Loading story…
Fraudsters are impersonating Molina Healthcare through spoofed phone calls, text messages, and emails in an effort to steal personal and financial information from members. Reported lures include fake notices about denied overseas medical claims, bogus child assessments or home-visit requirements, threats that coverage will be canceled immediately, and deceptive offers to switch health plans targeting Medicaid and Hawki recipients.
Victims are being told to distrust caller ID and avoid sharing sensitive data such as passports, Social Security numbers, or banking details in response to unsolicited outreach. Anyone targeted is being urged to verify communications through official Molina channels and to report incidents to Molina, the FBI Internet Crime Complaint Center (IC3), the FTC, and their financial institutions if account information may have been exposed.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
An article warns of active scams in which fraudsters impersonate Molina Healthcare through spoofed phone calls, texts, and emails to steal personal and financial information. Reported lures include fake overseas medical claims, bogus child assessment requirements, coverage-cancellation threats, and deceptive plan-switching targeting Medicaid or Hawki recipients.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A wave of impersonation scams is targeting individuals through phone calls and text messages, with fraudsters posing as debt collectors, tax agencies, law enforcement, and government departments. Victims report receiving unsolicited communications threatening legal action, arrest, or suspension of licenses unless immediate payment or personal information is provided. Tactics include aggressive language, urgent demands, and the use of official-sounding names or references to government codes to increase credibility. Notable examples include calls from entities like "Champion Strategy Holdings" and "Tax Solutions," as well as text messages purporting to be from the Florida Department of Highway Safety and Motor Vehicles (FLHSMV), all leveraging fear of legal consequences to coerce compliance. Authorities and cybersecurity experts warn that legitimate agencies do not demand payment or sensitive information via unsolicited calls or texts, nor do they threaten arrest or license suspension without due process. Individuals are advised to verify any such claims through official channels, avoid clicking on suspicious links, and never provide personal or financial information in response to these threats. The prevalence and sophistication of these scams highlight the ongoing need for vigilance and public awareness to prevent financial loss and identity theft.
Jul 1, 2026
Fraudsters are running a broad IRS impersonation campaign through robocalls, voicemails, texts, and emails that use fake names such as **Tax Mediation and Abatement Office**, **Tax Resolution Service Office**, **Taxpayer Abatement Assistance Office**, **American Tax Advocates**, and **American Tax Benefits**. The messages claim the target has unresolved tax issues, a file in "final review," frozen accounts, missed filings, or access to penalty relief or refunds, then pressure them to call back numbers including `888-355-0728`, `888-753-0127`, `888-663-0866`, `888-681-0352`, `888-788-3067`, `202-649-2801`, `202-649-2790`, `202-649-2783`, `771-222-3150`, `771-333-2237`, `771-333-2065`, `833-604-4139`, `877-706-0402`, `888-825-0405`, `888-551-2231`, `888-834-1048`, `888-792-0335`, `888-471-0706`, `833-684-4075`, `888-461-3098`, and `888-796-1408`. Some calls reportedly use spoofed caller ID, aliases such as **Laura Christie** and **Tara C. Hutchinson**, and AI-enhanced personalization to appear legitimate. The operation relies on classic social engineering: threats of arrest, fines, deportation, license revocation, liens, asset seizure, or collection escalation, alongside false promises to settle tax debts "for pennies on the dollar" or secure refunds. Victims are pushed to disclose personal data, IRS account credentials, and banking details, or to send money through gift cards, wire transfers, prepaid debit cards, or cryptocurrency; some lures also direct targets to phishing sites or malware-bearing links. The warnings align with the IRS **Dirty Dozen** advisory for the filing season, which highlighted impersonation, phishing, account theft, and malware risks targeting taxpayers and tax professionals. Officials and consumer alerts stress that the IRS generally initiates contact by postal mail, not unsolicited calls, texts, or social media, and urge victims to hang up, avoid calling back, verify any issue only through official IRS channels, and report incidents to **TIGTA**, the **FTC**, or `phishing@irs.gov`.
Jul 2, 2026
Fraudsters are impersonating **Huntington Bank** through phone calls, text messages, and emails in campaigns designed to steal online banking credentials, Social Security numbers, and one-time passcodes, while also pressuring customers to move money themselves. Reported lures include fake alerts about locked accounts, bogus requests to "upgrade" Zelle access, and caller ID spoofing that makes calls appear to come from Huntington’s legitimate customer service number. Victims are being urged to verify any account issue only through Huntington’s official mobile app, website, or the phone number printed on their bank card rather than using contact details supplied in unsolicited messages. People who may have interacted with the scam are advised to contact the bank immediately, change passwords, monitor accounts for unauthorized activity, and report identity theft or fraud through official channels such as **IdentityTheft.gov**.
Jul 23, 2026