What Social Security Email Scams Look Like Right Now
Social Security does not send unsolicited emails asking you to verify your account, update your information, or click a link to confirm your identity. If you receive an email claiming to be from Social Security, it is a scam. The real Social Security Administration communicates with you through the mail, through your online account at ssa.gov if you created one, or by phone if you called them first.
Current scams typically use one of three tactics. The first asks you to click a link because your account has been "locked" or "flagged for review" — the link takes you to a fake website that looks like ssa.gov but steals your username and password. The second attaches a file claiming to be a benefit statement or tax form; opening it installs malware on your computer. The third tells you that you have been approved for a benefit increase and asks you to "confirm" your Social Security number, bank account, or both.
These emails often use official-looking logos, reference real Social Security programs by name, and include language copied directly from Social Security's actual website. They may address you by name if that name was part of a data breach. None of this makes them real.
Key Takeaways
- Social Security never sends unsolicited emails asking you to click links, open attachments, or provide personal information.
- Scammers copy Social Security's logos and website design to make fake emails look official, but the sender's email address and the destination of any link will not match ssa.gov.
- If you receive a suspicious email, do not click anything — instead, forward it to phishing@ssa.gov and delete it.
- If you have already clicked a link or provided information, contact Social Security directly at 1-800-772-1213 to report it and check your account.
How to Check If an Email Is Really From Social Security
The sender's email address is your first checkpoint. Real Social Security emails come from addresses ending in @ssa.gov. If the email address ends in anything else — @socialsecurity.com, @ssa-security.net, @ssadmin.gov, or any variation — it is not from Social Security. Scammers often use addresses that look close to the real thing but are not identical.
Next, look at any links in the email. Hover your mouse over a link (do not click) and look at the web address that appears. If it does not start with ssa.gov, do not click it. Scammers often hide fake links behind text that says "Click here" or "Verify now," so the text itself is not reliable — only the actual address matters.
Social Security will never ask you to provide your Social Security number, bank account information, or password in an email. If an email asks for any of these, it is a scam. Social Security already has your Social Security number on file; they do not need you to send it to them.
What to Do If You Receive a Suspicious Email
Do not click any links or open any attachments. Do not reply to the email. Instead, forward the entire email to phishing@ssa.gov — this is Social Security's official reporting address for suspected scams. Then delete the email from your inbox.
If you have already clicked a link or opened an attachment, do not panic, but act quickly. Change your Social Security online account password when ready if you have one at ssa.gov. If you do not have an account yet, create one now at ssa.gov/myaccount so you can monitor your own record. Then call Social Security directly at 1-800-772-1213 to report what happened. Do not use any phone number from the suspicious email — look up the number yourself or use the one listed above.
If you provided your Social Security number, bank account details, or other sensitive information, tell Social Security during that call. They can place a fraud alert on your account and walk you through next steps. You may also want to contact your bank directly to let them know your account information may have been compromised.
Protecting Your Social Security Account Online
If you have created a my Social Security account at ssa.gov, use a strong, unique password — one you do not use for any other website. A strong password has at least 12 characters and mixes uppercase and lowercase letters, numbers, and symbols. Do not use your birth date, address, or any part of your Social Security number.
Enable two-factor authentication on your account if Social Security offers it. This means that even if someone has your password, they cannot log in without a second form of verification, usually a code sent to your phone. Check your account settings at ssa.gov/myaccount to see if this option is available.
Check your account periodically — at least once a year — to make sure the earnings record is correct and no one has filed a claim under your number. If you see something wrong, contact Social Security at 1-800-772-1213 right away.
What Real Social Security Communication Looks Like
Social Security reaches out to you by mail when they need something from you or want to tell you something important. You will receive a physical letter at the address they have on file. These letters have the official Social Security seal and come from a Social Security office address.
If you have created a my Social Security account, you can also log in to that account to see messages from Social Security. These messages appear only when you are logged into your account at ssa.gov — Social Security will not send you an email with a link to read them.
If Social Security needs to reach you by phone, they will call you — you do not call them first in response to an email. If you are unsure whether a call is real, hang up and call Social Security yourself at 1-800-772-1213 using the official number.
Reporting Scams and Protecting Others
Forward suspected scam emails to phishing@ssa.gov. This helps Social Security track which scams are currently circulating and take action against the people running them. Include the full email, including the header information that shows where it came from.
You can also report the scam to the Federal Trade Commission at reportfraud.ftc.gov. The FTC collects reports from across the country and uses them to identify patterns and shut down scam operations. Reporting takes a few minutes and helps protect other people from the same scam.
If you know someone who has fallen for one of these scams — a family member, friend, or neighbor — encourage them to contact Social Security and their bank right away. The sooner they report it, the sooner they can limit the damage.
Frequently Asked Questions
Can Social Security lock my account through email?
No. Social Security does not lock accounts via email or ask you to unlock them by clicking a link. If your account is actually locked, you will find out when you try to log in to ssa.gov, and Social Security will guide you through unlocking it on the website itself or by calling 1-800-772-1213.
What if the email looks exactly like it came from ssa.gov?
Scammers can make emails look very similar to real ones, but they cannot change the actual sender's email address — that is controlled by the email system itself. Check the sender's address carefully. If it does not end in @ssa.gov, it is not real, no matter how official the email looks.
Is it safe to call the phone number in a suspicious email?
No. Scammers often include fake phone numbers in their emails. If you need to contact Social Security, look up the number yourself — call 1-800-772-1213 or visit ssa.gov to find the contact information for your local office.
What happens if I accidentally opened an attachment from a scam email?
Contact Social Security at 1-800-772-1213 right away to report it. If the attachment installed malware, your computer may need to be scanned by antivirus software. Consider taking your computer to a professional or running a full scan with your existing antivirus program.
Do I need to freeze my credit if I gave out my Social Security number?
You may want to. A credit freeze prevents someone from opening new accounts in your name. You can place a free freeze through each of the three major credit bureaus — Equifax, Experian, and TransUnion — through their websites. It is not required, but it is a strong protective step if your Social Security number has been compromised.