The Omicron wave pushed COVID-19 testing demand to new highs, and scammers followed. According to IdentityIQ's write-up of recent warnings, the Better Business Bureau and federal agencies are flagging a surge in fake test sites, fraudulent home test kits and robocall-driven scams. The goal is not the test result. It is the personal data, the health insurance details and the credit card information.
Test scams are also identity theft scams. The clinical and financial damage is layered.
At a glance
- Fake COVID test sites and home kits are surging with the Omicron wave.
- Scammers collect personal data, driver's licence numbers, Medicare IDs and insurance details.
- Robocalls redirect users to fake sites that look like clinics or medical suppliers.
- Legitimate sites like COVIDtests.gov do not ask for payment or ID numbers.
- Reporting to identitytheft.gov is the right first step if you suspect compromise.
The fake-site playbook
BBB and federal warnings describe a consistent pattern. Scammers set up pop-up test sites, fake websites and fraudulent emails. They advertise free tests, fast results or miracle turnaround times. They collect driver's licences, photocopies of health insurance cards, Medicare IDs and birth dates. They may charge a fee for the test; the fee is the least of the damage.
Some operations have a large digital presence: social media ads, SMS messages, emails. The goal is to look legitimate. The data they collect is sold, used for Medicare fraud or used for follow-on identity theft.
The robocall redirect
BBB specifically warns about robocalls that direct consumers to websites posing as clinics or medical suppliers offering COVID-19 tests. Some promise results within 10 minutes. All ask for credit card or personal information.
The pattern is the same: ask for personal data up front, deliver a "test" that may or may not be real, and monetise the data. The clinical outcome is not the concern. The business outcome is.
How to spot a fake
Six flags, drawn from the warnings:
Willingness to provide details. A legitimate site will tell you how the test works, where it comes from and which lab processes it. A fake site will be short on details.
Identity of the medical director. A legitimate site will name the medical director and provide credentials. A fake site will not.
Domain name accuracy. Scammers register lookalike domains. Check carefully; misspelled domains and complex subdomains are common.
Requests for unnecessary information. Medicare IDs and credit card numbers are not required for most legitimate tests.
Up front payment. Legitimate test sites bill insurance or, for uninsured patients, claim from a federal fund. Up front payment is a red flag.
Outreach method. Legitimate sites do not cold-call, cold-text or cold-email to offer tests. Any unsolicited contact is suspect.
What to do if you have been scammed
The first step is to report to identitytheft.gov, the federal identity theft reporting portal. Then you can continue to:
- Monitor the suspected obfuscation via the official channels (credit reports, financial statements, Medicare statements).
- Place a fraud alert or credit freeze with the major credit bureaus.
- Notify your health insurer and Medicare if those details were exposed.
- Reset credentials on any account that used the same password as the compromised site.
- Document the timeline; regulators and insurers will ask for it.
Our analysis
Test scams are not new; the pattern is the same as every other pandemic-era scam. What is new is the data the scammers are harvesting. Health insurance IDs, Medicare numbers and driver's licence numbers are durable identifiers that survive password resets and can be used for Medicare fraud, financial fraud and identity theft for years.
The right framing is that test scams are identity theft scams in clinical clothing. The clinical failure (a fake test, a delayed result, an inaccurate result) is the visible artefact. The identity theft is the silent cause. Reporting the clinical failure does not address the identity theft.
The other framing is that the most common target is not the patient; it is the data. Patients who paid for a fake test lost money. Patients who gave a fake Medicare ID, social security number and driver's licence to a fake site lost much more. The marginal cost of providing the data is low; the marginal cost to the patient is high.
A worked example
Say you responded to a text offering a free COVID test, clicked through to what looked like a clinic site, and provided your driver's licence, Medicare ID and a credit card for "verification." You never got a result. Today, file a report at identitytheft.gov. Place a fraud alert with one of the three major credit bureaus (the one you contact will alert them automatically). Notify Medicare and your health insurer of the suspected Medicare ID compromise. Reset the password on any account that shares the password you used on the fake site. Document the timeline. Then do not respond to the next unsolicited test offer.
Bottom line
Test scams are identity theft scams in clinical clothing.
- Treat any unsolicited test offer as suspect, especially via SMS, email or robocall.
- Verify the medical director, the lab and the domain name before providing any data.
- Do not provide Medicare ID, driver's licence or credit card unless legally required and verified.
- Report suspected compromise to identitytheft.gov and place a fraud alert.
- Monitor the suspected obfuscation for at least 12 months after compromise.
Frequently asked questions
How do I recognise a fake COVID test site?
Unsolicited outreach, lack of clinical detail, requests for unnecessary data (Medicare ID, credit card), up front payment requests and misspelled domains are the common flags.
Will COVIDtests.gov ask for my ID or payment?
No. The federal site does not request payment or ID numbers for legitimate orders.
What should I do if I gave my Medicare ID to a fake site?
Report to identitytheft.gov, notify Medicare and your health insurer, place a fraud alert with the credit bureaus and monitor Medicare statements for unfamiliar charges.
Are home test kit scams common?
Yes. BBB warns of fraudulent kits that may give inaccurate results and harvest personal data.
How long should I monitor the suspected obfuscation after a suspected compromise?
At least 12 months. Stolen health and identity data can be used for fraud long after the initial compromise.