For most people, the last day to enroll in a health plan for 2016 was January 31, 2016. But for scammers looking for a new twist on health insurance fraud, phishing season has just begun.

Phishing is a form of identity theft in which hackers use fraudulent websites, fake emails, and robocalls to attempt to steal your personal data, especially passwords, credit card information and, increasingly your Social Security number. Clicking on the link may open your computer to malware, like viruses and spyware. Or the link may send you to a spoof site—for example, a copycat version of the Social Security Administration’s site—to trick you into entering your personal information, including your Social Security number.

In what’s being called the Health Insurance Marketplace scam, you get a robocall purporting to be from a local branch of the Health Insurance Marketplace, the umbrella organization that oversees HealthCare.gov. The recorded message says, “You need to buy health insurance or face a fine. To learn more, press 1.” If you press 1, an operator who claims to “work with the law” asks for your personal information, including your name, date of birth, phone number, income, and Social Security number.

The more personal information you share, the more likely you are to be compromised. Crooks running the Health Insurance Marketplace scam start by trying to snag enough basic information—your date of birth and address, for example—to troll the web for more information. The more they amass, the more opportunities for fraud arise: They can open a credit card in your name, steal your tax refund, take out loans in your name, and even clean out your bank account or retirement accounts. 

What to Watch For

There are myriad clues that you’ve been targeted for the Health Insurance Marketplace scam:

  • A caller says, “I’m from the government.” No, he isn't. The government will not call you about your health insurance, and no one from the government will ask you to verify your Social Security number or divulge credit card information.
  • You receive a robocall. Robocalls are illegal. Unless you gave the caller written permission to call you, a robocall is illegal.
  • A phone recording asks you to press 1. Don’t press that button—or any button. Pressing a number to connect to an operator—even if you intend to tell them never again to call you—only verifies that you’re a live respondent and puts you at risk for receiving more calls. Scammers will put your number into a queue to target later.
  • The operator asks you for personal information. If you do speak to an operator who asks you for personal information, hang up.