It began with a letter. An official-looking one. They even went to trouble of laminating it (nice touch). When you open it, it said that good 'ol Medicare was issuing chip-enabled cards for 2026 and that recipients needed to call a number to "activate" theirs. All they needed was their Medicare number.
That's the setup. What comes next is worse.
On May 8, Mendocino County, CA sheriff's deputies got a call at 11:43 p.m. from a couple in Willits, CA who believed their home was under surveillance and their devices had been compromised.
Oh, one other thing: They had just handed over nearly $100,000.
They hadn't been robbed at gunpoint. They'd been walked, step by carefully scripted step, through one of the most sophisticated impersonation con jobs in circulation right now.
Those four steps? Here's how they played out...
Before the Letter Even Arrives: Social Media
What most victims never realize is that the scam started long before anyone contacted them directly.
Nearly 30% of all consumer scam losses in 2025 originated on social media, totaling $2.1 billion — an eightfold increase since 2020, according to the FTC. And with 88% of Baby Boomers active on Facebook, older adults are disproportionately exposed.
Lynette Owens, VP of Consumer Education and Marketing at Trend Micro, says the scam likely started long before the letter arrived.
"Scammers can study behavior, interests, and relationships, then build highly personalized scams that feel natural — and AI is helping them do this at scale."
She calls the multi-channel approach "platform hopping" — moving targets across texts, apps, and websites to build trust before money is ever at stake.
ACT ONE: The Medicare Letter
The Medicare chip card pitch arrives as laminated mail, a phone call, or an email. The message is always urgent: Medicare is upgrading to chip-enabled cards for security. Provide your Medicare number to receive yours.
What makes this effective in 2026 is that Medicare did make real changes to Part D coverage this year. Scammers are exploiting that real news to make the fake upgrade feel timely.
The rule: Medicare will never contact you asking for your Medicare number to activate or verify anything. If you get this contact, hang up and call Medicare directly: 1-800-633-4227.
Smart Senior Daily Staff
ACT TWO: The Microsoft Pop-Up
Days or weeks later, a pop-up fills the victim's screen with an alarm sound: SECURITY ALERT — YOUR COMPUTER HAS BEEN COMPROMISED. Call Microsoft Support immediately.
The Willits couple called the number. The man who answered was calm and professional. He said their laptops contained viruses, illegal material, and evidence of criminal activity. They were now part of a federal investigation. He needed remote access to their computers to document the evidence.
They gave it to him.
What's actually happening: That pop-up is fake. Microsoft would never send out unsolicited warnings with phone numbers. No legitimate tech company would. But, once you give a scammers remote access, they can see your banking information and easily set up the next phase.
Gary P Guthrie
ACT THREE: The Federal "Investigator"
The fake Microsoft rep transferred the couple to a colleague — called him an "FTC investigator" with a badge number and everything. Hen, then, explained they were persons of interest in a federal money laundering case. Not arrested yet. But they needed to cooperate. And stay silent.
Don't tell your bank why you're withdrawing money. Don't tell your family. The investigation could be compromised.
What's happening: That instruction to stay silent is the cruelest part of this script and the single most important deal-sealer to a scammer because it isolates victims from everyone who might stop them. If anyone ever calls you and starts asking questions like this, call a friend, a relative, your bank – somebody – who might shake you and wake you from this nightmare.
Gary P Guthrie
ACT FOUR: The Fake Chase Rep
A third caller identified himself as a Chase fraud specialist. He walked them through withdrawing cash and packaging it. A stranger came to their door and collected $23,000. They were then told to mail a $73,000 cashier's check to a Brooklyn address.
Detectives, working fast with local businesses and banks, intercepted the cashier's check and returned the money before it was cashed. The $23,000 was not recovered, however. The investigation is ongoing.
Gary P Guthrie
A Few Things to Do Before Anything Else
At the risk of being redundant, whether it's a Medicare letter, a Microsoft pop-up, or a call from anyone claiming to be a government agency or your bank:
- Don't call the number in the message. Look up the official number yourself. Medicare: 1-800-633-4227. FTC: 1-877-382-4357. Your bank: the number on the back of your card.
- Tell someone. The moment a caller creates urgency — your account will be closed, you'll be arrested, act now — that's also the script." Urgency is the other universal scam lever.
- Close the pop-up — don't call the number. Hold down your power button to shut the computer off. It won't damage anything. When you restart, the pop-up will be gone. Important: Save anything important first if you can, but if you can't, the pop-up is the bigger problem.
- Never pay with gift cards, wire transfer, or crypto. No government agency, no legitimate tech company, and no real bank will ever ask you to pay a debt or fee this way. Ever. If someone does, the call is over. This is arguably the single most actionable scam-stopper there is.
If You've Already Been Hit
- Gave your Medicare number? Call 1-800-633-4227 to flag your account.
- Gave remote computer access? Disconnect from the internet and take it to a trusted tech professional before using it again.
- Transferred money? Call your bank immediately — speed matters.
- Report to the FTC at reportfraud.ftc.gov and the FBI at ic3.gov.
For free support, AARP's Fraud Watch Network helpline is available at 1-877-908-3360.
Sources: Mendocino County Sheriff's Office; FinanceBuzz; Federal Trade Commission; AARP Fraud Watch Network
