GAO Found $21 Billion in Unverified ACA Subsidies. Here's What That Means for You.

Last year, the Government Accountability Office created 20 fake people and applied for taxpayer-subsidized health insurance on the ACA marketplace. Nineteen were approved. Eighteen were still collecting your tax dollars when the GAO last checked, five months ago.

That is the state of ACA subsidy fraud prevention in the United States. Fabricated identities with unverifiable Social Security Numbers sail through verification and remain enrolled for years. The system is not catching them. Routine controls are not stopping the payments.

The GAO's December 2025 report is the most detailed accounting yet of how the Affordable Care Act's premium tax credit program---which distributed an estimated $124 billion to insurers in plan year 2024---operates with fraud controls that are outdated, unenforced, or simply absent. (Source: GAO-26-108742)

Here is what the report found, what Congress is doing about it, and what it means for your premiums.

What the GAO Report Actually Found

The report---GAO-26-108742---has a title only a government agency could write: "Preliminary Results from Ongoing Review Suggest Fraud Risks in the Advance Premium Tax Credit Persist." Published December 3, 2025, with a companion testimony (GAO-26-108811) delivered to the House Judiciary Committee the same day. The title epitomizes the phrase 'burying the lede'. (Source: GAO-26-108811)

$21 Billion With No Verification

GAO's preliminary analysis of tax year 2023 data could not identify evidence of reconciliation for over $21 billion in advance premium tax credits (APTC)---approximately 32% of total APTC paid on behalf of enrollees who provided Social Security Numbers to the federal Marketplace that year.

Reconciliation means filing a tax return with IRS Form 8962, which compares the subsidies you received against the subsidies you were actually entitled to based on your real income. Skip that step, and the government has no way to verify whether the correct amounts were paid---or whether the enrollee was a real person.

A critical distinction: "Unreconciled" does not automatically mean "fraudulent." Some of these enrollees may have been legitimately eligible but simply did not file tax returns. Others may have experienced income changes that would have required repayment. The point is that nobody knows. Not CMS. Not the IRS. Not the insurers collecting the payments. Twenty-one billion dollars, and the verification system is a shrug.

The Fictitious Applicant Test

The GAO did not just analyze data. They tested the system themselves---creating fictitious identities and submitting applications for subsidized ACA coverage across two plan years.

Plan year 2024: GAO submitted 4 fictitious applications in October 2024. All 4 were approved---a 100% approval rate. CMS paid approximately $2,350 per month in APTC for these fictitious enrollees in November and December 2024.

Plan year 2025: GAO submitted 20 fictitious applications. 19 were approved. As of September 2025, 18 fictitious enrollees were still actively covered, receiving combined APTC of over $10,000 per month in taxpayer-funded subsidies.

These applications used fake Social Security Numbers, unverifiable identities, and fabricated income claims. The Marketplace frequently did not request documentation---and when it did, it approved coverage even when the submitted documents were internally inconsistent or not credible.

GAO notes that these results "cannot be generalized" to the broader program. Fair enough. But the implication is hard to miss: if federal investigators can create fake people and collect subsidies for over a year without triggering a single alarm, the system is not checking.

And this is not the first time. GAO ran the same test in plan years 2014 through 2016 and found the same vulnerabilities. A decade of warnings. The holes remain open.

Dead People Collecting Subsidies

You do not need to be alive to collect ACA subsidies. That is not editorializing. It is what the data shows.

GAO's analysis of plan year 2023 data found that SSNs on Marketplace applications matched Social Security Administration death records for over 58,000 individuals, resulting in approximately $94 million in APTC paid to insurers on behalf of households containing deceased enrollees. At least 7,000 of those individuals were deceased before their coverage even began.

The scale of apparent SSN misuse goes beyond deceased individuals. GAO found:

• One single SSN was used on applications for more than 125 insurance policies, totaling over 26,000 days of coverage. That is 71 years of continuous health insurance on one identity. The system let it continue.
• Nearly 68,000 SSNs in plan year 2024 received more than one year's worth of coverage---meaning the same identity was used for overlapping policies.
• Over 29,000 SSNs in plan year 2023 had the same problem.

These are not edge cases. They are what a program looks like when nobody is watching the door.

The Broker Problem: 275,000 Unauthorized Enrollments

Identity fraud is only half the problem. The other half comes from inside the system---the brokers and agents who are supposed to help consumers sign up for coverage.

In 2024, CMS received more than 275,000 complaints from consumers about unauthorized activity on their Marketplace accounts. Between January and August alone, approximately 183,000 people reported being enrolled in plans without their consent and approximately 90,000 reported having their plans changed without their consent.

GAO's own analysis identified approximately 160,000 applications in plan year 2024 with likely unauthorized broker changes---about 1.5% of all applications.

Why would a broker enroll someone without their knowledge? The usual reason. Brokers earn commissions from insurers for each enrollment. More sign-ups, more money. Some brokers discovered they could use consumer information obtained from other contexts to create or switch ACA enrollments, collect the commission, and the consumer would never know. If this sounds familiar, it should---it is the same scheme Wells Fargo employees ran when they opened millions of fake bank accounts to hit sales targets, except with health insurance.

CMS Suspended 850 Brokers. Then Reinstated All of Them.

Between June and October 2024, CMS suspended 850 agents and brokers for suspected fraudulent or abusive conduct. (Source: KFF Health News)

Then, in May 2025, CMS confirmed to the GAO that all 850 suspended brokers had been reinstated. Every single one. CMS provided no public explanation of what investigatory steps were taken before reinstatement or whether the brokers had remedied the conduct that led to their suspension. (Source: KFF Health News)

In June 2025, CMS quietly released an FAQ document related to the removal of more than 1,000 brokers from its suspension and termination list, with minimal explanation. (Source: KFF)

If you are a broker considering whether to commit enrollment fraud, here is your risk calculus: a temporary suspension, followed by full reinstatement, followed by no public explanation of what happened.

How This Happened: CMS's Fraud Prevention Gaps

When CMS last assessed the fraud risks in this program, it was distributing approximately $53 billion in subsidies. By plan year 2024, that number had grown to $124 billion. CMS never updated the assessment. The program more than doubled. The fraud controls stayed frozen. (Source: GAO-26-108742)

Here is the timeline:

November 2018: CMS completed a fraud risk assessment for the ACA marketplace program, identifying 27 specific fraud risks. (Source: GAO-26-108742)

2018-2025: CMS never developed a formal antifraud strategy based on those 27 identified risks. Seven years. No strategy. The assessment gathered dust while the program doubled. (Source: GAO-26-108742)

2021-2024: CMS paused enforcement actions based on IRS data for consumers who did not file tax returns and reconcile prior APTC. For four consecutive plan years, individuals who received subsidies but never filed taxes faced no consequences. The $21 billion in unreconciled subsidies accumulated during exactly this window. (Source: GAO-26-108742)

Tax year 2020: Separately, the American Rescue Plan Act suspended the requirement to repay excess APTC for tax year 2020---meaning even people who did file and owed money back did not have to repay it. (Source: IRS.gov)

Add it up: a $124 billion program running on a fraud risk assessment from when it was half that size. No formal antifraud strategy. Four years of paused enforcement. And identity verification so weak that people who do not exist can collect subsidies for over a year.

Congress Responds: 8 Insurers Subpoenaed

On February 10, 2026, House Judiciary Chairman Jim Jordan (R-OH), along with Representatives Scott Fitzgerald (R-WI) and Jeff Van Drew (R-NJ), issued subpoenas to eight health insurance companies for documents related to ACA marketplace fraud. (Source: House Judiciary Committee)

The eight subpoenaed insurers:

1. Blue Shield of California
2. Centene Corporation
3. CVS Health
4. Elevance Health
5. GuideWell
6. Health Care Service Corporation
7. Kaiser Permanente
8. Oscar Health

The subpoenas demand documentation of enrollee counts, subsidy amounts received between 2020 and 2025, fraud detection staffing, communications with regulators, and internal audits. The deadline for compliance was February 23, 2026. (Source: InsuranceNewsNet)

These subpoenas were necessary because the companies failed to fully respond to voluntary requests. Congress asked nicely. The insurers declined to answer. You can draw your own conclusions about what that suggests regarding their fraud-prevention efforts.

Legislative Response: The OBBBA

The One Big Beautiful Bill Act (OBBBA), signed into law by President Trump on July 4, 2025, includes several provisions targeting ACA subsidy integrity. (Source: King & Spalding)

Section 71305 eliminates caps on the IRS's recovery of excess APTC. Previously, repayment limits restricted how much the government could recoup when enrollees received more subsidies than they were entitled to. Starting with the 2026 tax year, individuals who misreport income must fully account for overpayments---with no cap on repayment. (Source: King & Spalding)

Section 71303 requires annual pre-enrollment verification of eligibility starting with plan year 2028. This ends the longstanding practice of allowing subsidized marketplace consumers to auto-reenroll without re-verifying income and eligibility. It also imposes a permanent APTC ban for individuals who failed to file taxes and reconcile in the prior year. (Source: King & Spalding)

These are meaningful reforms. They also do not take full effect until 2028. Two more years of the current verification gaps. Two more years of the same system that approved 19 out of 20 fake people.

What This Means for Your Premiums

This is not an abstract accounting problem. You are paying for it.

When ineligible people receive subsidies, every taxpayer absorbs the cost. When fraudulent enrollments distort the risk pool---adding fictitious or ineligible individuals to insurer rolls---it affects the actuarial calculations that set your premium rates. And when the system cannot verify whether $21 billion in subsidies went to the right people, the integrity of the program that millions of Americans depend on is undermined.

The timing makes this worse. As we documented in our analysis of ACA premiums jumping 21% in 2026, enhanced subsidies expired at the end of 2025. Real people saw premium increases of $85 per month or more. An estimated 4.8 million Americans lost marketplace coverage entirely.

Read that again. The system could not verify whether $21 billion in subsidies went to eligible people---but it did let the subsidies that kept real people insured expire right on schedule. Fake enrollees kept their coverage. Real ones lost theirs.

To be clear, eliminating fraud would not have prevented the subsidy expiration---that was a congressional decision. But the GAO's findings undermine public confidence in a program that needs it. When voters learn that fabricated identities collect subsidies while their own premiums double, the political will to fund the program erodes.

Then there are the insurers. The same companies subpoenaed by the House Judiciary Committee---CVS Health, Elevance, Kaiser Permanente, and others---collect billions in taxpayer-funded premiums. Every enrollment, real or fictitious, means revenue. Their financial incentive runs toward maximizing enrollment, not scrutinizing it.

This is the fundamental design flaw at the heart of the ACA marketplace: privatized profits with socialized risk, and no one minding the gap between them. The government assumed that market competition would constrain insurer behavior. The market assumed the government was overseeing its own money. Neither is true. The result is a responsibility vacuum where insurers collect guaranteed taxpayer revenue with little incentive to verify who they are covering, and a regulator that identified 27 fraud risks seven years ago and never built a strategy to address them. For more on the broader pattern of how health insurers take taxpayer money, see our hub article.

What You Can Do

Protect Your Own Enrollment

If you have ACA marketplace coverage, verify that your enrollment has not been tampered with. Log in to your HealthCare.gov account and confirm:

• Your current plan matches what you selected
• No unauthorized broker or agent is listed on your account
• Your income and household information is accurate
• You have not been switched to a different plan without your consent

If anything looks wrong, take action immediately.

Report Unauthorized Changes

If you were enrolled in a plan without your consent or had your plan changed without authorization:

1. Call the Marketplace Call Center: 1-800-318-2596 (24/7)
2. File a complaint: Through your HealthCare.gov account under "My Applications & Coverage"
3. Contact your state insurance commissioner: They can investigate broker misconduct
4. Document everything: Save screenshots, correspondence, and any records of unauthorized activity

You are a victim of fraud, not the perpetrator. CMS has processes to restore your correct coverage and investigate the broker involved.

File Your Taxes and Reconcile

If you received APTC, file your federal tax return with Form 8962. This is not just a legal requirement---starting with the 2028 plan year, failure to reconcile will permanently disqualify you from future subsidies under the OBBBA. (Source: King & Spalding)

Even if you fear you owe repayment, the new OBBBA provisions make it worse to avoid filing than to face the balance.

Understand Your Coverage Options

If rising premiums or subsidy changes have affected your coverage, explore your options:

• Review our guide on healthcare coverage options without employer insurance
• Understand what happened with ACA premiums in 2026 and what alternatives exist
• If you are paying more out-of-pocket, make sure every medical bill you receive is accurate---our tool can help identify overcharges

Demand Accountability

The GAO identified these vulnerabilities a decade ago. CMS has not fixed them. Congress is investigating, but investigations are not fraud controls. Contact your representatives and demand they:

• Fund real-time identity verification for ACA applications
• Require CMS to update its fraud risk assessment annually
• Hold insurers accountable for enrollment integrity
• Ensure the 2028 verification requirements are implemented on schedule

The ACA marketplace has helped millions of Americans access health insurance. That is exactly why its integrity matters. A program that cannot tell the difference between a real enrollee and a fabricated one is a program that is destroying the public trust it needs to survive.