ACA Open Enrollment Starts Nov. 1. The Lookalike Sites and Rogue “Agents” Got There First. (2026)

Type HealthCare.gov yourself — and no one can switch your plan without you. ACA marketplace open enrollment runs November 1 through January 15, and the FTC says scammers and dishonest businesses pay to appear at the top of search with lookalike addresses and official-looking logos — follow their link and you can end up paying for a “scammy plan” that isn't health insurance, or feeding a medical identity theft. The abuse is measurable from the inside: the government canceled roughly 315,000 unauthorized marketplace enrollments covering more than 760,000 people — many signed up without consent by rogue agents — and CMS now requires your electronic authorization before an agent can touch your application. Shop only at HealthCare.gov or 800-318-2596, typed by you.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — October 19, 2026 →

Straight from the source

The verdict stands on the public record — the line below is quoted verbatim from the source named under it.

“When you click on a link from an unsolicited email, it may take you to a website that looks identical to healthcare dot gov or Medicare dot gov, but you're on a lookalike website, and you don't know that because you're probably on your phone and you can't see the full URL.”

— Daniel Irwin, Better Business Bureau, October 12, 2026.

Why you’re seeing this now

The ACA marketplace open enrollment window runs November 1 through January 15 — a different program from Medicare's, and it draws its own impostors. The FTC's rule for the season: scammers and dishonest businesses pay to appear at the top of search, using lookalike addresses and official-looking logos to pass as HealthCare.gov; follow their link or number and you can end up paying for a “scammy plan” that isn't health insurance, or feeding a medical identity theft. This year the abuse is measurable from the inside: the federal government canceled roughly 315,000 unauthorized marketplace enrollments covering more than 760,000 people — many signed up without consent by rogue agents chasing commissions — terminated over 200 non-compliant agents and brokers, issued 569 more termination notices, and froze new broker registration for the 2027 plan year. Another 419,000 sign-ups are under review, and some wrongly removed consumers are being reinstated. So verify both directions: shop only at HealthCare.gov or 800-318-2596 — typed by you, past the “Ad” labels — get free real help through the site's “Find Local Help,” and check your own account for any plan or agent you never chose. CMS now requires your electronic authorization before an agent can touch your application.

Five red flags — any one is enough

A health-insurance “deal” at the top of search with an address that isn't quite HealthCare.gov — the FTC says paid placement is the impostor's front door. Scroll past the “Ad” and “Sponsored” labels.

Any unsolicited call, text, or email about open enrollment — the BBB's rule: an out-of-the-blue mention of open enrollment is a red flag until you vet it yourself.

Pressure to enroll or “verify” today over the phone — real enrollment runs through January 15, and HealthCare.gov never cold-calls.

A plan that's cheaper than everything and covers everything — the scammy-plan tell. Demand the Summary of Benefits, then check the insurer's name and complaints before paying anything.

A plan, agent, or broker on your account you never chose — the unauthorized-switch tell. CMS requires your electronic consumer authorization before an agent can act; without it, the enrollment is the fraud.

Your next three moves

Verify through a channel you open yourself — never the one in the message. Shop only at HealthCare.gov or 800-318-2596, typed by you, scrolling past the “Ad” and “Sponsored” labels, and get free, real help comparing plans through the site's “Find Local Help.” Then check your own account for any plan or agent you never chose: CMS now requires your electronic authorization before an agent or broker can act on your application.

Refuse the specific ask: no plan bought through a search ad, an unsolicited call, or a text — an out-of-the-blue mention of open enrollment is a red flag until you vet it yourself — no “verify today” pressure (real enrollment runs through January 15, and HealthCare.gov never cold-calls), and nothing without a Summary of Benefits you can check against the insurer's name and complaints before paying anything.

Report health-insurance cons to the FTC at ReportFraud.ftc.gov and your state attorney general — and if a plan or agent appeared on your account without your consent, call the marketplace at 800-318-2596 first. If you paid, call your card issuer; if you shared a Social Security number, start a plan at IdentityTheft.gov and watch for Explanation of Benefits statements you don't recognize. Check any link or number from the message via the $2 instant check for a 0–100 scam risk score before you act.

Is HealthCare.gov the real enrollment site — and is my window really open soon?

Yes on both. Marketplace open enrollment runs November 1, 2026 through January 15, 2027. The only official front doors are HealthCare.gov (typed by you) and 800-318-2596; state-run marketplaces have their own .gov sites. Free, legitimate help comparing plans exists — use “Find Local Help” on HealthCare.gov.

Can an agent enroll or switch me without my permission?

Not lawfully. After canceling some 315,000 unauthorized enrollments covering 760,000+ people, CMS now requires electronic consumer authorization before an agent or broker can act on your application, and barred new brokers from the 2027 market. Check your account at HealthCare.gov; if anything changed without your consent, call the marketplace, then report the agent to the FTC at ReportFraud.ftc.gov and your state attorney general.

I entered my details on a lookalike site — what now?

If you paid, call your card issuer. If you shared a Social Security number or personal details, start a plan at IdentityTheft.gov and watch for insurance Explanation of Benefits statements you don't recognize — medical identity theft shows up there first. Report the site at ReportFraud.ftc.gov and to your state attorney general.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.