CMS called its broker-fraud fixes a success. Complaints kept climbing
Summary
In October 2024, CMS said its Marketplace system changes were having "the desired effect" against unauthorized broker activity. Its own data shows confirmed unauthorized enrollments and plan switches reached 299,604 in 2025 — four and a half times the 2023 count — and all 850 brokers it had suspended on suspicion of fraud were reinstated.
The documents
This piece reads five primary documents against each other: the two July 2026 reports; 's December 2025 covert-testing report (GAO-26-108742⧉); 's own October 17, 2024 press release⧉ declaring its fixes effective; and 's June 2024 consent guidance⧉, which sets the rule the agency was measured against. The consent rule is not ambiguous: brokers must explain every application attestation to the consumer, document the consent, and keep that documentation for ten years. What found is that nobody checks — "does not verify that the agent or broker actually obtained consumer consent before agent and broker actions occur," and does not routinely review the documentation. In practice, four stakeholders told , consent is a checked box.
The money
The federal Marketplace paid nearly $124 billion in advance premium tax credits for about 19.5 million enrollees in plan year 2024⧉. Brokers are paid none of it directly — issuers pay their commissions — which is precisely the mechanism identifies: every enrollment or plan switch a broker files, authorized or not, can generate a commission. 's data analytics found at least 30,000 plan year 2023 applications and at least 160,000 plan year 2024 applications where three or more different brokers filed actions for the same coverage start date — its deliberately conservative marker for likely unauthorized churn. The December report also flags the money nobody has accounted for: over $21 billion in plan year 2023 APTC with no evidence of reconciliation as of April 2025, and over $94 million paid for households where an enrollee's Social Security number matched federal death records.
View data as table
| Plan year 2023 | 30,000 | 0.4% of relevant applications |
|---|---|---|
| Plan year 2024 | 160,000 | 1.5% of relevant applications |
also tested the front door. Its investigators created 20 fictitious identities — some with invalid, never-issued Social Security numbers, backed by counterfeit documents produced with publicly available tools — and the Marketplace initially approved 19 of them for plan year 2025 coverage⧉. As of September 2025, 18 were still covered, drawing over $10,000 a month in combined subsidies. In one case, the Marketplace notified a fictitious applicant that it had confirmed their income from documentation never submitted.
View data as table
| Fictitious identities created | 20 | |
|---|---|---|
| Initially approved for coverage | 19 | The 20th was dropped when the broker stopped responding |
| Still covered, September 2025 | 18 | Drawing over $10,000/month in combined APTC |
The people
Over 19 million consumers were enrolled through federal and state Marketplaces as of February 2026⧉. For the consumer, an unauthorized switch is invisible until it isn't: stakeholders told that people commonly discover it when the asks them to reconcile subsidies they never knowingly claimed, or at the pharmacy counter when the plan they thought they had is gone. sends no notice for a person search, a new enrollment, or a change of the broker on the account — and found plan year 2024 applications where the listed phone number or email belonged not to the consumer but to a broker, or to no one at all. The exposure is structural: any of the ~96,000 registered brokers can run a person search with a first name, last name, and date of birth and see the household's income information and partial SSNs. 's own monitoring caught brokers running 600 to 1,000 person searches in a single day.
View data as table
| 2023 | 66,548 | |
|---|---|---|
| 2024 | 258,424 | CMS's July and October 2024 fixes land mid-year |
| 2025 | 299,604 | First full year after the fixes: up 16% again |
The disagreement between documents
On October 17, 2024, reported "a dramatic and sustained drop across several key metrics" — casework on unauthorized plan changes down about 30 percent, broker-associated plan changes down nearly 70 percent, commission-record changes down nearly 90 percent — and concluded the July 2024 changes were "having the desired effect of successfully preventing consumers from being switched to different plans or enrolled in coverage without their informed consent."⧉ The ledger keeps tells a different story: complaints confirmed as unauthorized rose from 258,424 in calendar 2024 to 299,604 in calendar 2025 — a 16 percent increase in the first full year after the fixes. The same release promised suspension and termination of brokers "who have engaged in fraud or abusive conduct"; in May 2025, CMS told GAO it had reinstated all 850 brokers⧉ it had suspended by October 2024 on reasonable suspicion of exactly that conduct, citing its statutory and regulatory procedures.
View data as table
| Casework on unauthorized plan changes (drop) | 30% | "approximately 30%" |
|---|---|---|
| Plan changes tied to an agent or broker (drop) | 70% | "nearly 70%" |
| Changes to commission information (drop) | 90% | "nearly 90%" |
The second disagreement is between Baltimore and the states. examined three state-based Marketplaces — Covered California, Georgia Access, and BeWell New Mexico — and found all three require a one-time passcode from the consumer before a broker can act; California allows no person searches at all, and all three notify consumers when their enrollment or broker changes. Officials and stakeholders told unauthorized activity "is not a significant issue"⧉ in those states. , asked in March 2026, said it was "exploring options" for plan year 2027 — after having considered stronger controls for plan year 2026 and opting not to implement them.
What happens next
makes two recommendations: verify consent (a one-time passcode is the named example), restrict record access to the broker of record, notify consumers of broker actions — and then periodically test whether the controls work. concurred with both and says it is drafting requirements for enrollment platforms to demand a one-time confirmation from consumers and to restrict full-application access to the broker of record. No timeline is committed; the next open enrollment period, for plan year 2027, begins November 2026. 's covert work is explicitly ongoing — its fictitious enrollees were still drawing subsidies as of September 2025, and it is still reviewing roughly 32,000 enrollments dated after the enrollee's reported death.
- Complaints confirmed as unauthorized enrollments or plan switches hit 299,604 in 2025 — 4.5× the 2023 count and up 16% in the first full year after declared its fixes effective.
- All 850 brokers suspended by October 2024 on reasonable suspicion of fraud were reinstated by May 2025.
- enrolled 19 of 20 fictitious identities for 2025 coverage; 18 were still drawing over $10,000/month in subsidies as of September 2025.
- Three state-run Marketplaces already verify consumers with one-time passcodes (or, in California, a monitored call) and report no comparable problem; is "exploring options" for plan year 2027.
Method notes. The complaint counts are 's own, as analyzed by (fig. 2 of -26-108041); cautions that complaints received in a calendar year may correspond to a prior plan year and include only consumer-initiated complaints. The 30,000/160,000 likely-unauthorized application counts are floors: 's definition (3+ brokers filing for the same coverage start date) deliberately excludes two-broker switching. The $94 million death-data figure counts full-household APTC where at least one member matched death records under 's two focus scenarios, and death-file matches can include reporting errors. The covert-test results are illustrative and, per , not generalizable to the enrollee population. 's claimed declines (30/70/90 percent) are presented here as claims from its October 2024 release, shown as drop magnitudes in the chart.
Sources(5) ▾
- U.S. Government Accountability Office, Health Insurance Marketplaces: CMS Needs Stronger Controls to Prevent Unauthorized Actions by Agents and Brokers (GAO-26-108041) (2026-07-13) — The primary report, to the Chair of the Senate HELP Committee. Source of the three control weaknesses, the complaint counts (fig. 2), the 96,000 registered agents figure, the state-marketplace comparison table, 's March 2026 'exploring options' posture, and both recommendations with 's concurrence. gao.gov · original document
- U.S. Government Accountability Office, Health Insurance Marketplaces: CMS Needs Stronger Controls to Prevent Unauthorized Actions by Agents and Brokers (GAO-26-108297) (2026-07-13) — The companion release of the same report, addressed to congressional requesters. Corroborates every finding in -26-108041 and supplies the February 2026 enrollment scale (over 19 million consumers across federal and state Marketplaces). gao.gov · original document
- U.S. Government Accountability Office, Advance Premium Tax Credit: Preliminary Observations on Fraud Risk Management (GAO-26-108742) (2025-12-03) — 's covert-testing and data-analytics report. Source of the 20-fictitious-identity test (19 approved, 18 still covered, over $10,000 a month in APTC), the 30,000/160,000 likely-unauthorized application counts, the $124 billion APTC scale, the $21 billion with no evidence of reconciliation, the death-data matches, and the 850 suspended-then-reinstated brokers. gao.gov · original document
- Centers for Medicare & Medicaid Services, CMS Update on Actions to Prevent Unauthorized Agent and Broker Marketplace Activity (2024-10-17) — 's own October 2024 account of its fixes: the July 19, 2024 blocking change, the three-way-call requirement, and the claimed results — casework down about 30 percent, agent-associated plan changes down nearly 70 percent, commission-information changes down nearly 90 percent, described as 'the desired effect.' Used as the ledger the 2026 complaint data is read against. cms.gov · original document
- Centers for Medicare & Medicaid Services, CCIIO, Frequently Asked Questions: Consumer Consent & Application Review Requirements (2024-06-12) — 's own consent rulebook for agents and brokers: attestations must be explained to the consumer, consent documented and kept a minimum of 10 years, produced to on request. The rule measured 's practice against. cms.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
Two reports published today (GAO-26-108041⧉ and GAO-26-108297⧉) find that the federal Marketplace still cannot reliably verify that a consumer agreed to what a broker does in their name. Complaints itself confirmed as unauthorized enrollments or plan switches grew from 66,548 in 2023 to 299,604 in 2025 — through the period described its countermeasures as having "the desired effect." Any of roughly 96,000 registered brokers can still pull up any consumer's record with a name and date of birth; three state-run Marketplaces examined require a one-time passcode from the consumer, and report no comparable problem.