Does Social Security Send Emails or Is It a Scam?

The Social Security Administration does send emails, but only in a few narrow situations, and none of them involve asking you for your Social Security number, bank details, or a payment. Most real messages are automated alerts tied to your my Social Security account, a newsletter you signed up for, or a one-time link an employee sends after speaking with you. Anything outside those categories should be treated as a scam until you can prove otherwise.1Social Security Administration. my Social Security – Security and Protection

When a Real SSA Email Actually Arrives

Legitimate emails from Social Security fall into three buckets.

The first is account activity. If you have a my Social Security account, you may get an automated email when you create it, change your password, or receive a new notice in your secure Message Center. These emails are alerts. They tell you to log in; they do not deliver sensitive information in the body of the message itself.1Social Security Administration. my Social Security – Security and Protection

The second is the agency’s newsletter. If you subscribed to Social Security Matters, the SSA blog, you’ll get periodic emails through a service called GovDelivery covering general topics like retirement planning and cost-of-living adjustments. They contain no personal benefit information.2Social Security Administration. Social Security Matters

The third is a one-time upload link. During a phone call or field-office visit, an SSA employee may send you an email with a link to upload documents electronically. This only happens after the employee asks for your consent to send it, and the link expires after 30 days. After that, you’d have to submit documents by mail, fax, or in person.3Social Security. EM-24015 eSignature Upload Documents Processing Reminders

If a message doesn’t fit one of those three situations, it probably isn’t from Social Security.

The Email Addresses SSA Uses

Real SSA emails come from a short list of published addresses:

  • no-reply@ssa.gov
  • subscription.service@subscriptions.ssa.gov
  • Thank.You@ssa.gov
  • DoNotReply@ssa.gov
  • Information@update.ssa.gov
  • do-not-reply-message-center@ssa.gov
  • echosign.com (used for the electronic document signing process)

Most end in @ssa.gov. The echosign.com address is the one exception, a third-party service SSA uses for electronic signatures. Links inside a real message will point to an address beginning with https://www.ssa.gov/ or https://secure.ssa.gov/.1Social Security Administration. my Social Security – Security and Protection

You may also see emails from Login.gov or ID.me if you use one of those services to sign in to your account. Those are legitimate, but the same rule applies: check that any link points to login.gov, id.me, or ssa.gov before clicking.4Social Security Administration. my Social Security

When you check the sender, look at the actual address, not just the display name. Scammers can put “Social Security Administration” in the “From” field while the real address is something else entirely. A genuine SSA address won’t contain misspellings, extra characters, or random strings of numbers.

Red Flags That Mean It’s a Scam

SSA has published a list of things its employees will never do in any communication. Any email doing one of these is fraudulent:

  • Asking for your Social Security number, bank details, or passwords. SSA does not request sensitive identifiers by email, text, or social media because those channels aren’t secure.5Social Security Administration. Internet Privacy Policy
  • Threatening arrest or legal action if you don’t pay.
  • Claiming your Social Security number has been suspended, revoked, or deactivated. Social Security numbers can’t be suspended.
  • Demanding payment by gift card, prepaid debit card, wire transfer, cryptocurrency, or cash.
  • Pressuring you to act within hours. Real SSA processes come with written notices and appeal windows.
  • Offering to move your money into a “protected” account. No such program exists.
  • Telling you to keep the contact secret from family or friends.
  • Direct-messaging you on social media. SSA does not conduct business that way.6Social Security Administration. Protect Yourself from Social Security Scams

Scams also cluster around the annual cost-of-living adjustment. You may get an email saying you need to provide personal information or make a payment to “activate” your COLA increase. This is always a scam. COLA increases apply automatically to every eligible beneficiary with no action from you.6Social Security Administration. Protect Yourself from Social Security Scams

The Fake Overpayment Email

One of the most common scam formats is a fake overpayment demand. Knowing how a real overpayment notice works makes the fake easy to spot.

When SSA determines you’ve been overpaid, it sends a written notice to your physical mailing address. Not by email. That notice explains the amount, your repayment options, and your right to appeal. You have 60 days from the date you receive the mailed notice to file an appeal using Form SSA-561, and SSA assumes you received it five days after the date printed on it.7Social Security Administration. Overpayments

An email demanding immediate payment for an alleged overpayment, particularly one asking for gift cards or a wire transfer, is fraudulent. Delete it.

How to Verify a Suspicious Email

If you’re not sure whether a message is real, don’t use the phone number, link, or reply address in the email itself. Contact SSA directly instead. Call 1-800-772-1213 or visit your local field office. If the message referred to a notice, log in to your my Social Security account separately and check the Message Center.

Even if you didn’t fall for the message, reporting it helps investigators track fraud patterns. The SSA Office of the Inspector General takes reports online at oig.ssa.gov. The form asks for the sender’s displayed name and real address, the date the message arrived, and a description of the content, including any links.8Social Security Administration. Report Scams – Office of Inspector General

If You Already Clicked or Shared Information

If you clicked a link in a suspicious email or gave up personal information, act quickly.

  • Call the fraud department of your bank or any financial institution where you shared account details. Ask them to freeze or close compromised accounts and change your passwords.
  • Place a fraud alert on your credit by contacting any one of the three major credit bureaus: Equifax (800-685-1111), Experian (888-397-3742), or TransUnion (888-909-8872). The alert lasts one year, and the bureau you contact must notify the other two.
  • Review all three credit reports for accounts or transactions you don’t recognize. Free weekly reports are available at AnnualCreditReport.com.
  • File an identity theft report at IdentityTheft.gov. The site produces a personalized recovery plan with step-by-step guidance.9Federal Trade Commission. IdentityTheft.gov

The longer stolen information circulates, the harder fraudulent accounts and transactions are to unwind. Speed matters more than getting every step perfect.