GAO’s covert test still cleared most fictitious identities
GAO created 20 fictitious identities for federal Marketplace testing in plan years 2024 and 2025. All four applicants submitted in October 2024 received subsidized coverage. For 2025, 18 of 20—90%—remained actively covered as of September 2025, carrying more than $10,000 a month in advance premium tax credits.
The test is deliberately illustrative. GAO says it cannot be generalized to the full enrollee population, so the 90% rate is a control test result, not an estimate that 90% of real enrollments are improper.
| Measure | Plan year 2023 | Plan year 2024 / 2025 |
|---|---|---|
| Fictitious applicants covered | Not tested in this phase | 4 of 4 for 2024; 18 of 20 active for 2025 |
| SSNs used for more than one year of APTC coverage | More than 29,000 | Nearly 68,000 in 2024 |
| Applications with likely unauthorized changes | At least 30,000 | At least 160,000 in 2024 |
| Latest CMS fraud-risk assessment | 2018 | Still not updated in GAO review |
Two broader warning indicators accelerated
GAO identified more than 29,000 Social Security numbers in plan year 2023 and nearly 68,000 in 2024 that were used to receive more than one year of subsidized coverage within a single plan year. Using the reported endpoints, that is an increase of roughly 39,000, or about 134%.
Applications with likely unauthorized agent or broker changes rose from at least 30,000 to at least 160,000—an increase of at least 130,000, or about 433%. CMS implemented a control in July 2024, and GAO said its ongoing review was assessing the change.
$21 billion unreconciled is not a $21 billion fraud finding
GAO could not identify evidence of tax reconciliation for more than $21 billion in 2023 advance credits tied to enrollees who provided Social Security numbers. GAO expressly cautioned that unreconciled credits may have gone to eligible people and are not automatically overpayments.
CMS also told GAO that it permits multiple enrollments per Social Security number so a legitimate holder can obtain coverage despite identity theft or data-entry errors. That is relevant counterevidence: the flags identify records needing review, not proven fraud.
Method, status and limitations
The newsroom recalculated the year-over-year changes from GAO’s preliminary counts and kept covert-test results separate from the population-wide data analysis. GAO compared enrollment records with death and tax data and assessed CMS documentation against federal fraud-risk practices.
The report was published December 3, 2025 and remains preliminary. GAO made no recommendations in this product because the work was ongoing. Counts described as ‘over,’ ‘nearly’ or ‘at least’ remain approximate and should not be converted into exact case totals.