Health Insurance Lead Scams: How Agents Spot and Avoid Them

How health insurance lead scams actually work

Not every bad lead is a scam. Wrong numbers and tire-kickers come with any lead source. A scam is when the vendor misrepresents what you're buying or how the consumer was captured. Most cases fall into four patterns.

• Fabricated leads: names, phone numbers and ZIP codes that don't belong to real shoppers, or real people who never filled out any form.
• Recycled leads sold as exclusive: the same household sold to many agents, sometimes days apart, while every invoice says "exclusive."
• Bait-ad leads: real people who responded to an ad promising something other than insurance, such as cash cards or rebates, and have no idea an agent will call.
• Consent-less leads: real shoppers whose form never mentioned an agent contacting them, or whose consent language names a different company or a list of hundreds of partners.

The bait-ad pattern is behind the worst cases. KFF describes a class-action complaint alleging that marketing agencies ran social media ads falsely offering free cash rewards. Landing pages captured consumers' information, which was sold to agents and brokers who enrolled or switched those consumers without their knowledge through an enhanced direct enrollment platform.

KFF also notes that many people and groups in the lead generation business are not licensed agents or brokers themselves. They sell leads to people who are licensed. That gap is the core of the problem for you.

Why lead fraud insurance risk lands on your NPN

Georgetown's Center on Health Insurance Reforms points out in its June 2025 analysis of Marketplace broker misconduct (opens in a new tab) that CMS does not have direct oversight of some third-party entities, such as lead generators or field marketing organizations that collect and sell leads to brokers. Agents, on the other hand, are licensed, easy to find, and named on the enrollment.

The consequences are real. KFF reports that between June and October 2024, CMS suspended 850 brokers for reasonable suspicion of fraudulent or abusive behavior tied to unauthorized plan switches and enrollments. KFF also notes that the civil penalty of up to $250,000 for knowingly and willfully providing false or fraudulent information extends to "any person," including an agent or broker.

CMS also closes the "the vendor said they consented" loophole. Its Marketplace compliance presentation for agents and brokers (opens in a new tab), dated August 28, 2025, says you need compliant consent documentation before giving enrollment assistance, including a person search, "even if you are connected with the consumer by a third party." You must keep that documentation for at least 10 years and provide it to CMS on request.

This is general information, not legal advice. The CMS presentation covers the Federally-facilitated Marketplaces and generally does not apply to State-based Marketplaces that don't use HealthCare.gov. Confirm your obligations with your FMO, carrier compliance team or counsel.

Red flags of bad lead vendors

One red flag can be sloppiness. Two or three together is a pattern. Watch for these before and after you buy:

• The vendor won't show you the ads and landing pages that produced the leads.
• Sourcing is vague: "a network of publishers" or "proprietary traffic" with no detail.
• Consent language lists hundreds of partners or never names you or your agency.
• Leads arrive without a timestamp, IP address, page URL or copy of the consent text.
• Contacts say they never asked about health insurance, or mention a cash card, gift or "government benefit."
• Consumers tell you several other agents already called them about the same request.
• "Exclusive" pricing that seems too cheap compared with what real ad traffic costs in your market.
• No returns for disconnected numbers or for people who deny requesting contact.
• Pressure to buy a large bundle before you can test a small batch.

For a full vendor interview process, see our guide on how to vet ACA lead vendors before you buy.

A due-diligence checklist before you buy leads

CMS's compliance presentation strongly encourages agents working with lead generators to understand how the company generates leads, check its creative materials, and understand how it prices and sells leads so you don't buy one that has been sold to multiple agents. Turn that into questions you send in writing:

1. Send me three current ads and the landing pages they link to.
2. What exact consent language does the consumer see, and does it name my agency?
3. For each lead, what record do I get: timestamp, IP, page URL, consent text, and any session or consent certificate?
4. How many times can the same record be sold, and over what period? Put it in the contract.
5. Who runs the ads, and is anyone in your chain a licensed agent?
6. What is the return policy for duplicates, bad numbers and consumers who deny requesting contact?
7. Can I test a small batch before committing to volume?

Save every answer in a vendor file. If questions come up later, a record that you asked is far better than nothing. If price is the deciding factor, our breakdown of exclusive vs shared health insurance leads shows how to compare real cost per enrollment.

For a regulator's view of what can go wrong between an ad and a sold lead, read the FTC guidance on deceptive health insurance lead generation (opens in a new tab), which discusses allegations and a settlement in a recent case. Plenty of third-party lead generation is legitimate. Your job is to know which kind you're buying.

Calling purchased leads without inheriting the scam

Even a clean lead needs a clean first contact. Three habits protect you.

Know which telemarketing rules apply

The FTC explains in its guide to complying with the Telemarketing Sales Rule (opens in a new tab) that, under the McCarran-Ferguson Act, the TSR applies to insurance to the extent that business is not regulated by state law. Whether your calls are covered depends on your state, and the TSR doesn't automatically apply just because a third-party telemarketer runs the campaign. Where it does apply, failing to make required disclosures clearly and conspicuously can bring a civil penalty of $53,088 per violation.

Separately, the TCPA and state calling laws govern calls and texts to purchased numbers. Review your dialing and texting setup with your compliance resources before you load a new vendor's list.

Re-confirm consent on the first call

Try a script like this: "Hi, this is [Name], a licensed health insurance agent with [Agency]. You asked about Marketplace health plans on [site] on [date]. Is now a good time? Before I look anything up, I need your permission to help with your Marketplace application and to search for your information. Is that okay?"

Document the answer in the format your Marketplace rules require. If the person says they never asked, apologize, stop, mark the record, and return it to the vendor. Do not run a person search.

Never change a plan without the consumer present

CHIR reports that as of July 2024, the Marketplace required a three-way call with the consumer before a new broker could make coverage changes through enrollment websites. Afterward, broker-initiated plan changes fell nearly 70 percent and commission redirection fell almost 90 percent. Check CMS's current requirements for 2026, and make it your rule regardless: no switch without the consumer actively on the line.

What to do if you already bought bad leads

1. Stop calling the batch and pause the vendor.
2. Don't run searches or enrollments on any lead you can't tie to documented consent.
3. Export invoices, lead files, consent records, call notes and vendor emails.
4. Request returns or refunds in writing, listing the specific records.
5. Review enrollments from that vendor and re-confirm each consumer wants the coverage.
6. Report what you found.

Your state department of insurance licenses you and can investigate. The NAIC's insurance fraud resource page (opens in a new tab) notes that 42 states and the District of Columbia operate insurance fraud bureaus, and that its Online Fraud Reporting System lets consumers and insurance departments route suspected fraud to the right state. Reporting early also shows you acted when you saw the problem.

Own the source and lead scams lose their grip

The surest way to avoid health insurance lead scams is to stop relying on leads you can't trace. When the ad, landing page, consent form and CRM are yours, you can answer every question about where a lead came from.

FastTrack ACA builds that for you: a branded quote funnel on your domain under your NPN, permission to contact and permission to act on the Marketplace signed separately and filed as PDFs, a GoHighLevel CRM configured for ACA, a prefilled HealthSherpa handoff, and Meta ads run on your own ad account (ad spend is billed by Meta). Your leads are yours and are never resold or shared.

Set up your own ACA lead system at FastTrack ACA online, with no sales call.