D.C. Health Agency Printed Incorrect Website on ID Cards
The Department of Health Care Finance accidentally directed Medicaid recipients to a phishing site.
Updated on Sept. 22, 2026 in Cybersecurity
Live Poll
Do you trust your local government agencies to keep official digital communications secure and accurate?
The D.C. Department of Health Care Finance mailed medical identification cards that featured an incorrect website address. This error led users to a phishing site containing adult content instead of the official government portal.
Why it matters
The mailing error highlights critical gaps in document verification processes for sensitive government communications. It exposed vulnerable residents to potential cybersecurity risks while they attempted to manage their healthcare benefits.
The Medicaid renewal process typically spans 45 days. The issue was initially identified by a 34-year-old resident.
The players
D.C. Department of Health Care Finance
This is the government agency responsible for administering Medicaid and health insurance programs in Washington, D.C.
Office of the Chief Technology Officer
This agency provides technology leadership and IT services for the government of the District of Columbia.
The details
Residents attempting to access their online portals were redirected to a third-party site because the agency failed to update the URL on printed materials. The District of Columbia government no longer owns the incorrect domain used on the identification cards.
Timeline
September 20, 2026: A resident opened the official letter from the DHCF.
September 21, 2026: The resident shared the experience on Reddit.
Roadmap
This error highlights the vulnerability of physical documentation in an increasingly digital healthcare infrastructure. It underscores the importance of rigorous quality control for government-issued credentials linked to critical online portals.
Residents should only visit the official D.C. Medicaid portal at medicaid.dc.gov to manage their accounts. Do not trust or input personal information into any website address found on physical mailers that does not explicitly end in .dc.gov.
The takeaway
Always verify official government URLs by typing them directly into your browser rather than relying on links or addresses from printed mail. Double-check all correspondence for inconsistencies to protect your personal data from phishing attempts.
Further reading
For more information on digital security and agency protocols, visit the Cybersecurity section.
More information
To manage your benefits securely, visit the Official D.C. Medicaid portal.
Live Poll
Do you trust your local government agencies to keep official digital communications secure and accurate?
