Citizens Disability SSDI Impersonation/Robocall Scheme

What Happened

Citizens Disability, LLC, a Massachusetts-based company that helps consumers apply for Social Security Disability Insurance (SSDI) benefits, and its subsidiary CD Media, LLC contracted with third-party lead generators and call centers to sell their paid benefits-application-assistance services. Per the DOJ complaint (filed upon FTC referral) in the District of Massachusetts (Case No. 1:25-cv-12826), between January 2019 and July 2022 the defendants allegedly caused more than 109 million outbound telemarketing calls to be placed, including more than 25.7 million calls to telephone numbers listed on the National Do Not Call (DNC) Registry. The leads for these calls were allegedly harvested through deceptive "consent farm" websites that offered consumers sweepstakes entries, coupons, or other services in exchange for contact information, without adequately disclosing that the information would be used for telemarketing solicitation. Many recipients were lower-income or disabled consumers. A subset of the calls allegedly used prerecorded robocalls in which a voice identifying itself as "Amber" or "Audrey" falsely told the consumer "it show[s] here that you recently inquired about your eligibility for Social Security Disability benefits," creating the false impression the call was a personalized follow-up to the consumer's own prior outreach, when in fact the consumer's data had simply been scraped from an unrelated coupon/sweepstakes site. Defendants neither admitted nor denied these allegations in resolving the matter via stipulated order.

How the Attack Worked

The scheme combined a data-harvesting front end with a pretexting-based robocall back end. First, consent-farm websites advertising prizes, coupons, or other unrelated services collected consumers' names and phone numbers, with telemarketing use of that data buried or omitted from disclosures. Those lead lists were sold/passed to Citizens Disability's contracted call centers, which then dialed the numbers, including numbers on the DNC Registry, in violation of the Telemarketing Sales Rule (TSR), using prerecorded messages that lacked the required prior express written consent. The core social-engineering hook was the false-continuity pretext: rather than cold-calling as a stranger, the robocall (voiced as "Amber" or "Audrey") asserted the consumer had already reached out about SSDI eligibility, manufacturing a sense of familiarity and legitimacy (and an implicit echo of official Social Security Administration contact) that lowered the recipient's skepticism and increased pickup/engagement, funneling interested consumers to live agents to sell benefits-application assistance.

The Lure & the Tell

The tell was the specific script line quoted in the FTC complaint: a prerecorded voice identifying itself only as "Amber" or "Audrey" stating "it show[s] here that you recently inquired about your eligibility for Social Security Disability benefits," a claim the recipient had never actually made. Consumers who had never visited any SSDI-related site (and in many cases were on the DNC Registry) had no way to have "inquired," which is the giveaway that the call originated from purchased consent-farm data rather than a genuine prior contact; legitimate SSA-related outreach would not come from a third-party disability-services telemarketer referencing an inquiry the consumer never made.

Outcome

The United States, acting via DOJ upon a 3-0 FTC referral vote, filed a complaint and simultaneous proposed stipulated order in the U.S. District Court for the District of Massachusetts on September 30, 2025 (Case No. 1:25-cv-12826; FTC matter no. 2223158). The stipulated order, entered the same day, imposed a $2 million civil penalty judgment jointly and severally against Citizens Disability, LLC and CD Media, LLC, with $1 million suspended contingent on compliance and timely payment of the remaining $1 million (in two $500,000 installments). It permanently enjoins the defendants from prerecorded robocall telemarketing (absent a narrow statutory exception), from calling DNC-listed numbers absent a valid exception, and from misrepresenting that a call is in response to a consumer's own SSDI-eligibility inquiry; it also requires due diligence and monitoring of lead generators and proper recordkeeping. Defendants neither admitted nor denied the allegations in the complaint as part of the settlement. No individuals were named or charged in the federal action. The FTC case page lists the matter as "Under Order" as of the filing date; no reporting reviewed confirmed collection beyond the ordered payment schedule.

Why It Matters

The case is a clean, well-documented illustration of the "false-continuity" pretexting variant at industrial scale: the complaint's allegations of over 109 million calls and 25.7 million-plus DNC-registry contacts show that this pretext (falsely claiming to be responding to the consumer's own inquiry) can be deployed as a mass-market lead-conversion tool, not just a bespoke targeted attack. It also demonstrates how legitimate-seeming "coupon" and "sweepstakes" data-collection sites function as an upstream feeder for pretexting campaigns, and how the pretext is engineered to specifically exploit consumers already anxious about disability benefits, a population selected in part for vulnerability (lower-income, disabled). For an educational site, it's a strong real-world case for teaching "verify independently, never trust an inbound claim that you already contacted them" and for showing regulators' TSR/FTC Act theory of liability against both the telemarketer and its lead-generation supply chain.

Defenses

FTC/DOJ enforcement resulted in a permanent injunction barring: (1) prerecorded/robocall telemarketing except under a narrow statutory safe harbor; (2) calls to numbers on the National Do Not Call Registry absent a valid exception; (3) misrepresentations that a call is in response to a consumer's own SSDI-eligibility inquiry or implies SSA affiliation; and required due diligence/monitoring of third-party lead generators, recordkeeping, and restrictions on use/retention of consumer data harvested via consent-farm sites. For consumers, the case illustrates standard robocall defenses: numbers on the DNC Registry are not fully protected against sweepstakes/coupon-site data harvesting; a caller claiming "you recently inquired" should be independently verified by contacting SSA (ssa.gov or 1-800-772-1213) directly rather than trusting the inbound caller; legitimate SSA communications do not originate from third-party disability-benefits marketing firms.