Medicare Open Enrollment opens October 15, and the trap is already set. You search for "Medicare enrollment," and the first result looks exactly like the real thing. It isn't. It's an ad, and a scammer paid to put it above the real site.

On September 28 the FTC warned that fraudsters build lookalike websites that copy Medicare.gov and HealthCare.gov, complete with official logos and near-identical addresses, then buy ads so their fakes sit at the top of your search results. Click, and you either buy a health plan that does not exist or hand over the personal details that fuel medical identity theft. The red flags: a tiny "Ad" or "Sponsored" label, an address that does not end in .gov, and limited-time offers rushing you to sign up.

The rule: Type medicare.gov or healthcare.gov into your browser yourself. Real help is free: Medicare at 800-633-4227, HealthCare.gov at 800-318-2596, or your local State Health Insurance Assistance Program (SHIP).

Source: FTC: What to know ahead of Open Enrollment to avoid health insurance scams

A text says your refund is waiting. An email says your account is locked. A caller demands payment today. All three claim to be the IRS, and all three are lying.

On October 2, as Cybersecurity Awareness Month began, the IRS warned that impersonators are working every channel: mail, email, text, social media, and phone. The script always pushes one of two buttons, a bigger refund to lure you or a scary problem to panic you, and it always ends at a fake website or a demand for immediate payment. Here is the tell: the real IRS starts with a letter in the mail. It does not text you, message you on social media, or threaten you into paying on the spot.

The rule: Don't click, don't call back. If you're worried, go to IRS.gov yourself and check your account. While you're there, turn on multifactor authentication and get a free Identity Protection PIN, a six-digit code that blocks crooks from filing a tax return in your name.

Source: IRS: Cybersecurity Awareness Month offers simple steps to protect tax data

The ad promised cheap contact lenses. The checkout page had other plans.

On October 2 the FTC, joined by the Utah and Nevada attorneys general, sued Lens.com for advertising one price in search ads and on its site, then adding a mandatory "Taxes & fees" charge that routinely doubled the total. The charge was tucked below the edge of the screen, right under a big "Continue" button, so most shoppers never saw it. The label was misleading too: many states don't even charge sales tax on contact lenses. The complaint says the scheme cost consumers hundreds of millions of dollars, with the same hidden charges buried in the AutoRefill subscription plan.

The rule: Before you hit Continue on any checkout, stop and scroll. Read the order total line by line. If the ad said one price and your card was charged another, screenshot both and report it at ReportFraud.ftc.gov.

Source: FTC: FTC, States Sue Lens.com for Misrepresenting the Price of Contact Lenses

Your kid's photo plus a free app equals a fake nude that looks real. That is the ugly math the FTC asked parents to talk about this week.

On October 1 the FTC published guidance for talking with kids about deepfakes and "nudify" apps, tools that turn an ordinary photo of a real person into fake explicit images. Kids often treat these as pranks. The harm is real, and creating or sharing explicit images of minors is a serious crime even when it starts as a joke. The good news: under the Take It Down Act, social media and photo-sharing platforms must remove explicit images of a child, deepfakes included, within 48 hours of a report.

The rule: Have the talk before there's a problem. Three lines every kid should know: never share explicit images or deepfakes, even as a joke; say no to anyone who asks for them; tell a trusted adult right away. If an image is already out there, start at TakeItDown.ftc.gov.

Source: FTC: Talking with parents and kids about deepfakes, online safety, and the Take It Down Act