What are the warning signs of a medicare & health fund impersonation?

Watch for: Unsolicited call or SMS about Medicare or your health fund; Requests for full Medicare number, IRN or CRN; Threats that your card will be cancelled within 24 hours; Recorded voice asking you to 'press 1 to speak to an officer'.

How can I tell if this is a scam?

Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.

What should I do if I clicked the link or replied?

Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Hang up. Medicare and Services Australia don't cold-call asking for numbers. Sign in to myGov directly to check messages — never via a link in an SMS. Call your health fund using the number on your member card to verify.

What should I do if I already sent money?

Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.

Where should Australians report this scam?

Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.

All scams

🩺

Medicare & health fund impersonation

Calls or texts pretending to be Medicare, Bupa or Medibank wanting to 'verify' your details.

SeniorMigrant

How it works

A caller says your Medicare card is being cancelled, a rebate is owed, or your private health policy has been compromised. They ask you to confirm your Medicare number, Centrelink CRN, Medibank ID, bank details or a 6-digit verification code. With these, they commit identity fraud, raid your MyGov account, or open phone contracts in your name.

Common scenarios to watch for

This scam shows up in several different shapes. Recognise the pattern, not just one message.

Reporting locationHotlines on the printed checklist will match this location.

Robocall 'press 1' Medicare cancellation

An automated call says your Medicare card has been suspended due to fraud and asks you to press 1 to speak with an 'investigator' who then phishes your number and ID.

"This is Services Australia. Your Medicare entitlement has been suspended. Press 1 to speak to an officer immediately."

Red flags to spot

Is the call a recorded voice asking you to press a key?
Are they threatening to cancel your Medicare unless you act now?
Do they ask for your full Medicare number or CRN?
Did the call come from a withheld or overseas number?

'Rebate owed' SMS link

An SMS says you're owed a Medicare or private health refund and links to a fake myGov / Medibank page that captures your login and bank details.

"Medicare: A rebate of $326.40 is pending. Confirm bank details: medicare-rebate-au.com/claim"

Red flags to spot

Is there a link to a site that isn't medicare.gov.au or my.gov.au?
Does the page ask for full card numbers, CVV, and Medicare details together?
Is the rebate amount oddly specific to feel real?
Did you reach the page only via the SMS link, not by going to myGov yourself?

Red flags

🚩Unsolicited call or SMS about Medicare or your health fund
🚩Requests for full Medicare number, IRN or CRN
🚩Threats that your card will be cancelled within 24 hours
🚩Recorded voice asking you to 'press 1 to speak to an officer'
🚩Caller already knows your name and address (from data breach) and uses it for trust

What to do

1Hang up. Medicare and Services Australia don't cold-call asking for numbers.
2Sign in to myGov directly to check messages — never via a link in an SMS.
3Call your health fund using the number on your member card to verify.
4If you shared your Medicare or CRN, call IDCARE (1800 595 160) to lock down identity.
5Report to Scamwatch.

Who's targeted

Seniors and migrants enrolled in Medicare or a health fund.
Anyone whose name and address leaked in a recent breach (e.g. Medibank).

Why it works

Caller already knows your name and address from breach data.
Threats to cancel essential health cover create urgency.

Common variations

Different shapes of the same scam — recognise the pattern.

1'Your Medicare card has been cancelled' robocall.
2Health-fund 'rebate' email asking for bank details.
3'Premium overcharge refund' text linking to a phishing page.

If you've already been scammed

1Call your health fund directly using the number on your card.
2If you shared Medicare or CRN details, call IDCARE on 1800 595 160.
3Place a temporary credit freeze with Equifax / illion if ID was exposed.

Frequently asked

Does Medicare ever cold-call?▾

No. Services Australia only contacts you via myGov, not unsolicited SMS or calls.

Will my card really be cancelled?▾

No — Medicare cards are not cancelled by phone.

How long does IDCARE help last?▾

As long as you need — their service is free and ongoing.

Questions people ask about this scam

How does the medicare & health fund impersonation work?: A caller says your Medicare card is being cancelled, a rebate is owed, or your private health policy has been compromised. They ask you to confirm your Medicare number, Centrelink CRN, Medibank ID, bank details or a 6-digit verification code. With these, they commit identity fraud, raid your MyGov account, or open phone contracts in your name.
What are the warning signs of a medicare & health fund impersonation?: Watch for: Unsolicited call or SMS about Medicare or your health fund; Requests for full Medicare number, IRN or CRN; Threats that your card will be cancelled within 24 hours; Recorded voice asking you to 'press 1 to speak to an officer'.
How can I tell if this is a scam?: Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.
What should I do if I clicked the link or replied?: Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Hang up. Medicare and Services Australia don't cold-call asking for numbers. Sign in to myGov directly to check messages — never via a link in an SMS. Call your health fund using the number on your member card to verify.
What should I do if I already sent money?: Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.
Where should Australians report this scam?: Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.

General scam awareness information. ScamShield AI cannot guarantee that every scam will be detected or that a message is legitimate.

Check a message like this Report & next steps