Eduardo explains that a person claiming to work with your agency contacted him about a payment issue and asked for personal and financial information over the phone to effectuate his Marketplace coverage. Since Eduardo did not provide any information, should this incident be reported?

• A. No, not necessary
• B. Yes, all fraudulent activity should be reported
• C. Yes, but only to Marketplace Call Center
• D. Only if information was disclosed

Answer: (B)

Any suspected attempt to obtain personal or financial information over the phone to activate Marketplace coverage should be reported, even if no data is actually disclosed. This is a red flag for social engineering or fraud, and logging the incident helps protect the individual and the system as a whole. Reporting creates a record for investigators and marketplace security teams to analyze patterns, share warnings, and prevent others from being targeted.

In Eduardo’s case, the caller asked for sensitive information to effectuate coverage, which signals fraudulent activity regardless of whether information was shared. That’s why the best course is to report the incident as fraudulent activity. Limiting reporting only to situations where information was disclosed would miss other legitimate threats, and waiting to report only to a specific channel would risk losing visibility.