An email from Social Security is legitimate only when it comes from a sender address ending in .gov, links only to ssa.gov or another .gov site, and either confirms something you just did in your my Social Security account or delivers general information you opted in to receive. Anything else — a request for your Social Security number, a threat, a payment demand, an attachment to download, a link to a non-.gov site — is a scam. The Social Security Administration does send real emails, but they are narrow in purpose and never ask you to hand over personal or financial details.
Start With the Sender’s Address
The single most reliable check is the address the email came from. Every genuine SSA email is sent from a domain ending in .gov, which is restricted to government entities.1Social Security Administration Office of the Inspector General. OIG Scam Alert – Beware of Scam Emails Asking to Download Statements If the address ends in gmail.com, yahoo.com, ssa-gov.org, or any near-miss of a real government domain, it’s fake. This one detail catches most scams before you read a word of the message.
Links inside a real SSA email also point only to ssa.gov or another .gov address. Hover your cursor over any link before clicking to see where it actually goes. Scammers routinely make the visible text read “ssa.gov” while the underlying URL points somewhere else entirely.2Social Security Administration. Protect Yourself from Social Security Scams
One more structural clue: legitimate SSA emails don’t contain downloadable attachments. In April 2025, the Office of the Inspector General warned specifically about fraudulent emails asking recipients to download fake Social Security statements.1Social Security Administration Office of the Inspector General. OIG Scam Alert – Beware of Scam Emails Asking to Download Statements If you’re asked to open an attached document, treat that alone as reason enough to stop. SSA directs you to log in and view documents inside your account, not to download them from an inbox.
When SSA Actually Emails You
Real SSA emails almost always follow something you did first. Reset a password, change your address, or update your direct deposit through the my Social Security portal, and the system sends an automated confirmation. Those are transactional messages recording your action, not requests for you to take a new one.
If you’ve opted in to receive notices electronically, SSA emails you about events like the annual Cost-of-Living Adjustment or the availability of your 1099 tax statement.3Social Security Administration. Opt Out of Receiving Notices by Mail That Are Available Online These messages are informational and link to news releases or resources on ssa.gov. They don’t include your benefit amount, your Social Security number, or your bank details, and they don’t ask you to reply with any of that.
Subscribers also receive an email when a new Social Security Statement becomes available in their account. If you filed a disability appeal online and gave an email address, you’ll get a confirmation after submitting it, and an SSA representative may email you if additional evidence is needed for that appeal.4Social Security Administration. Electronic Appeals Terms of Service Outside of these situations, an unsolicited email claiming to be from Social Security deserves heavy skepticism.
What a Real SSA Message Will Never Do
This is where scams give themselves away. The Social Security Administration has published a clear list of things its representatives never do, by email, phone, or text:
- Threaten arrest or legal action if you don’t respond immediately.
- Claim your Social Security number has been suspended. SSA cannot suspend Social Security numbers.
- Demand on-the-spot payment to resolve a problem.
- Ask for payment by gift card, prepaid debit card, wire transfer, cryptocurrency, or mailed cash.
- Request your full Social Security number, bank account details, or credit card numbers by email or text.
- Ask for personal information to process a cost-of-living adjustment. COLA increases are automatic.
Any message that does any of these things is fraudulent.5Social Security Administration. What Should I Do If I Receive a Call From Someone Claiming to Be a Social Security Employee
Why Today’s Scam Emails Look So Convincing
The grammar mistakes and clumsy formatting that once made phishing easy to spot are gone. AI tools now let scammers produce polished, professional-sounding messages that closely mimic the way SSA actually writes. These messages can include your name, reference real programs, and use language that reads like a government notice.
Some operations pair a phishing email with a follow-up phone call using AI-generated voice cloning. You get an email about a problem with your benefits, then a call from someone who sounds like a federal employee pressuring you to verify your identity. The combined effect is designed to overwhelm skepticism.
The defense hasn’t changed. Ignore the contact method the message provides and reach SSA through a channel you start yourself. If the email tells you to call a number, don’t; call 1-800-772-1213 instead. If it tells you to click a link, don’t; type ssa.gov into your browser directly.
How to Verify a Message You’re Unsure About
If a message claiming to be from Social Security has you second-guessing, don’t reply, don’t click any links, and don’t open any attachments. Instead:
- Check the sender address. If it doesn’t end in .gov, it’s fake. Even a .gov address isn’t a guarantee on its own, since display names can be spoofed.
- Log in independently. Open a new browser window, go to ssa.gov/myaccount, and sign in. A real issue with your benefits will show up there.
- Call SSA directly at 1-800-772-1213, Monday through Friday, 8:00 a.m. to 7:00 p.m. local time. Automated services are available 24 hours.6Social Security Administration. Contact Social Security By Phone
- Visit your local field office for in-person verification with staff who can pull your official records.
Once you’ve confirmed a message is a scam, report it to the Office of the Inspector General at oig.ssa.gov/report or by calling 1-800-269-0271. Include the sender’s address, the full message, and any links. Save the email rather than deleting it; investigators need the technical details in the headers.7Office of the Inspector General. Report Fraud
If You Already Clicked or Shared Information
If you clicked a link, downloaded an attachment, or handed information to a scammer, move quickly. The first few hours matter most.
Contact your financial institutions immediately. Call the fraud department of every bank or credit card company where you have an account, freeze or close anything that may be compromised, and change passwords and PINs. If you shared direct deposit information, call SSA at 1-800-772-1213 to confirm your payment routing hasn’t been changed.6Social Security Administration. Contact Social Security By Phone
Place a fraud alert or, better, a credit freeze. A fraud alert asks creditors to verify your identity before opening new accounts and lasts a year; you only need to contact one of the three major bureaus, and that bureau notifies the others. A credit freeze blocks new credit accounts entirely until you lift it, requires contacting Equifax, Experian, and TransUnion separately, and is free to place and lift.8Consumer Advice – FTC. Credit Freezes and Fraud Alerts For most scam victims, a freeze is the stronger choice.
File an identity theft report at IdentityTheft.gov to get an FTC Identity Theft Report and a personalized recovery plan.9Federal Trade Commission. IdentityTheft.gov Print the Identity Theft Affidavit, then file a report with your local police, bringing the affidavit, a government photo ID, and proof of address.
Request an IRS Identity Protection PIN. A stolen Social Security number can be used to file fraudulent tax returns, and the IP PIN is a six-digit number that blocks anyone from filing under your number without it. Request one through your IRS Online Account at irs.gov. If you can’t access your account online, submit Form 15227 if your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), or schedule an in-person visit at a Taxpayer Assistance Center by calling 844-545-5640.10Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
Lock Down Your My Social Security Account
Two account-level protections are worth knowing about even if you haven’t been scammed.
The Direct Deposit Fraud Prevention block stops anyone, including you, from changing direct deposit or address information through the my Social Security portal or through a bank’s auto-enrollment. After the block is in place, any change to your payment routing requires an in-person visit to a local SSA office. That’s an inconvenience by design, and it’s one of the most effective ways to keep a scammer with account access from redirecting your benefits.11Social Security Administration. Fraud Prevention and Reporting
The eServices block goes further and prevents anyone from viewing or changing your personal information online at all. Removing it also requires contacting your local office. It’s the option to use if you think your credentials may already have been compromised and want to shut down electronic access while you sort things out.11Social Security Administration. Fraud Prevention and Reporting
As of June 2025, sign-in to my Social Security runs through either Login.gov or ID.me; the old SSA-specific username and password no longer works.12Social Security Administration. Learn About Changes We’re Making to Your Personal My Social Security Account Both support multi-factor authentication, so a stolen password alone isn’t enough to get in. When you set up MFA, pick a security key or an authentication app over SMS codes where you can. Text-based codes are the weakest option.