A federal prosecution laid out the fraud scheme’s exact mechanics in court. A senator’s letters to CMS went, by his own account, unanswered for a year. The agency’s own budget scorekeeper told Congress in writing that the number of people gaming the system had nearly doubled. CMS acted only this September — after all of that had already happened.
A Crackdown Announced as News
On September 22, 2026, the Centers for Medicare & Medicaid Services announced it was canceling 315,000 Affordable Care Act enrollments — affecting more than 760,000 people — and clawing back an estimated $2.2 billion in improperly paid premium subsidies. CMS said the enrollments traced to “a pattern of unauthorized enrollments and suspicious agent and broker activity.” HHS Secretary Robert F. Kennedy Jr. said the action would “protect Americans’ health coverage and ensure taxpayer dollars reach the people they are intended to serve.” CMS Administrator Dr. Mehmet Oz put it more bluntly: “Every dollar lost to fraud is a dollar taken from hardworking taxpayers.”
Outlets across the spectrum covered it as breaking news — a decisive new anti-fraud push from a Vice President-led task force. What went largely unreported is that CMS was not describing a newly discovered problem. It was finally responding to a fraud mechanism that had already been proven in federal court, flagged in writing by a sitting U.S. senator more than a year earlier, and confirmed by Congress’s own nonpartisan budget office to be worsening in the interim. The real story is not the crackdown. It is the year-plus gap between when Washington knew and when Washington acted.
The Scheme, Already Proven in a Courtroom
Seven months before CMS’s announcement, on February 18, 2026, a federal judge in the Southern District of Florida sentenced Cory Lloyd and Steven Strong to 20 years in prison each for running a $161.9 million Affordable Care Act enrollment fraud scheme. According to the Justice Department’s own case record, Lloyd and Strong — along with co-defendants prosecuted separately — targeted “vulnerable, low-income individuals experiencing homelessness, unemployment, and mental health and substance abuse disorders” from approximately August 2018 through September 2022, at times offering bribes to induce enrollment in subsidized ACA plans.
The DOJ’s case file lays out the mechanics in granular detail: agents used “misleading sales scripts and other deceptive sales techniques,” submitted “addresses and social security numbers that did not match the consumers,” and coached enrollees “on how to respond to application questions to maximize the subsidy amount.” Lloyd and Strong were ultimately ordered to pay $180.6 million in restitution. A related defendant, Dafud Iza, was sentenced in January 2026 to 35 months and ordered to pay $133.9 million in restitution for a similar scheme. A third case, against a firm identified in DOJ records as AP of South Florida LLC, was still active in 2026 — meaning the same basic fraud pattern proven in the Lloyd-Strong prosecution was still generating new federal cases years after the original scheme was shut down.
In other words, by the time CMS announced its “new” crackdown in September, the government had already convicted the architects of the exact fraud vector it was describing, obtained a public account of exactly how the scheme worked, and was still prosecuting its successors.
The Letter Washington Says Went Unanswered
Senate Judiciary Committee Chairman Chuck Grassley has been pressing CMS on this specific vulnerability since well before the Lloyd-Strong sentencing. According to Grassley’s own account, he first wrote to CMS in July 2024 requesting information on how the agency was combating ACA enrollment fraud. The Biden administration, Grassley says, never substantively responded.
Grassley wrote again on July 7, 2025 — this time to CMS Administrator Oz under the new administration — citing the Lloyd-Strong prosecution by name as proof the fraud mechanism was real and demonstrated in court, not speculative. His letter describes fraudsters using “targeted internet advertisements for free health insurance” to harvest consumer data through web forms, then enrolling victims through a federally-approved marketplace platform while “coaching” them to misstate income and submitting “false income verification extension requests” to keep subsidized coverage active. Grassley demanded CMS provide, by July 21, 2025: the agency’s own estimate of fraudulent enrollments and associated costs from 2019 through 2025, broken down by agent; documentation of coordination with the IRS to recover improperly paid tax credits; and data on whether insurance agencies face any consequences when their affiliated agents are terminated for misconduct.
RSN could not independently confirm from CMS’s September fact sheet whether the agency ever answered Grassley’s specific 2019–2025 data request in full. What is confirmed is the timeline: a Senate committee chairman handed CMS a written roadmap of the fraud, backed by a federal conviction, more than fourteen months before the agency’s public crackdown.
The Number That Nearly Doubled While Washington Waited
The clearest evidence that this was not a static, contained problem comes not from Grassley’s office or from CMS, but from the Congressional Budget Office — an institution with no partisan stake in the outcome. In an August 25, 2025 letter to House Ways and Means Chairman Jason Smith, Budget Committee Chairman Jodey Arrington, and Energy and Commerce Chairman Brett Guthrie, CBO Director Phillip Swagel wrote that “1.3 million marketplace enrollees improperly claimed the premium tax credit via intentional overstatement of income for 2023,” and that “2.3 million enrollees did so for 2025.”
That is not a rounding change. It is a near-doubling, by CBO’s own analysis, in the two years between 2023 and 2025 — the same window in which Grassley’s first letter went out and, by his account, went unanswered. CBO’s letter also flagged a telling pattern: the number of marketplace plan selections for people reporting income between 100 and 138 percent of the federal poverty line — the income band where subsidies are steepest — rose from 4.3 million to 7.1 million between the 2023 and 2025 open enrollment periods. Separately, CBO found that in 2023, 1.7 million people in states that had not expanded Medicaid reported income clustered narrowly between 100 and 105 percent of the poverty line — the minimum threshold required to qualify for marketplace subsidies at all, and a suspiciously precise concentration for a supposedly random distribution of actual household earnings.
CBO did not itself attach a dollar figure to the 2.3 million estimate. The Federalist, applying average subsidy amounts to CBO’s enrollee count, calculated a potential 2025 cost of $13.9 billion to $15.5 billion — a figure worth citing only with that caveat attached, since it is a third-party extrapolation from CBO’s data rather than a number CBO itself published. Separate Republican-aligned committee statements have cited far larger figures, in some cases exceeding $100 billion, drawn from a different CBO estimate of the ten-year coverage and cost effects of the 2025 reconciliation law’s verification requirements — a different question (future savings from a policy change) than the historical fraud estimate CBO gave Congress in August. RSN has kept those figures separate rather than conflating a future savings projection with a fraud estimate, a distinction political messaging on both sides of this story has often blurred.
What CMS Finally Did
The mechanics CMS announced in September are, on their face, a reasonable response to what the DOJ case, Grassley’s letters, and the CBO data all separately pointed to. The agency’s own fact sheet reports that agents and brokers who registered newly in 2026 were 2.8 times more likely than established agents to have unresolved income-verification issues, 2.7 times more likely to be missing required Social Security numbers, and 2.6 times more likely to have unresolved citizenship or immigration-status verification problems — a risk profile that maps closely onto the tactics described in the Lloyd-Strong indictment. CMS says it has terminated more than 200 non-compliant agents and brokers since January 2026, issued 569 notices of intent to terminate, and completed 66 terminations from the first 100 notices. Going forward, the agency is imposing a temporary moratorium on new broker registrations for the 2027 plan year, requiring existing agents to re-verify their identity, mandating Social Security numbers for all non-newborn applicants, and requiring electronic consumer authorization before an agent can act on an application.
Those are structural fixes aimed, at least on paper, at the broker-side vulnerability the DOJ case exposed. The open question — one CMS’s fact sheet does not answer — is why a fraud mechanism this well documented, this thoroughly prosecuted, and this clearly flagged by a Senate committee chairman took more than a year of confirmed growth before producing a policy response.
The Other Side of the Ledger
Intellectual honesty requires acknowledging the strongest counterargument, and it is a real one. Health policy researchers, including analysts at KFF, have drawn a distinction RSN’s reporting should not blur: an “improper” enrollment — one where a household’s actual income, verified after the fact through IRS reconciliation, differs from what was estimated at sign-up — is not automatically the same thing as fraud. Congress built income reconciliation into the ACA precisely because it anticipated that people with volatile or hard-to-predict incomes, especially near the poverty line, would sometimes misjudge their year-end earnings without any intent to deceive.
That distinction matters for how CMS’s fix is evaluated, not just for how the underlying scheme is described. KFF’s analysis of the new rules — including a 2025 reconciliation law provision eliminating the previous cap on how much low-income households must repay in excess subsidies, and the removal of a special enrollment period previously available to very low-income applicants — argues the new verification burden falls primarily on consumers filling out paperwork, not on the brokers and agencies whose commission structure created the incentive to enroll people fraudulently in the first place. If that critique is accurate, CMS’s September crackdown may correctly identify the disease — broker-driven enrollment fraud, proven in federal court — while writing a prescription that asks ordinary enrollees, including many with no role in the scheme, to absorb most of the new compliance burden.
What Remains Unanswered
RSN’s review of the public record — the DOJ case file, Grassley’s letters, CMS’s own fact sheet, and CBO’s August 2025 letter to Congress — does not answer several questions that determine whether this was a system finally fixed or a political announcement timed to a news cycle. Did CMS ever provide Grassley’s committee with the 2019–2025 fraud data his July 2025 letter demanded, and if so, when? Has any insurance agency — as opposed to individual terminated agents — faced consequences for employing brokers found to have engaged in this conduct, a question Grassley’s letter posed directly and to which RSN found no public CMS response? And with a third prosecution, against AP of South Florida LLC, still working through federal court in 2026, does CMS’s broker-registration moratorium actually close the specific vulnerability — commission-driven, low-verification online enrollment — that has now generated three separate federal fraud cases from the same fact pattern?
The Lloyd-Strong prosecution proved, under a burden of proof no press release requires, exactly how this fraud worked. A sitting senator handed CMS that proof and asked pointed questions for more than a year. The government’s own budget office confirmed, in writing, that the underlying problem nearly doubled while those questions sat unanswered. It is a pattern RSN has now documented across multiple federal health agencies this year, including CMS’s own Medicare organ-acquisition guidance failure and the EPA’s mismanaged Clean School Bus Program — federal programs where the warning signs were documented long before anyone acted on them. Whatever credit CMS’s September crackdown deserves — and structurally, some of it does — it does not erase the fact that Washington had the evidence, the warning, and the data confirming the trend long before it had a fix.