A package labeled from the U.S. Department of Health and Human Services (HHS) is usually a routine Medicare or public health mailing — a Medicare card, the annual Medicare & You handbook, a prescription refill from a federal health program, or printed health guidance from an agency like the CDC. But scammers also impersonate HHS to ship unrequested medical equipment or genetic testing kits as part of Medicare fraud schemes, so if the package has no connection to any program you use, treat it as a warning sign rather than a benefit.
Routine Reasons a Real HHS Package Arrives
The most common sender behind an HHS-labeled package is the Centers for Medicare and Medicaid Services (CMS). When you first enroll in Medicare, CMS mails a welcome packet with your Medicare card. If you already receive Social Security benefits, the card arrives automatically about three months before coverage starts; if you signed up on your own, it usually arrives about two weeks after enrollment. The card shows your Medicare Number (not your Social Security Number), which parts of Medicare you have, and when your coverage begins.1Medicare.gov. Your Medicare Card
Every fall, CMS also mails the Medicare & You handbook to all Medicare households. Updated copies go out in late September so you can review changes before the annual open enrollment period opens in October.2Medicare.gov. Medicare and You These mailings go to the address on file with the Social Security Administration.
HHS is also the parent agency of the Centers for Disease Control and Prevention, the Office of the Surgeon General, and other public health divisions. These agencies sometimes send brochures, vaccination schedules, or health advisories directly to households, especially during outbreaks or emerging public health threats. You don’t have to sign up for them. These pieces are usually lightweight envelopes containing pamphlets, not boxes with products inside.
If you’re enrolled in a specialized federal health program, you may also receive medications or medical devices by mail as part of your care. The Indian Health Service runs a Meds by Mail program that ships prescription refills to enrolled patients.3Indian Health Service. Meds By Mail The Ryan White HIV/AIDS Program provides medications through its care networks. These shipments happen only after you’ve completed enrollment steps like signing a mail-order agreement and verifying your address.
Free COVID-19 Tests Are No Longer Mailed
Between 2021 and 2025, the federal government mailed free at-home COVID-19 tests to millions of households. HHS ended that program in mid-2025, stating the tests are widely available at retail stores. If a package arrives claiming to contain free government COVID-19 tests now, be skeptical — federal distribution is no longer active.
How to Tell a Real HHS Mailing From a Fake One
Official government mail carries a few consistent markers:
- Genuine federal mailings use a printed permit imprint rather than a stamp, and display the words “Official Business” and “Penalty for Private Use, $300” near the return address. This imprint is printed directly on the piece and is never rubber-stamped, typed, or handwritten.
- The agency name and return address are machine-printed.
- The package connects to something you already know about: a Medicare enrollment, a prescription refill you signed up for, a clinical trial you joined, or a public health campaign. If nothing about it lines up with a program you’ve used, that’s a red flag.
- A real HHS mailing never asks you to call a number to give your Social Security Number, bank information, or Medicare Number to “activate” a product. A card or flyer requesting that information is almost certainly a scam.
Scams That Use HHS-Style Packaging
Unsolicited Medical Equipment
One widespread scheme mails durable medical equipment — back braces, knee braces, urinary catheters, glucose monitors — to Medicare beneficiaries who never ordered anything.4Office of Inspector General. Consumer Alerts Scammers obtain your name and Medicare Number through deceptive phone calls, bill Medicare for expensive equipment, and ship you a cheap version. You may only notice when charges show up on your Medicare statements. Beyond the fraud itself, this can burn through coverage limits for equipment you actually need later.
Genetic Testing Kits
Fraudsters offer “free” genetic or DNA testing through telemarketing, health fairs, or door-to-door visits. If you share your Medicare Number, a cheek swab kit arrives in the mail and Medicare gets billed for a test that was never medically necessary or ordered by your doctor. If Medicare denies the claim, you could owe the full cost, which can run into thousands of dollars.5Office of Inspector General. Fraud Alert – Genetic Testing Scam The HHS Office of Inspector General warns: don’t accept a genetic testing kit unless your own physician ordered it.
Brushing Scams
In a brushing scam, a seller finds your name and address online, mails you a product you never ordered, and posts a fake positive review in your name. Some use medical-sounding products or government-style packaging to look official. An unexpected package from an unknown sender generally means someone accessed your personal information. The Federal Trade Commission recommends changing your online shopping passwords, monitoring your credit at AnnualCreditReport.com, and reporting the scam at ReportFraud.ftc.gov.6Federal Trade Commission. Got a Package You Didn’t Order? It’s Probably a Scam
What You Can Do With an Unordered Package
Federal law is on your side if merchandise arrives that you didn’t order. Under 39 U.S.C. § 3009, unordered merchandise sent through the mail may be treated as a gift. You can keep it, use it, throw it away, or give it away, and the sender cannot bill you or send demand letters.7Office of the Law Revision Counsel. 39 U.S. Code 3009 – Mailing of Unordered Merchandise You don’t have to return unsolicited medical supplies or testing kits. You should still report the shipment if you suspect fraud behind it.
How to Report It and Protect Yourself
If a suspicious package arrives and you think someone may have used your information to bill Medicare or another federal health program:
- Review your Medicare Summary Notice. If you have Original Medicare, check the MSN for services or supplies you didn’t receive, dates that don’t match your visits, or equipment you never ordered. If you have a Medicare Advantage plan, check your plan’s claims statements.8Medicare.gov. Protecting Yourself From Fraud
- Report Medicare fraud by calling 1-800-MEDICARE (1-800-633-4227) or filing online through Medicare.gov.9Medicare.gov. Reporting Medicare Fraud and Abuse
- Contact the HHS Office of Inspector General for fraud, waste, or abuse in any HHS program. File a complaint at oig.hhs.gov or call 1-800-HHS-TIPS (1-800-447-8477).10Office of Inspector General. Submit a Hotline Complaint
- For a brushing scam or general identity theft rather than Medicare-specific fraud, report it at ReportFraud.ftc.gov.
If your Medicare Number or other personal information may already be out there, take a few more steps. Log in to patient portals at your hospital, clinic, and doctors’ offices to look for treatments, diagnoses, or prescriptions that aren’t yours. If records aren’t online, request paper copies in writing — providers must respond within 30 days.11Federal Trade Commission. Identity Theft – Steps to Take After It Happens Notify your health insurer’s fraud department; for Medicare that’s 1-800-633-4227, and for Medicaid, contact your state Medicaid agency through Medicaid.gov. Check your credit report free at AnnualCreditReport.com, since medical billing errors from fraudulent claims can show up there. And change the passwords on your online shopping accounts, patient portals, and Medicare.gov account.