GAO Report Exposes Widespread Vulnerabilities in ACA Premium Tax Credit Program

Introduction

In 2024 alone, the Centers for Medicare & Medicaid Services (CMS) paid out nearly $124 billion in advanced premium tax credits (APTC) to about 19.5 million enrollees. Despite this astronomical dollar amount, CMS has been shown to have very weak fraud prevention measures.

This was highlighted by a report from the Government Accountability Office (GAO), detailing massive fraud in the Federal Marketplace’s issuing of advanced premium tax credits.

The report stated that nearly a third of enrollees that provided Social Security numbers through the Federal Marketplace cannot be reconciled with IRS tax records, amounting to $21 billion of subsidies.

Additionally, GAO conducted two separate experiments, where they attempted to enroll fictitious applicants into the Federal Marketplace for subsidized coverage using falsified information and documents.

In the first experience, GAO submitted four fictitious applicants in October of 2024. All four applicants were approved for enrollment and were receiving subsidies into late 2024.

The second experiment entailed submitting 20 fictitious applicants for the 2025 enrollment cycle. So far, 18 of these applicants have been approved and are receiving subsidies.

What is APTC, and how does enrollment work?

Advanced premium tax credits are subsidies given to American consumers under the Patient Protection and Affordable Care Act. These subsidies are “advanced” as they are paid directly from the government to health insurers. The goal of APTC is to lower out-of-pocket premium costs for American consumers who are on private health insurance plans.

In order to receive APTC, consumers must enroll in the Federal Marketplace, which will look at income levels in order to determine eligibility.

An applicant must meet these requirements to be able to enroll in a health insurance plan in the Federal Marketplace and receive subsidies: be a U.S. citizen or lawfully present, reside in the Marketplace area, not be incarcerated, meet household income requirements, and not be eligible for minimum essential coverage through an employer or government-sponsored program.

Some states have their own marketplaces that applicants can enroll through. However, other states, such as Wisconsin, only have the option of enrolling through the Federal Marketplace, which is the one we will be focusing on today.

The Federal Marketplace is overseen by the Centers for Medicare & Medicaid Services (CMS) and the Department of Health and Human Services (HHS).

There are three pathways of enrolling into the Federal Marketplace. One of those ways is by just applying directly through healthcare.gov. Another way is by enrolling through an approved non-Marketplace website that then directs you to healthcare.gov to complete your application. However, CMS just ended this pathway. The last way is through an approved non-Marketplace website that does not redirect you to healthcare.gov at any point.

Insurance brokers can also be used in the enrollment process to help consumers more easily complete their applications. Insurance brokers must be licensed and approved by CMS and are required to make documentation of consumer consent available to CMS upon request in response to monitoring, audit, and enforcement actions.

Synopsis of the Studies

The GAO’s first study was conducted in 2024, where they submitted four fictitious applicants to enroll in the Federal Marketplace and receive APTC for the 2024 plan year. GAO put down invalid Social Security numbers, used counterfeit documents for proof of identity, and put down an income level that would qualify for APTC.

Two applied directly through healthcare.gov, and two were done via telephone through insurance brokers.

For the two fictitious applicants using insurance brokers, GAO states that they were not asked to submit documentation to verify the applicants’ identities for enrollment.

Moreover, in both cases, the insurance brokers called the Marketplace Call Center without the “applicants” present and successfully submitted the application with invalid Social Security numbers. This despite the fact that the system used by the brokers to assist GAO’s applicants flagged both Social Security numbers as “unverified.”

On the Marketplace's end, they never requested documentation showing proof of citizenship or estimated income for one of the applicants. For another applicant, the Marketplace never requested documentation showing proof of a valid Social Security number.

In the last two cases, the Marketplace did request the applicants to submit further documentation to support each applicant’s Social Security number, citizenship status, and estimated income. However, GAO never submitted the additional documentation, and both were eventually approved for enrollment and subsidies anyway.

The end result was that all four fictitious applicants were enrolled in the Federal Marketplace and received payouts for their APTC subsidies, totaling $2,350 per month.

To further investigate CMS’s ability to detect fraudulent applicants, GAO decided to conduct a larger experiment with 20 fictitious applicants in the 2025 plan year.

So far, 18 of these 20 applicants have been approved for coverage and are receiving subsidies. The investigation is still ongoing.

However, CMS did cancel coverage for one of the 20 applicants after GAO failed to submit the requested documentation to prove citizenship status.

Potential Weak Points in CMS Fraud Accountability:

From the study, one clear weak point in CMS’s fraud prevention is its tendency to enroll applicants, even when they do not send in proper proof of documentation.

Even when GAO failed to submit documentation requested by CMS to prove income, citizenship, and a valid Social Security number, CMS still ended up approving the applications.

Another issue in enrollment fraud surrounds the role of insurance brokers and the poor incentive structure that surrounds them. While insurance brokers cannot receive monetary compensation or commission from the Marketplace or CMS, they often do receive commission from qualified health plan insurers.

This means that insurance agents and brokers have an incentive to maximize enrollment and could possibly submit applications with “red flags” or lack of proper documentation in order to receive a higher compensation.

Another issue that GAO touched on in their report surrounds the use of invalid Social Security numbers.

People who are enrolled in the Federal Marketplace and receive APTC must reconcile their subsidies when filing for their taxes every year in April. This is to ensure that they were receiving the correct amount of subsidies from the government based upon their income.

A valid Social Security number is required in order to complete tax reconciliation. However, when sifting through IRS tax data, GAO could not find proof of reconciliation for over $21 billion paid out in advanced premium tax credits. This accounts for approximately 32% of APTC paid to enrollees that provided their Social Security number through the Federal Marketplace.

One likely reason for the lack of proof of reconciliation is that APTC receivers are just simply forgetting or choosing not to reconcile their subsidies. However, there are two other possible, more troubling, reasons that this could be happening.

The first one being that the enrollee used a Social Security number that did not belong to them. GAO did a preliminary analysis and found that over 29,000 such Social Security numbers received more than 365 days of insurance coverage with APTC for the plan year 2023.

One Social Security number used for the plan year 2023 even received subsidized insurance coverage for over 26,000 days across 125 insurance policies. This means that enrollees received over 71 years of coverage in just one year, from a single Social Security number.

Situations where a Social Security number is linked to receiving more than 365 days of coverage in a single plan year can be due to either data entry error or identity fraud.

Another reason for the lack of proof of APTC reconciliation could be that enrollees are using Social Security numbers that belong to individuals that have been determined to be deceased by the Social Security Administration (SSA). GAO identified over 58,000 Social Security numbers that were receiving APTC in plan year 2023 but which also belonged to deceased individuals.

CMS says that they do not automatically terminate enrollment and subsidies when there is a death match with SSA data to prevent unjust terminations and give enrollees a chance to appeal should the information from SSA be incorrect.

Potential solutions

There are a few solutions that CMS could implement to strengthen fraud prevention and limit improper payments to fraudulent applicants.

First off, GAO recommends that CMS implement enhanced data-matching procedures by submitting all enrollment data to one single data-matching system. This would allow for routine, large-scale detection of discrepancies such as death records and duplicate enrollments.

Secondly, GAO recommends that CMS either resolve all matches found in the data-matching system or terminate coverage as appropriate.

Conclusion

GAO’s findings reveal systematic weaknesses in one of CMS’s largest and most expensive programs. With over $120 billion being paid out per year in advanced premium tax credits, it is reasonable to expect robust safeguards to prevent fraudulent applicants from receiving taxpayer-funded subsidies.

The fact that fictitious applicants, who submitted falsified documents and invalid Social Security numbers, were able to be approved for enrollment and receive subsidies underscores how easily the current system can be exploited.

While lawmakers in Washington currently debate the future of enhanced premium tax credits, it is crucial that they also look at the system that implements them. Meaningful reforms, such as routine data matching, would prevent widespread abuse and restore public trust and transparency in the program.