verify identity “are taken from the app: the person's name, date of birth and address,” Fine said. “It's an ID. It's a joke.”
Asked about the effectiveness of the three-way calling rule and about reports of impersonation, CMS spokeswoman Catherine Howden said in a statement that “eradicating waste, fraud and abuse is one of Dr. Oz's top priorities,” referring to CMS Administrator Mehmet Oz. The agency “takes allegations of fraudulent or abusive behavior seriously and acts quickly when such behavior is identified or reported,” she added.
Ronnell Nolan, president and CEO of the insurance brokerage lobbying group Health Agents for America, said: “Three-way calls are a failure. They need to be abandoned.”
Instead, she has long called for two-factor authentication, similar to systems used in banking and other industries, to ensure that the person making the change is in fact the policyholder or its agent.
This did not happen in the federal market, where problems with unauthorized switching are concentrated.
IN 20 states plus the District of Columbiawho operate their own ACA marketplaces, such problems are not common. States say that's because they require more types of authentication and also typically use their own websites for registration.
Bagdoian said the GAO report does not address what states could do differently.
“It was beyond our capabilities,” he said.
Devilish details
The 26-page document outlines a GAO investigation in which investigators submitted 20 false claims, some through insurance brokers, covering the years 2024 and 2025. Most of them were approved, even with fake documents.
One application attempt was rejected by investigators when the broker stopped responding (the brokers did not know they were part of the investigation), and another was rejected by the federal marketplace after five months of review when required documents were not submitted. But 18 plans remain in place, with subsidies being sent to insurers to cover fake people, Bagdoyan said.
The investigation also included analyzing enrollment data from 2023 and 2024 to look for things like multiple uses of the same Social Security numbers, numbers for deceased people, and instances where three or more agents submitted enrollment activities for the same person and start date, potentially indicating fraud.
Similar investigations using fictitious registrations were conducted by GAO as part of previously classified work. it started in 2014at the start of the ACA.
The new report says that while CMS conducted a fraud risk assessment in 2018, it has not updated its assessment since then, even though ACA enrollment has grown significantly.
“We have documented evidence that whatever they did, obviously it didn't work,” Bagdoyan said, “because we're running into the same problems we had 12 years ago with identity verification.”
