Scam Trends, September 2026: The Second Scam, Cloned Storefronts, and the Medicare Countdown
September runs on lists. Fraud crews buy and resell the names of people who already paid a scammer, then call back offering to recover the money for a fee. Medicare enrollment opens October 15, so the impersonation calls arrive weeks before any real plan may pitch you. Add AI-built clones of real storefronts, a fall hiring wave, and a giving season fraudsters raise money off. One rule handles most of it: nobody who contacts you first gets paid up front.
Last month’s report followed the back-to-school calendar and holds through the first weeks of term. September differs in one way that matters. August’s scams borrowed a deadline everyone knew about; several of this month’s borrow something more personal, like a loss you already took, a birthday that put you on Medicare, or a car you have hunted since spring. The backdrop: about $16 billion reported lost to fraud in 2025, the highest on record, $3.5 billion of it to imposter scams alone, per FTC data released in June.
The second scam, and the list you are already on
An FTC alert on August 3 got less attention than it deserved, and it describes the cruelest con in circulation. Refund and recovery scammers buy lists of people who already lost money, on the theory that those people can be taken again. To sound credible they claim to be a government agency, sometimes the FTC itself, or a consumer group, or a law firm handling recoveries. The pitch: your money is retrievable, and all that stands in the way is a retainer, a processing charge, or your bank details so the refund can be deposited.
Pay and that money is gone too. Hand over the account and the identity theft starts. This works not because victims are gullible but because official channels are slow, so a confident voice offering to fix things reaches someone who badly wants them fixed.
Two facts end every version. Nobody who contacts you out of the blue can recover your money for a fee, and no legitimate organization asks for payment or financial details in exchange for a refund. Search any name you are given alongside the word scam, using contact details you looked up yourself.
If the caller says they are the FTC
That is the scam. The FTC does not call consumers about refunds, demand money, or ask you to move funds to protect them, and neither does anyone claiming to run a recovery program on its behalf.
If someone in your family has already paid a scammer, warn them before the recovery pitch arrives. Our guide to recovery scams has the script, the first 60 minutes after a scam has what actually helps, and the FBI IC3 version covers the one wearing a federal badge.
Medicare opens October 15, so the calls start now
Open enrollment for 2027 Medicare coverage runs October 15 to December 7, and more than 70 million people are enrolled. Here is the detail almost nobody knows, and it turns a vague suspicion into a clean test: plans and agents may not market next year’s offerings before October 1. An unsolicited September call about your 2027 plan is therefore a marketing violation or a scam, and the difference is academic from where you sit.
The scripts barely vary. A new Medicare card is being issued and they need your number. Your benefits are being updated. A flex card with money on it is waiting. You are owed a refund on recent medical bills. Every version wants the Medicare number, and the ambitious ones want a bank account too.
The dollar figures explain the effort. In 2025 people reported losing nearly $1 billion to business impersonators, with bank impersonators taking the largest share, and about $920 million to government impersonators, up from $866 million and $789 million the year before. Older adults carry a disproportionate share: the FBI logged more than $7.7 billion in losses from victims aged 60 and over in 2025, a 37 percent jump, averaging above $38,000 each.
One sentence to give a parent
“I don’t take plan calls. I’ll call 1-800-MEDICARE myself.” It ends the call without an argument and costs nothing if the caller was real. For the wider check-in, see how to protect elderly parents and read their statements.
Storefronts that were never there
On September 1 the FTC warned that scammers are cloning car dealership websites, frequently with AI, copying logos, listings, and photography down to the detail and adding invented testimonials for texture. The bait is often a rare muscle car or a hard-to-find classic. Buyers pay up front, drive to the dealership, and find no order, no payment, and no car. Two weeks earlier the agency flagged the search-engine version: paid ads can put an impersonator above the real bill-pay page, so you pay a stranger for a bill you still owe. Social feeds are no safer, since platforms do not thoroughly vet the ads or the advertisers behind them.
The common defect is that looking legitimate has stopped being evidence, because a model can build a convincing storefront in an afternoon. What works is friction a fake cannot survive. Search the seller’s name with the word scam attached. Ask to see the merchandise and the premises in person, or hire a mobile inspection service. Walk away from anyone who insists on a wire transfer. For bills, skip the search box and type the address you know. Our piece on AI-driven phishing covers how cheap this tooling got, and our link checker shows where a link really goes.
Fall hiring, and the jobs that are not jobs
Seasonal listings go up in September, well before the holiday rush, and scammers post alongside the real ones because the volume gives them cover. Warehouse work, retail shifts, and remote customer service are the usual costumes, and the biggest brands get impersonated most because their names persuade for free. Two mechanics do most of the damage. In the check version, a new employer sends a check to cover equipment you must buy from a named vendor. It clears on paper, bounces days later, and the bank claws the money back while the vendor payment is gone. In the reshipping version, packages arrive at your home and you forward them, which makes you the last visible link in a chain of goods bought with stolen cards. One rule catches both, and the task-scam variant too: a real job never asks you to pay to get paid, and a real employer never needs your bank login. Our fake remote job playbook covers hiring fraud end to end, and our guide to micro-task scams is the one to forward to a student.
Giving season, and a quieter storm season
September is National Preparedness Month, and FEMA’s 2026 theme is “Americans Stand Ready.” The Atlantic is cooperating: heading into the climatological peak around September 10, NOAA held its below-normal outlook at 7 to 13 named storms and no more than 2 major hurricanes, with El Niño shear and Saharan dust doing the suppressing. A quiet hurricane season is not a quiet season for disaster fraud, though, because the fundraising is global. The FTC’s August 27 alert pointed at appeals tied to flooding in Nepal and Tibet and earthquakes in Venezuela, Japan, and Colombia. Fake charities appear within hours and want an irreversible payment while the images are fresh. Check any appeal through Charity Navigator or the BBB Wise Giving Alliance first, and treat a request for gift cards, wire, or crypto as disqualifying. A real charity will still be there tomorrow. And FEMA never charges a fee to apply for or receive aid; its helpline is 800-621-3362.
Also moving this month
- Packages nobody ordered. The FTC flagged brushing again on August 20. A free parcel usually means a seller is writing fake reviews under your name. See our brushing scam guide, and never scan the QR code in the box.
- A postcard for veterans. Veterans are getting mail about extra monthly benefits under a “Veterans Savings Program” that does not exist.
- Tax debt relief before October 15. With the filing extension deadline close, offers to settle back taxes for pennies on the dollar are circulating again. Firms that charge before reviewing your situation leave people deeper in the hole than they started.
For businesses: the invoice is still the weapon
The FBI’s Internet Crime Complaint Center took 1,008,597 complaints in 2025 and tallied $20.9 billion in losses, up 26 percent. Business email compromise took $3.05 billion of that, second only to investment fraud, and it stays the most expensive thing that happens to companies nobody was targeting in particular.
September raises the odds for a mundane reason. Fourth-quarter planning starts, renewals and purchase orders cluster, and seasonal hires arrive with paperwork that has to move fast. A fraudulent invoice blends into a busy payables queue, and an email changing a vendor’s bank details looks like one more piece of admin. New hires open the payroll window too, since a direct-deposit change from a face nobody knows yet is hard to challenge.
Three free controls cover most of the exposure. Verify any change to payment or deposit details on a number you already had, never one from the message. Require a second approver above a dollar threshold you pick. And give the help desk a written identity rule, so a caller cannot talk past MFA by sounding senior and stressed. Specifics live in our guides to vendor email compromise, payroll diversion, and help desk vishing.
The pattern underneath
Strip the costumes off and every item above uses the same three parts: contact you did not ask for, a reason to move quickly, and a payment or credential that cannot be walked back. Remove any one and the con stops working, and the cheapest to remove is the first. Hang up, look the number up yourself, call back on a channel you chose. Scammers need to stay inside the conversation they started, so breaking it beats any amount of red-flag spotting.
Practice beats panic.
ScamDrill sends safe, realistic fake texts, voicemails, and emails to your family or your team on a rotating schedule, tuned to the scams trending right now. When someone clicks, they get a teachable moment instead of a real loss.
Start a free drill →Ask three questions out loud this week. What would you say to a caller offering to recover money you lost? What would a parent on Medicare do with a September call about next year’s plan? How would your bookkeeper verify a vendor’s new bank details? Rehearsed answers are the ones people reach for under pressure.
Sources: FTC press release on 2025 imposter-scam data (June 15, 2026); FTC consumer alerts on recovery scams (Aug 3), social ads (Aug 10), tax debt relief (Aug 13), bill-pay impersonators (Aug 17), brushing (Aug 20), the veterans postcard (Aug 24), disaster donations (Aug 27) and cloned dealership sites (Sept 1, 2026); FBI IC3 2025 Internet Crime Report; CMS Medicare enrollment data and dates; NOAA 2026 Atlantic hurricane outlook; FEMA National Preparedness Month 2026.