SEARCH-AD IMPERSONATION

Fake health insurance and Medicare search-ad scam 2026: the #1 "Sponsored" result is not healthcare.gov

You searched "health insurance." The very first result looked official. It was a paid ad built to take your information. The FTC just put a name to it.

SB

SafeBrowz Threat Research Security ResearchJune 23, 202610 min read

What the FTC actually warned about

On June 9, 2026, the Federal Trade Commission published a consumer alert with a blunt title: "Searching for health insurance? Keep scrolling to avoid government impersonators." The point is simple and uncomfortable. Many people type a query into Google, click the very first result without thinking, and assume the first thing they see is the official one. With health insurance and Medicare, that habit can cost you.

The FTC said dishonest businesses pay to place ads at the top of search results that look like official government websites. Those ads are designed to trick you into sharing personal information, paying unnecessary fees, or signing up for misleading services. The agency gave three defenses: spot the "Ad" or "Sponsored" label, check that the web address ends in .gov, and scroll down past the top results before you click anything.

This is not a niche warning. Health insurance, Medicare, and healthcare.gov are some of the most-searched, most lucrative phrases in the entire paid-search economy. Where the money is, the impersonators follow.

How search-ad impersonation works

Search engines sell the slots above the real results to the highest bidder. A scam operator buys ads on phrases like "health insurance," "Medicare enrollment," "Obamacare plans," or even "healthcare gov" itself. Their ad sits at the very top, often with a clean-looking display URL and copy that reads like a government page. The only thing separating it from a real organic result is a small "Ad" or "Sponsored" label that is easy to miss.

Click it and you land on a page that mimics the look of an official Marketplace or Medicare site: a federal-looking seal, blue-and-white styling, a "Check your eligibility" or "Enroll now" form. The domain, though, is something like healthcare-enrollment-gov.com or medicare-plans-help.net or official-marketplace-signup.org. It is not a .gov address. It just borrows the words.

From there the operation goes one of a few ways. Some pages are lead-generation traps that harvest your name, date of birth, income, Social Security number, and Medicare number, then sell that data to aggressive call centers. Some charge a junk "processing fee" or "enrollment assistance fee" for a service that is free on the real site. Some sign you up for a thin, misleading plan that is not the comprehensive coverage you thought you were buying. The common thread: you handed real information to a site you believed was the government, and it was not.

Why the #1 sponsored result is not official

Here is the mental model to lock in. A sponsored result is an advertisement. Its position has nothing to do with being correct, trustworthy, or official. It is at the top because someone paid for it to be there, and right now. The real healthcare.gov and medicare.gov sites usually appear as organic results below the ad block, without any "Ad" label, on a genuine .gov address.

The U.S. government does not need to outbid scammers for the top ad slot to be the real one. Official federal sites end in .gov, a suffix that only verified U.S. government organizations can register. That single detail is your strongest signal. A health insurance or Medicare site that ends in .com, .org, .net, .us, or anything other than .gov is not the federal government, no matter how official the page looks or how high it ranks in the ad block.

Search ad review systems do catch many impersonators, but enforcement is reactive. A fresh lookalike domain can run live for hours or days before it is reported and pulled, and the operators simply spin up the next one. That gap is exactly where victims get caught.

The real official sites, and how to reach them

There is a short list of genuine federal addresses for health insurance and Medicare. Memorize them, and type them into the address bar yourself rather than clicking a search result. All of these end in .gov.

• Health Insurance Marketplace: healthcare.gov. The official site to compare and enroll in Affordable Care Act Marketplace plans. Type it directly.
• Medicare: medicare.gov. The official site for Medicare benefits, plan comparison at medicare.gov/plan-compare, and your account. Type it directly.
• Centers for Medicare and Medicaid Services: cms.gov. The federal agency that runs Medicare, Medicaid, and the Marketplace.
• Social Security Administration: ssa.gov. Where you actually sign up for Medicare Part A and Part B, at ssa.gov/medicare.

Two more habits make this nearly foolproof. First, bookmark the real sites once and use the bookmark from then on, so you never re-search and never re-roll the dice on the ad block. Second, for free unbiased help choosing a plan, call 1-800-MEDICARE (1-800-633-4227) for Medicare or use the Marketplace call center listed on healthcare.gov itself, and contact your state SHIP (State Health Insurance Assistance Program) at shiphelp.org. None of those will charge you a "processing fee," because enrolling through the official channels is free.

Red flags that you are on a fake health insurance page

Before you type a single character into any health insurance or Medicare site, scan for these signals.

• The result is labeled "Ad" or "Sponsored." That label means someone paid for the placement. For government services, treat the top ad as guilty until proven innocent and scroll to the organic .gov result instead.
• The web address does not end in .gov. healthcare-enrollment-gov.com is not healthcare.gov. The word "gov" in the middle or with a hyphen is a trick. Only the actual top-level ending of .gov counts.
• It asks for your Social Security number or Medicare number before showing you any plans. The real Marketplace asks for identity details deeper in a logged-in application, not on a cold landing page you reached from an ad.
• There is a fee to enroll, a "processing fee," or an "assistance fee." Enrolling through healthcare.gov, medicare.gov, or a state SHIP counselor is free. Any charge to enroll is a red flag.
• Urgency and pressure. "Enroll in the next 10 minutes." "Only 3 plans left in your area." "Your eligibility expires today." Real Marketplace and Medicare deadlines exist, but they do not work on a countdown timer on a landing page.
• A phone number that wants to "verify" you immediately. Many of these pages exist to put you on the phone with a high-pressure sales floor that is paid per lead, not to enroll you in the best plan.
• Generic or off contact details. No real .gov address, a free email address for "support," or a company name that is not CMS, SSA, or your state Marketplace.

What to do if you already submitted your information

If you typed your details into one of these pages, do not panic, but move today. The right steps depend on exactly what you gave away.

• If you gave your Social Security number or Medicare number, treat them as compromised. For Medicare fraud, call 1-800-MEDICARE (1-800-633-4227) and report it, and contact your state Senior Medicare Patrol at smpresource.org or 1-877-808-2468. For your Social Security number, start a recovery plan at identitytheft.gov and consider a free fraud alert or credit freeze at the three credit bureaus.
• If you paid a fee, contact your bank or card issuer right away, explain it was a fraudulent or misrepresented charge, and ask about a dispute or chargeback. Card payments are reversible far more often than people assume if you act quickly.
• If you think you "enrolled" in a plan through the fake site, verify your real coverage status directly at healthcare.gov (type it yourself) or by calling the official Marketplace number, and at medicare.gov for Medicare. Do not call any number the fake site gave you.
• Watch for follow-up contact. Once a lead-gen page has your number, expect a wave of calls and texts. The real government will not cold-call you to finish an enrollment you started on an ad page. Let unknown numbers go to voicemail and call the official line back yourself.
• Report it. File with the FTC at reportfraud.ftc.gov. Your report feeds the Consumer Sentinel database that drives enforcement against these operators.

How this connects to the wider scam-ad problem

Search-ad impersonation is not unique to health insurance. The same playbook hits banking logins, crypto exchanges, software downloads, and government services like the IRS and Social Security. We have covered the broader pattern in how malicious ads (malvertising) work and in the fake ChatGPT and Sora download ad scam, where a paid result leads to a lookalike instead of the real product. Government impersonation in particular shows up against Medicare, as in the Medicare open enrollment scam, and against Social Security in the SSA impersonation scam. The defense is always the same family of habits: do not trust position, check the domain, and reach official sites directly.

If you want a deeper checklist, our guide on how to tell if a website is a scam walks through the domain, padlock, and content tells in detail.

Last updated 2026-06-23

How SafeBrowz blocks this threat

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI.

• Layer 1, Local detection: 60+ URL patterns and 550+ brand-specific signatures run directly in your browser. When you land on a lookalike like healthcare-enrollment-gov.com or medicare-plans-help.net, the impersonation pattern is caught at click time, before any form loads. Honest scope: SafeBrowz flags the lookalike .gov landing page even when it was the top sponsored result you clicked.
• Layer 2, API checks: Google Safe Browsing, PhishTank, and URLhaus cross-references run server-side, catching known malicious health-imposter domains the moment they are reported anywhere in the world, including the throwaway lookalike sites that ad-buyers spin up and burn.
• Layer 3, AI deep scan (Premium): Content analysis flags brand-new health insurance and Medicare imposter pages that no blocklist has seen yet. It works in over 100 languages, which matters for the multilingual versions of this scam aimed at Spanish-speaking and other US communities.

Detection signatures are derived from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

FAQ

Is the first search result for Medicare official?

Not necessarily. The first result is very often a paid "Ad" or "Sponsored" placement, and the FTC warned on June 9, 2026 that these top ads are frequently government impersonators built to look official. A sponsored result is at the top because someone paid for that slot, not because it is the real Medicare site. The genuine Medicare site is medicare.gov, on a .gov address. Scroll past the ads, look for the .gov ending, or type medicare.gov yourself rather than clicking the top result.

What is the real Medicare and health insurance website?

The real Health Insurance Marketplace is healthcare.gov. The real Medicare site is medicare.gov. The agency that runs both is the Centers for Medicare and Medicaid Services at cms.gov, and you sign up for Medicare Part A and Part B through the Social Security Administration at ssa.gov. All four end in .gov, which only verified U.S. government organizations can register. A health insurance or Medicare site ending in .com, .org, or .net is not the federal government. Type the .gov address into your browser yourself, or use a saved bookmark.

I gave my info to a fake health insurance site. What now?

Act today. If you gave your Social Security number or Medicare number, treat them as compromised: report Medicare fraud to 1-800-MEDICARE (1-800-633-4227) and your state Senior Medicare Patrol at smpresource.org, and start identity recovery at identitytheft.gov. If you paid a fee, contact your bank or card issuer immediately and ask to dispute the charge. Verify your true coverage status directly at healthcare.gov or medicare.gov, never through a number the fake site gave you. Then report the scam at reportfraud.ftc.gov.

How do I report a fake government website?

Report it to the FTC at reportfraud.ftc.gov, which feeds the Consumer Sentinel database used by law enforcement. For impersonation of Medicare specifically, also report to 1-800-MEDICARE and your state Senior Medicare Patrol at smpresource.org or 1-877-808-2468. You can report a misleading paid ad to the search engine that showed it, using the "Why this ad" or ad-feedback option next to the listing. Reporting helps get the lookalike domain and the ad pulled faster, which protects the next person who searches.