Scam Trends, October 2026: Fake Officials, Fake Recalls, and the Enrollment Window
October stacks real deadlines on top of each other. Amazon’s Prime Big Deal Days run October 6 and 7, Medicare open enrollment starts October 15, and holiday shopping season starts with them. Scammers borrow every one. The loudest warning this month came from the FBI, which counted more than $1.6 billion lost to people posing as police and government officials between January 2025 and July 2026. The defense rarely changes: end the call or close the message, then go to the source yourself.
September’s report was about lists, and the crews that call back people who already paid once. October is about borrowed authority. A badge, a .gov look-alike, a recall notice, a son’s voice: none belong to the scammer, and all of them do the persuading. For scale: Americans reported $15.9 billion in fraud losses to the FTC in 2025 across 3 million reports, and imposter scams were the most reported category again, with more than a million reports and over $3.5 billion lost.
The badge on the phone
On September 17 the FBI’s Internet Crime Complaint Center reissued a warning it first published in 2022, and the update came with numbers. Between January 2025 and July 2026, IC3 received nearly 61,000 complaints about scammers impersonating US or foreign law enforcement and government officials, with losses topping $1.6 billion. Most of those complaints follow one script: you are connected to a crime, and paying is how you clear your name or help catch the “real” criminals.
The FBI broke out several smaller scripts. Missed jury duty or a skipped court date produced 6,833 complaints and nearly $36 million in losses. An expiring passport or driver’s license that needs a paid “renewal” produced 496 complaints. Medical practitioners told their license is expiring, or was used in a crime, filed 3,322 complaints and lost more than $37 million. The costliest version targets international students and immigrant communities: callers posing as foreign police or diplomats threaten extradition or a cancelled passport, sometimes in fake uniforms in front of mock government offices. That version cost 1,809 complainants more than $140 million.
The tradecraft barely varies: spoofed caller ID showing a real agency number, an urgent tone, a demand that you stay on the line, and payment by prepaid card, courier, wire, crypto, or cash fed into a crypto kiosk. One fact ends the call: law enforcement and government agencies do not phone or text people to demand payment of any kind. Hang up, find the agency’s number yourself, and call it. Our jury duty scam guide walks through the warrant version line by line, and this piece on fake IC3 agents covers the ones who claim to be the FBI itself.
“Don’t tell your bank”
The FBI says these callers routinely tell victims not to talk to family, friends, their bank or the police. No real investigation needs your silence. When a caller asks for secrecy, treat that request as the confirmation that it is a scam.
Social Security has its own variant this fall. On September 21 the agency’s inspector general warned about offers to “boost,” “unlock,” or “maximize” benefits for a fee. The agency does not raise anyone’s benefits in exchange for money. The annual cost-of-living announcement normally lands in October, and the pitch will borrow it. The real number is 1-800-772-1213.
Medicare opens October 15, and the top result may be an ad
Open enrollment for 2027 Medicare coverage runs October 15 through December 7. Last month’s warning was about early cold calls. This month the risk moves to the search bar. On September 28 the FTC pointed out that scammers and dishonest businesses pay to sit at the top of search results, use web addresses that look like government ones, and copy official logos. Call the number in one of those ads and you may buy a “plan” that is not health insurance, or hand over enough for medical identity theft.
The defense is boring and it works. Type Medicare.gov yourself, or call 800-633-4227. For Marketplace plans, type HealthCare.gov or call 800-318-2596. Scroll past anything labeled Ad or Sponsored, and check that the address ends in .gov. For free help comparing plans, the State Health Insurance Assistance Program and the Senior Medicare Patrol both exist for exactly this. Patient portals get imitated too, as our breakdown of the MyChart “Medicare kit” email shows.
Ten minutes this weekend
Save Medicare.gov as a bookmark on a parent’s phone and 800-633-4227 as a contact named “Medicare (real).” No advertiser can outbid a saved link. More on the wider conversation in our guide to protecting elderly parents.
Prime days, recall notices, and the text that comes after
Amazon’s Prime Big Deal Days run October 6 and 7. Amazon’s own trust team says scam texts tend to spike in the days immediately after a Prime event, when a “problem with your order” text sounds plausible to almost everyone. The variant AARP is hearing most about right now is the fake recall. The Fraud Watch Network helpline reported a spike in texts and emails claiming something you bought has been recalled for safety reasons. Amazon is the most impersonated retailer, with Walmart, Costco and Best Buy appearing too. The link promises a refund or a repair, and the page behind it wants your login or card details. AARP notes recall scams tend to peak during shopping seasons, which is the season we just entered.
Check real recalls without touching the message: look the product up at cpsc.gov/recalls, or sign in to the retailer through its app or a typed address and look at your orders. FTC data show social media was the costliest way scams reached people in 2025, at $2.1 billion, and shopping scams were the most reported type there. More than 40 percent of people who lost money to a scam on social media said it started with an ad for something they ordered. If a text has you unsure, paste it into our SMS scam checker before you tap anything.
Voices and faces you know
AARP published a story on September 28 that is worth forwarding to anyone with grown kids. A New Hampshire man got a call from someone claiming to be an attorney: his son had been arrested in Boston. Then the son came on the line. To keep him out of jail through the weekend, the family needed $15,000, supposedly 10 percent of the bail, and a courier would collect it in an envelope. He paid. That call was in 2023. He now volunteers to warn others, and AARP’s point is blunt: as voice cloning improves, these calls only get more convincing.
The counter costs nothing. Agree on a family safe word that never appears in a text or a post, and ask for it whenever a call involves money and panic at the same time. Our safe word guide covers picking one, and this piece on voice cloning explains how little audio a scammer needs. For parents of teens, the FTC also published a guide on talking with kids about deepfakes and the Take It Down Act. Platforms must now remove a reported intimate image, and known identical copies, within 48 hours, and if one does not, you can report it at TakeItDown.ftc.gov. Our sextortion playbook covers the first hour if it happens to your child.
Also moving this month
- Stickers on parking meters. The FTC warned on September 3 that scammers are covering legitimate QR codes on meters with their own. Businesses with their own signage should read our QR sticker guide.
- Farm equipment that does not exist. Fake equipment dealers are asking farmers for deposits or full payment, usually by wire, the FTC said on September 15. Our fake dealer breakdown has the checks.
- The robocall flood. Americans received about 4.3 billion robocalls in July 2026 alone, roughly 5.8 million an hour, according to YouMail figures cited by AARP.
- The reporting gap. In an AARP survey published this spring, only 14 percent of fraud victims said they reported it to the FBI or FTC. Reports are what alerts like these are built on.
For businesses: close the easy doors this month
October is Cybersecurity Awareness Month. CISA is running it under the banner “Securing the Next 250,” and the National Cybersecurity Alliance picked a theme that reads like advice: “Don’t Make It Easy for Them.” Its four habits are a password manager, multifactor authentication, recognizing and reporting scams, and updating software. They are the right four, and they still leave a gap.
On September 1 the FBI warned about OAuth consent phishing. Instead of stealing a password, the attacker gets an employee to click Accept on a malicious app that asks for access to mail or files. That access skips the password and MFA entirely, and it survives a password reset until someone revokes the app. Ask whoever runs your Microsoft 365 or Google Workspace two questions this week: can employees approve third-party apps on their own, and when did anyone last review which apps already have access? Our guide to device code phishing covers a close cousin that also walks past MFA.
Two more items for October. Clinics and dental offices should brief the front desk on the medical license script above, since those callers often reach staff first. And the invoice problem persists: business email compromise cost $3.05 billion of the $20.9 billion reported to IC3 in 2025. Confirm any change to payment details by calling a number you already had, never one in the email. Our vendor email compromise guide and help desk vishing playbook have the procedures.
The pattern underneath
Every scam in this report borrows something real: an agency’s name, an enrollment deadline, a retailer’s logo, a relative’s voice. So judging by appearance keeps getting harder. A better question is who started the conversation. If they reached you first and the next step involves money, a login, or secrecy, the safe move is to leave their channel and open your own.
Practice beats panic.
ScamDrill sends safe, realistic fake texts, voicemails, and emails to your family or your team on a rotating schedule, tuned to the scams trending right now. When someone clicks, they get a teachable moment instead of a real loss.
Start a free drill →Three questions to ask out loud this week. What would you do if a caller said there was a warrant out for you? Where would a parent click to compare Medicare plans? Who in your business can approve a new app’s access to company email? Any “I’m not sure” is the drill to run.
Sources: FBI IC3 PSAs on government impersonation (Sept 17, 2026) and OAuth consent phishing (Sept 1, 2026); FBI IC3 2025 Internet Crime Report; FTC 2025 Consumer Sentinel data (March 25, 2026) and social media Data Spotlight (April 27, 2026); FTC consumer alerts on parking QR codes (Sept 3), farm equipment impersonators (Sept 15), open enrollment health insurance scams (Sept 28) and deepfakes and the Take It Down Act; SSA OIG scam alert (Sept 21, 2026); AARP on recall scams (Sept 24), voice cloning (Sept 28), robocalls, and its 2026 fraud survey; Amazon scam trends and Prime Big Deal Days (2026); National Cybersecurity Alliance and CISA; CMS enrollment dates.