Unauthorized ACA enrollment, plan change complaints up fourfold since…

GAO reports unauthorized ACA enrollments and plan changes by agents and brokers increased fourfold from 2023 to 2025, with 299,604 confirmed complaints in 2025. CMS has identified three core control weaknesses—weak consent verification, unrestricted agent access to enrollment records, and lack of consumer notifications—and plans to implement one-time passcode confirmation and restricted access before 2027 open enrollment. If you build ACA marketplace infrastructure or broker tools, CMS just told you exactly what will break in 2027: weak identity verification on three-way calls, unrestricted agent access to full enrollment records, and missing consumer notifications. State exchanges like California already run tighter controls—California has no person search function at all—which means the federal marketplace is about to compress toward those rules, killing the data access and verification shortcuts your competitors rely on.