Scam Trends, November 2026: Fake FTC Calls, COLA Cons, and the Package You’re Expecting
November is full of messages people are waiting for. Marketplace enrollment opens November 1, Social Security posts its 2027 raise notices online in late November, and packages pile up between Thanksgiving on November 26 and Cyber Monday on November 30. Giving Tuesday follows on December 1. Scammers time their messages to land just before the real ones. The newest script comes from callers posing as FTC officials who threaten to shut off your phone number. One defense covers all of it: when you are expecting something, go and get it yourself instead of acting on the message that arrives.
October’s report was about borrowed authority: badges, .gov look-alikes, recall notices. November is about timing. A scam doesn’t need to look perfect when it shows up the same week you’re waiting for the real thing. The stakes are highest for older relatives. On October 19 the FTC told Congress that fraud losses reported by adults 60 and over rose about fivefold between 2020 and 2025.
The FTC also estimates that the overall cost of fraud to older adults in 2025 could be as high as $119.5 billion. If a parent has been talking about an investment that only grows, our pig butchering guide is the one to send first. The calendar below is the rest of the month, as a scammer reads it.
The FTC is not calling about your phone number
On October 22 the FTC described what it called the latest twist on FTC impersonators. The caller says he works for the FTC and reads off a badge number. A phone registered in your name, he says, is being used to run scams in another country, and your number will be deactivated unless you cooperate. Then you are transferred to a “police officer” who wants your ID and personal details, tells you to keep the call secret, and says you are under arrest unless you send money for a “security deposit.”
That sequence should sound familiar. In September the FBI counted more than $1.6 billion lost to people posing as police and government officials in 19 months, and the shape was the same: a crime you supposedly committed, a hand-off to someone with more authority, a demand for secrecy, and a payment that makes it all go away. The FTC’s answer is short. Its staff will never threaten to disconnect your phone, and will never ask you to send money.
The costume extends online, too. On October 29 the FTC said domain registrars had taken down 19 websites posing as the agency, among them FTC-help.com and federaltradecommission.net, and that imposter scams remain the top reported fraud category. A week earlier it sued the operators of GovAssist, Entry and IVS.us, alleging paid search ads that impersonated the government to sell passport help. The ads said services started at $89. The FTC says the lowest real price was $148 once shipping was added. Our jury duty scam guide and fake FBI agent breakdown cover two close cousins of the phone call.
The tell that never changes
A real agency never needs you to keep a call secret, stay on the line, or pay to make an accusation go away. Any one of those is enough. Hang up and call the agency on a number you look up yourself.
A raise you don’t have to activate
On October 14 Social Security announced a 3.6 percent cost-of-living adjustment for 2027, covering about 76 million people. The increase reaches about 7.3 million SSI recipients on December 31 and nearly 72 million Social Security beneficiaries with their January payments. In late November the notices themselves go online, in the Message Center of each person’s my Social Security account.
Scammers know that window well. On October 21 the agency’s inspector general warned that impostors are reaching out by phone, text, email, social media and mail, claiming they can raise payments or “activate” the COLA. The pitch ends in a fee, a request to change your direct deposit, or a link to a site that looks official. Some send fake documents or use the names of real employees. None of it is needed. Beneficiaries do not register, apply or activate anything, because the increase is automatic.
How to read the real notice
Sign in at ssa.gov yourself, not through a link in a text or email, and open the Message Center. If a call or message about the COLA asks for money or account details, report it at ssa.gov/scam or call the inspector general’s hotline at 1-800-269-0271. The same office warned in September about paid offers to “boost” benefits, which we covered in October’s report.
Open enrollment, round two: the plan in the ad
Medicare’s enrollment window runs to December 7, and on November 1 the Health Insurance Marketplace opens alongside it. Marketplace enrollment for 2027 coverage ends January 15, and you need to sign up by December 15 for coverage that starts January 1. The ads arrive with it. On October 29 the FTC warned that some promise comprehensive health insurance but sell plans with limited benefits, or medical discount cards that are not insurance at all. Others look like they come from the government or a well-known insurer and are run by impersonators.
Start at HealthCare.gov or call 1-800-318-2596. For Medicare, type Medicare.gov or call 800-633-4227. A prerecorded robocall selling health insurance is illegal, so that call is already a reason to hang up. The FTC is pressing the industry as well: staff are sending warning letters to 25 companies that market health plans or generate sales leads for them, with more to follow. For a parent who gets a lot of plan mail, our guide to protecting elderly parents has a script for the conversation.
The package you’re expecting, and the store that never ships
Thanksgiving is November 26, which puts Black Friday on the 27th and Cyber Monday on the 30th. Every order means a tracking update, and every tracking update is cover for a fake one. The U.S. Postal Inspection Service gives the cleanest test available. USPS does not send texts unless you asked for them with a tracking number, and even then the text will not contain a link. So a USPS text with a link that you never signed up for is a scam. Other carriers work differently, so the habit that works everywhere is to open the carrier’s app, or type its address yourself, and paste the tracking number there.
Forward a scam text to 7726 to flag it with your phone carrier. For USPS impostors, the Postal Inspection Service also takes reports at spam@uspis.gov. If you already tapped and typed anything in, call your bank. Our USPS text scam guide has side-by-side examples, and the SMS scam checker will look at one for you.
The other half of the season is the store that takes your money and ships nothing. The FBI logged 56,478 non-payment and non-delivery complaints in 2025, with $503 million lost. FTC data show social media was the costliest way scams reached people last year, at $2.1 billion, and shopping scams were the most reported type there. Two checks catch most of them: search the store’s name with “scam” or “complaint” before you buy, and pay by credit card so you can dispute the charge. Holiday Scams 2026 walks through the payment step that gives nearly every one away.
Giving season, and the prize you pay for
Giving Tuesday is December 1, and the appeals start well before it. On October 26 the FTC warned about scammers impersonating well-known charities, sometimes under names that only sound like real ones. It also flagged a newer hook: a call saying you won a sweepstakes sponsored by a charity you gave to. Caller ID can be faked, so a familiar name on the screen proves nothing. Some of these impostors buy ads on Google and Bing, so scroll past the paid results when you search.
If you have to pay to collect a prize, it is not a prize.
That rule settles the sweepstakes version, because legitimate sweepstakes are free and won by chance. To give, go to the charity’s own website yourself rather than answering a call, text or ad. And keep the FTC’s shortest piece of advice in mind all season: gift cards are for gifts. No real business or government agency will tell you to pay with one.
Also moving this month
- Election week. Election Day is November 3. The FBI’s October 15 warning lists four schemes: fake campaign “investment pools,” look-alike PACs, merchandise that never ships, and texts linking to fake voter registration pages. Check your registration at vote.gov and a PAC’s filings on the FEC website. Campaign donations are not an investment. More in our midterm election scams guide.
- Veterans Day. The VA warns about “claims predators” who charge veterans a fee and promise faster processing. Use only VA-accredited attorneys, claims agents, or veterans service organization representatives, and report fraud to the VSAFE hotline at 1-833-38V-SAFE (8-7233). Our veterans scams guide covers the rest.
- Sextortion “help” that doesn’t help. On October 13 the FTC sued the company behind BlackmailHelpline.com and related sites, alleging it charged victims thousands of dollars on a false promise to stop sextortion threats. Ignore and block the blackmailer, and don’t pay. If the victim is a minor, contact NCMEC’s CyberTipline. Our sextortion playbook covers the first hour.
- A refund check that is real. The FTC is sending more than $9.8 million to 65,022 people harmed by scams that ran through Walmart’s wire transfer services. Recipients should cash their checks within 90 days, and questions go to the refund administrator, Rust Consulting, at 1-833-472-1990. If someone calls offering to speed up a refund for a fee, that is the recovery scam.
- Packages you didn’t order. That is often a brushing scam. The Postal Inspection Service says unsolicited merchandise is yours to keep, and you don’t have to pay for it or send it back. Don’t scan a QR code that came in the box. More in our brushing scam guide.
For businesses: before the long weekend
Two FBI alerts from October belong on a small business’s list before Thanksgiving. The most urgent is technical. On October 23 the FBI warned about two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, that could let attackers run code remotely. Its advice is to apply the security updates immediately, or take the system offline until it can be fixed. WordPress and many online stores run on PHP, so ask your web host or developer this week whether your site is patched, before the busiest shopping days of the year.
The second is about hiring. On October 13 the FBI updated its warning on North Korean IT workers who land remote jobs with stolen identities and increasingly pay Americans to sit in on interviews, receive work laptops, and keep them running from home. The FBI estimates North Korea takes 85 to 90 percent of what these workers earn, and says no single check reliably identifies them. If you are adding seasonal or contract help remotely, verify identity more than once. Our piece on deepfake job candidates has the interview checks.
And the evergreen one. Business email compromise cost $3.05 billion of the $20.9 billion reported to IC3 in 2025. In December the request is usually gift cards for clients or a last-minute change to a vendor’s bank details. Confirm either by calling a number you already had, never one in the message. Our vendor email compromise guide has the procedure, and if a mailbox has already been taken over, the Microsoft 365 account takeover checklist explains why a password reset alone leaves the attacker inside.
The pattern underneath
November’s scams don’t need to be convincing so much as on time. The fake tracking text arrives the week you are waiting on a package. The COLA “activation” call comes the month the raise is announced. The charity sweepstakes call comes just before you planned to give. When you are expecting something, the safe move is to go and get it yourself: the carrier’s app, ssa.gov, HealthCare.gov, the charity’s own site. The message that came to you can wait.
Practice beats panic.
ScamDrill sends safe, realistic fake texts, voicemails, and emails to your family or your team on a rotating schedule, tuned to the scams trending right now. When someone clicks, they get a teachable moment instead of a real loss.
Start a free drill →Three questions to ask out loud this week. What would you do if a caller said your phone number was about to be shut off? Where would a parent go to read their 2027 Social Security notice? Who in your business answers the phone if something breaks over Thanksgiving weekend? Any “I’m not sure” is the drill to run.
Sources: FTC consumer alerts on FTC impersonators threatening phone deactivation (Oct 22, 2026), charity and sweepstakes impersonators (Oct 26), health insurance ads during open enrollment (Oct 29) and sextortion assistance services (Oct 13); FTC press releases on imposter scam enforcement and warning letters to healthcare plan marketers (Oct 29), the GovAssist lawsuit (Oct 22), Walmart wire transfer refunds (Oct 15) and the Protecting Older Consumers 2025–2026 report (Oct 19); SSA 2027 COLA information and SSA OIG scam alert (Oct 21, 2026); HealthCare.gov dates and deadlines; FBI IC3 PSAs on midterm election scams (Oct 15), North Korean IT workers (Oct 13), PHP vulnerabilities (Oct 23) and government impersonation (Sept 17, 2026); FBI IC3 2025 Internet Crime Report; FTC social media Data Spotlight (April 27, 2026); U.S. Postal Inspection Service smishing guidance; VA VSAFE.