Millions of Medicare beneficiaries have spent years being warned about fake Medicare card scams.Now some, myself included, are receiving what appear to be legitimate replacement Medicare cards in the mail. Given the long history of Medicare-related scams, many recipients are understandably wondering whether the mailing is genuine.The answer appears to be yes.Approximately 1.3 million Medicare beneficiaries are being issued new Medicare cards with new Medicare Beneficiary Identifiers, or MBIs, following a data security incident and fraud concerns, according to Medicare advocacy organizations, state aging agencies and industry groups tracking the reissuance effort.The new Medicare numbers became effective April 14, 2026, and replacement cards have been arriving in mailboxes nationwide.”I am not aware of any current mass mailing of this nature, but this is consistent with the letter and instructions that were sent in April to people whose Medicare numbers were compromised during a CMS hack,” said Casey Schwarz, counsel for education and federal policy at the Medicare Rights Center.
Why Medicare is replacing the cardsThe reissuance effort follows a Medicare.gov security incident disclosed by the Centers for Medicare & Medicaid Services.According to CMS, unauthorized individuals used legitimate beneficiary information between 2023 and 2025 to create Medicare.gov accounts. The information included MBIs, dates of birth, ZIP codes, last names and Medicare coverage start dates.Once those accounts were created, attackers may have been able to access additional information, including mailing addresses, provider information, dates of service, diagnosis codes, services received and Medicare plan premium details.CMS said it responded by deactivating fraudulently created accounts, blocking the creation of new Medicare.gov accounts from foreign IP addresses, monitoring claims activity for suspicious activity and replacing Medicare Beneficiary Identifiers for affected beneficiaries.The agency said it is not aware of any reports of identity theft or fraud resulting directly from the incident.CMS did not respond to requests for comment prior to publication.How to tell whether the mailing is legitimateThe arrival of replacement cards has created confusion because Medicare scams often involve claims that beneficiaries need a new card or Medicare number.Diane Omdahl, president and founder of 65 Incorporated, said recipients should remain cautious but look for key signs that distinguish a legitimate mailing from a scam.”People should always be skeptical of mailings that ask them to ‘confirm’ or ‘activate’ their new Medicare number. This mailing does not do that,” Omdahl said.Related: How does Medicare IRMAA work?She noted that CMS has issued replacement Medicare cards in the past when fraud concerns or security issues have been identified. Beneficiaries who question whether a mailing is legitimate can verify it by calling 1-800-MEDICARE or checking their Medicare.gov account.Omdahl also recommends monitoring Medicare claims activity for signs of unauthorized use.Marcia Mantell, founder of Mantell Retirement Consulting, said reports of beneficiaries receiving replacement Medicare cards have surfaced in multiple parts of the country.”It seems to be causing many folks a lot of confusion,” Mantell said.Mantell said beneficiaries receiving a legitimate replacement card will not be asked to activate it or take additional steps before using it. She also noted that the replacement card arrives as a paper card rather than a plastic one.Beneficiaries with concerns should contact Medicare directly, seek assistance from their local State Health Insurance Assistance Program, or review their MyMedicare account for any communications related to their situation.”The letter looks official and it did come in snail mail,” Mantell said. “It does seem legit.”What affected beneficiaries should doCMS recommends that beneficiaries:Review Medicare Summary Notices and Explanation of Benefits statements for unfamiliar services or charges.Report suspicious activity to 1-800-MEDICARE (1-800-633-4227).Check annual credit reports for signs of identity theft.Contact the Federal Trade Commission or local law enforcement if identity theft is suspected.CMS said Medicare coverage and benefits are not affected by the issuance of a new Medicare number. The agency’s primary goal is to protect beneficiary information and reduce the risk of future fraud involving compromised Medicare identifiers.Related: Fidelity sends strong message on major Medicare worry