Just weeks after alerting providers to a scam related to fraudulent record requests, CMS has updated its warning to note that these phishing attacks are arriving via fax and email.
 
“Scammers are impersonating CMS and sending phishing requests for medical records or payment of alleged Medicare debts, often via fax or email, falsely claiming to be part of a Medicare audit or debt collection efforts,” CMS notes in the alert July 10, 2025.
 
CMS generally doesn’t initiate audits via fax or email unless a provider requests it, and Medicare overpayment collections are handled through an established process through the Medicare Administrative Contractors (MACs).
 
If you receive a suspicious request, don’t respond. If you think you got a fraudulent or questionable request, work with your MAC to confirm if a medical records request or overpayment collections are legitimate.
 
Last summer, CMS noted a similar scam and shared an example of a fraudulent request. 
 
Other guidance included signs of a scam.
 
When you review any requests, look for signs of a scam, including:
  • Directing you to send records to an unfamiliar fax number or address
  • Referencing Medicare.gov or @Medicare (.gov)
  • Indicating they need records to “update insurance accordingly” 
A scam request may include:
  • Poor grammar, misspellings, or strange wording
  • Incorrect phone numbers
  • Skewed or outdated logos
  • Graphics that are cut and pasted