Bombshell, or bust? That’s the question hanging over a recent preliminary report from the Government Accountability Office about Affordable Care Act subsidy fraud.

The nonpartisan watchdog’s report (1), which dropped in early December, is based in part on findings from 2024 and 2025 during which time the Government Accountability Office (GAO) employed “fictitious applicants” to apply for the Affordable Care Act (ACA) advance premium tax credit (APTC) — a federal subsidy program that pays directly to insurance companies to help lower individual premiums on Marketplace plans.

They found that, in 2024, the Centers for Medicare & Medicaid Services (CMS) paid subsidies for all four of their fake applicants, totaling roughly $2,350 a month — despite some of those “applicants” failing to provide citizenship documentation or Social Security numbers (SSNs). In 2025 the GAO enrolled 20 fake applicants with the CMS — 18 of which still receive APTCs that combine for more than $10,000 a month.

In addition, the report found that a total of 29,000 SSNs received “more than one year’s worth of insurance coverage with APTC in a single plan year” in 2023, with another roughly 66,000 doing the same in 2024, meaning the same SSNs were used multiple times to receive benefits.

The findings also showed that brokers or insurance agents likely changed, without authorization, 30,000 or more coverage applications in 2023 and 160,000 in 2024, which “can result in consumer harm, including loss of access to medications.”

The GAO report was requested by three Congressional Republicans who released a statement (2) saying that it demonstrates “rampant waste, fraud, and abuse,” with Judiciary Committee Chairman Jim Jordan stating, that, “under Obamacare, hardworking Americans saw their premiums skyrocket and their health care choices shrink, all while fraud benefitted insurance companies.”

However, critics, as well as one of the report’s own authors, pushed back on that assertion, saying this preliminary report does not indicate rampant fraud — especially when viewed in the context of the wider health care system.

In an interview with KFF Health News (3), Seto J. Bagdoyan, one of the GAO report’s authors, cautioned that the findings only focus on “indicators of potential fraud” rather than conclusive evidence. And the report itself offers some important context to the big numbers that made headlines.

For example, the full 26-page preliminary report (4) specifies that the 30,000 applications affected by “unauthorized changes” in 2023, and the 160,000 in 2024, represent only 0.4% and 1.5% of all applications in those respective years.

And as for the duplicate SSNs, the roughly 29,000 from 2023 account for only 0.21% of all SSNs that received subsidies that year. The 66,000 duplicate SSNs in 2024 only accounted for 0.37%. Beyond representing less than 1% of all SSNs inputted, the report notes that the duplicates could also be a result of “data entry errors” and that further investigation is required.

“It really is trivial, the scope of fraud,” Lehigh University professor of health policy Michael Gusmano told CNBC about the report (5). “It’s just a scare tactic to justify the reduction of the federal government’s role in subsidizing health insurance.”

And Kaye Pestaina, director of KFF’s program on patient and consumer protection, noted in an email to CNBC that the “GAO report does not indicate that this is an outlier when compared to fraud in other federal programs.”

The report also says that the fraud risks it investigated were first examined between 2014 and 2016, with further assessments in 2018. Which means that this is an issue that’s potentially been known by multiple administrations, including President Barack Obama’s last term, President Donald Trump’s first term and President Joe Biden’s single term.

To that end, Bagdoyan told KFF (3) that the evidence shows any anti-fraud measures taken in the interim haven’t worked, “because we encountered the same issues as 12 years ago, having to do with identity verification.”

And one Democrat — Rep. Lloyd Doggett of Texas — responded to the report with a letter (6) that noted “CMS suspended 850 agents and brokers for suspected fraudulent or abusive conduct related to unauthorized enrollments or plan switches” last year. In May of this year, however, under President Trump, CMS reinstated the suspended agents, with Doggett adding that, “Yelling ‘fraud’ while empowering criminals solves nothing and will harm many.”

Overall, it’s believed that health care spending will total more than $5 trillion in 2025 (7), while the National Health Care Anti-Fraud Association (NHCAA) estimates that fraud costs taxpayers between 3% and 10% of the health care budget in any given year (8). As such, even though many experts feel that the GAO report isn’t the fraud smoking gun some politicians made it out to be, they agree that changes to the system are necessary.

Johns Hopkins Bloomberg School of Public Health professor Gerard Anderson told CNBC that while fraud attempts are inevitable, “you should always tweak the parameters of the system” to try and prevent it. Health policy expert Nick Fabrizio told the news outlet that extending ACA subsidies while implementing tools to prevent fraud is the best way forward.

“We’re in one of those situations where we have to extend the subsidies,” Fabrizio said. “But we have to stabilize the system. … We have to meet somewhere in the middle.”

Read More: Vanguard reveals what could be coming for U.S. stocks, and it’s raising alarm bells for retirees. Here’s why and how to protect yourself

Even though the scale of health care fraud in the GAO report is comparatively minimal, it won’t feel so insignificant if you fall victim to unscrupulous actors who steal your personal information. There are simple ways, however, to protect yourself.

To start, never share your SSN or any medical health account or password information with anyone unless you are certain they are your provider. Healthcare.gov (9) specifically recommends only getting your health coverage information from official government sources or websites, remaining vigilant for red flags, like health care contest giveaways, that could be scams, and always verifying the identity of anyone who claims to be a health coverage rep.

The NHCAA, meanwhile, urges people to remain informed about their policies and entitlements, while also regularly reviewing statements from their provider to ensure that they, in fact, did receive the benefits they’re billed for (and question those that look suspicious!).

And insurance provider Network Health (10) warns that you should never sign any blank insurance forms, and that you should always monitor financial statements “for any improper billing activity or fraudulent withdrawals.” As well, they recommend keeping your own records of all your appointments and services received in the event that any discrepancies arise.

If you do suspect that you’ve been a victim of health care fraud, reach out to your provider, the Federal Trade Commission’s fraud reporting portal, local authorities or, for Medicare-related matters, call 1-800-MEDICARE (1-800-633-4227).

We rely only on vetted sources and credible third-party reporting. For details, see our editorial ethics and guidelines.

Government Accountability Office (1), (4); United States House Committee on Ways and Means (2); KFF Health News (3), (7); CNBC (5); Doggett.gov (6); National Health Care Anti-Fraud Association (8); Healthcare.gov (9); Network Health (10)

This article provides information only and should not be construed as advice. It is provided without warranty of any kind.