A text message that says it is from the Cencora data-breach settlement is not coming from the people running it. The settlement’s official website states plainly: “The Settlement Administrator does not communicate via text message.” The statement sits on a page updated October 16, just as the long-delayed payments are expected to begin.
Timing is what makes the warning useful. Payments are anticipated in November 2026, and people who filed a claim are watching their phones for news.
Why does a settlement payment make a good scam hook?
Scam texts follow the news. When a settlement is about to pay, a message that mentions a payment, a fee or a “verify your claim” link looks believable to anyone who really did file. The settlement website says claims closed on January 19, 2026, and that the administrator now anticipates beginning distribution to eligible claimants in November 2026 because of the large volume of claims.
The breach itself gives scammers a reason to try. The HIPAA Journal reports that Cencora learned on February 21, 2024 that data had been taken, and that at least 1.43 million people were notified. A $40,000,000 settlement fund came out of that case.
For the many people in that group, the practical rule is simple. A text about a Cencora payment, from any number, is not the administrator. Do not tap its link, call the number in it or reply, even to say stop.
What changed this year: Social Security and Medicare change every year, and nobody sends you a memo. The Retirement Money Brief breaks down what changed and what to do. Bonus when you subscribe: our Scam & Identity-Theft Action Card.
Get the Brief and the scam action card →
We may earn a commission from links on this page.
How does the real administrator reach claimants?
The administrator is Kroll Settlement Administration. The settlement website lists three routes: a contact form on the site, a toll-free number at (833) 621-8029 and a mailing address at Cencora Data Security Incident Settlement Administrator, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391.
The page adds one more detail for people who return a call. Any callback from the Settlement Administrator would come from 855-711-8800. A call from a different number that claims to be the administrator does not match what the site says.
What do payments look like, and what would a fake ask for?
The real settlement offered two payment options. A documented-loss payment reimburses up to $5,000 per person for losses from September 1, 2023 through the claims deadline, with proof, and all of those payments together are capped at $5,000,000. A cash fund payment needs no documentation, and its amount is not fixed because it depends on how many claims are approved and what is left after fees and costs.
The case is Anaya, et al. v. Cencora, Inc., et al., in the U.S. District Court for the Eastern District of Pennsylvania, and the site says it has received final approval from the court. The administrator communicates by the channels above, so a text offering to speed up, confirm or increase a payment does not match the way the settlement says it reaches people.
Should anyone who got a text freeze their credit?
A person who replied to a text, clicked a link or gave out personal details has one fast, free step available. The Federal Trade Commission says on its credit freeze page that there is no cost to place or lift a credit freeze, and that it lasts until the person lifts it. A freeze blocks new credit accounts from being opened in that person’s name.
The FTC page also lists free fraud alerts, which last one year and require lenders to verify identity before granting new credit. Texts can also be reported. The FTC takes scam reports at ReportFraud.ftc.gov. The open question for the weeks ahead is whether the November payments arrive on time, because every further delay gives scammers more room to fill the silence.
Got a settlement text?
A text that sounds like the Cencora settlement can lead to a stolen login, a fake fee or an identity opened in someone’s name, and the first hour after a reply is when most of the damage can still be stopped. The administrator has said it does not text, so any such message is a warning sign.
The Senior Fraud Defense & First-Hour Recovery Kit includes the free credit-freeze steps, the first-hour recovery plan and a fraud evidence and report log. The log gives a person one place to record the number, the message and the date before reporting it.
Get the fraud defense kit’s report log for a fake settlement text →
More Financial Reading
- 21 Ways to Stretch a $2,087 Social Security Check
- 15 Places to Find Your Share of the $4.25 Billion States Give Back
- 17 Medicare Money Moves Now That Part D Caps at $2,400
This article was produced with AI assistance and edited for accuracy against the sources linked above.
