Social Security Phishing Emails: How to Check and Report Them

Treat an unexpected Social Security email asking for your full Social Security number, urgent payment, or account credentials as suspicious. SSA will not threaten arrest or demand gift cards, cryptocurrency, or wire transfers. Verify any claimed account problem through SSA directly before clicking, calling, or replying.

Scammers can borrow real news to make a false request sound timely. A message mentioning the reported database cleanup may be using an accurate headline as bait. Accuracy about a public event does not prove the sender has access to your record.

Separate the news hook from the request#

A typical pressure message says something has happened to your benefits or identity and gives you a short path to fix it. The path might be a login link, an attachment, a phone number, or a demand to send money. Judge that requested action separately from the official-looking explanation around it.

For example, the reported SSA database cleanup concerned record corrections. It does not establish that a stranger can require you to pay a fee to keep your Social Security number active. A message making that jump needs independent verification.

The same caution applies when a message contains your name or familiar personal details. Information about you is not proof that the sender represents SSA. Do not fill in missing details to help an unsolicited caller appear more credible.

Recognize demands SSA will not make#

Some warning signs are more useful than spelling mistakes. A polished message can be fraudulent, while an ordinary-looking message may require a legitimate follow-up. Focus first on threats, payment instructions, and requests for sensitive information.

Do not negotiate with the sender about a smaller payment or a different payment method. That keeps you inside the same unverified conversation. A threat does not become legitimate because the person offers to make it easier to comply.

Check an email without following its instructions#

Read the visible request, but do not open attachments or use its buttons to investigate. The sender's display name, an official-looking seal, and a copied signature are weak evidence. A link's visible wording can also differ from its destination.

On devices that let you inspect a link safely without opening it, the destination may reveal a mismatch. Do not rely on this technique if it is awkward on your phone or if you are unsure what you are seeing. There is no need to click a suspicious link to prove it is suspicious.

Open a separate browser window and type the official SSA address. Use its account and contact options to check whether there is a real issue. Do not search for help using the suspicious message's phone number, and do not call that number simply because it appears in a professional-looking footer.

If your online account contains no matching notice, that is useful context, but it does not settle every kind of agency communication. Ask SSA about a specific request when you remain uncertain. The goal is to confirm the request with the agency, not to solve the sender's puzzle.

Apply the same pause to texts and calls#

A text can create urgency with fewer words: benefits suspended, records incomplete, verify now. Do not tap the link to find out which problem it means. Move to your own route to SSA instead.

On a call, do not let a displayed agency name substitute for verification. Caller identification can be falsified. End the conversation if the person threatens you, dictates a payment method, or refuses to let you check the claim independently.

If the caller asks you to read out a sign-in code, do not provide it. Verification codes can allow another person to enter an account. Also refuse requests to install remote-access software or give the caller control of your screen while you open financial accounts.

If you already clicked, match the response to the exposure#

Write down what happened while you can still recall it. Distinguish opening a page from typing a password, disclosing identity information, downloading a file, or sending money. Different exposures call for different follow-up steps.

If you entered credentials, go to the real account through a trusted route and change the password. Change reused passwords on other accounts as well. Review account recovery details and available multifactor authentication settings. If you cannot get in, use the provider's official recovery process.

If you shared banking information or sent money, contact the financial institution or payment provider promptly through an independently obtained number. Explain the transaction and ask what can be stopped or secured. Recovery is not guaranteed, and someone promising recovery for an advance fee should receive the same scrutiny.

If you disclosed your Social Security number or other identity information, use the consumer protection resources at the Consumer Financial Protection Bureau for next steps. Review how to check your credit reports and monitor for unfamiliar accounts. If you find one, document and dispute the credit report error through the appropriate process.

Preserve useful evidence and make the report#

SSA directs scam reporting to its Office of the Inspector General at oig.ssa.gov. Find the reporting route through SSA's scam information page rather than a reporting link supplied by the suspected scammer.

Keep the sender address or phone number, message date, wording of the demand, and any payment details. Preserve screenshots or the original message securely when useful. Do not continue the conversation to gather more evidence, and do not send additional sensitive information to test the person's story.

For someone helping a relative, start with a calm question about what was shared and what still needs securing. A practical response is easier when the person feels able to describe the whole incident. After reporting, use the service provider's spam or blocking controls and return to independently verified communications.

This information is general education, not individualized financial, legal, or cybersecurity advice. Contact SSA, your financial institution, or a qualified professional for help with your circumstances.