A Social Security email scam is a fraudulent message dressed up to look like it came from the Social Security Administration, usually warning that your number has been suspended, that you owe money, or that a “statement” is waiting in an attached file. The real SSA will never suspend your Social Security number, threaten arrest, demand immediate payment, or send unsolicited attachments by email.1Social Security Administration. Protect Yourself from Social Security Scams If a message does any of those things, it is a scam, and you can delete it and report it without responding.
Signs the Email Is a Scam
Scam emails work by triggering panic. They claim your Social Security number has been linked to a crime, that benefits are about to stop, or that police are on the way unless you call a number or click a link right now. The SSA has stated plainly that it will never threaten arrest, demand immediate payment, or claim to suspend your Social Security number.1Social Security Administration. Protect Yourself from Social Security Scams Any of those threats, on their own, tell you the message is fake.
A recent wave of scam emails claims to include your Social Security statement as an attachment. The SSA Office of the Inspector General issued a specific alert about this, warning that scammers label attachments as “statements” or “documents” to trick recipients into downloading malware. The real SSA does not send unsolicited attachments or direct download links by email.2Office of the Inspector General. SSA Office of the Inspector General Warns Public of Surge in Fraudulent Social Security Statement Emails See an attachment? Don’t open it.
Other versions ask you to send personal information or make a payment to unlock a cost-of-living adjustment or other benefit increase. The SSA never requires payment or personal data to process routine benefit changes.1Social Security Administration. Protect Yourself from Social Security Scams Requests for wire transfers, prepaid debit cards, gift cards, or cryptocurrency are the loudest signal of fraud there is.
Checking the Sender Address and Links
The “From” line is where to look first, though it takes a careful eye. Legitimate SSA emails come from addresses like no-reply@ssa.gov, DoNotReply@ssa.gov, and do-not-reply-message-center@ssa.gov. The agency also uses echosign.com for some communications and occasionally works with marketing firms for outreach about online services. Any links inside those messages should still point to a .gov web address.3Social Security Administration. Security and Protection Scam addresses often look right at a glance but swap .gov for .com or .net, add extra characters, or use a lookalike domain.
Links inside the message deserve the same skepticism. Hovering over a link without clicking shows the real destination in the bottom corner of most browsers and email programs. If that address doesn’t lead to a genuine .gov page, the link goes to a fake portal built to capture your login or Social Security number.
How the SSA Actually Contacts You
Most SSA business happens by postal mail, especially benefit decisions, payment updates, and anything that needs a response from you. The agency does send email, but only in limited situations and only to people who have a “my Social Security” account: annual reminders around your birthday to review your Social Security Statement, alerts that a new message is waiting in your secure Message Center, and follow-ups after you complete something online or speak with a representative.4Social Security Administration. Does Social Security Send Emails to the Public You can adjust those notification preferences in your account settings.5Social Security Administration. Communication Preferences
A genuine SSA email will never ask you to reply with your Social Security number, bank information, or other personal details. It directs you to sign in through the official website instead, and it does not include attachments labeled as benefit statements or account documents.2Office of the Inspector General. SSA Office of the Inspector General Warns Public of Surge in Fraudulent Social Security Statement Emails One boundary worth knowing: the SSA also does not handle claims or account questions through social media direct messages, so anyone contacting you that way and claiming to be from Social Security is running a scam.6Social Security Administration. Social Media Comment Policy
How to Report a Social Security Email Scam
Before deleting anything, save what investigators will want: the full sender email address, the date and time the message arrived, any phone numbers or URLs in the body, and the specific threats or demands made. Take a screenshot or copy the text into a separate document rather than forwarding the email, since forwarding can trigger tracking pixels or strip useful header data.
SSA Office of the Inspector General
The OIG runs a dedicated scam reporting portal at secure.ssa.gov/oig/scam, which is separate from its general fraud form.7Office of the Inspector General. Report Fraud There’s also a phone hotline at 1-800-269-0271, staffed from 10 a.m. to 2 p.m. Eastern Time on weekdays.8Social Security Administration. Fraud Prevention and Reporting For email scams the online form is faster, since you can paste the details straight in and file at any hour.
Federal Trade Commission
A parallel report at ReportFraud.ftc.gov adds the incident to Consumer Sentinel, a database that civil and criminal law enforcement agencies worldwide draw on.9Federal Trade Commission. Report Fraud You won’t get a personal case update from the FTC, but the data helps investigators spot patterns and shut down organized operations.
FBI Internet Crime Complaint Center
If you lost money, or the email looks like part of a wider internet fraud scheme, file a complaint with the FBI at complaint.ic3.gov. The form asks whether you sent or lost money and the total amount. One important warning: do not enter your Social Security number or date of birth anywhere on the IC3 form. The agency explicitly instructs against including that information.10Internet Crime Complaint Center (IC3). Complaint Form
Filing with all three takes roughly 20 minutes and makes it far more likely your report connects to a larger investigation.
What to Do If You Already Clicked or Responded
If you already clicked a link, opened an attachment, or shared personal information, move quickly. The steps below are in priority order.
- Block electronic access to your Social Security record. Call the SSA at 1-800-772-1213 (TTY 1-800-325-0778) and request a Block on Electronic Access. This stops anyone, including you, from viewing or changing your record online or through the automated phone system. Removing the block later requires a visit to a local SSA office.11Social Security Administration. How You Can Help Us Protect Your Social Security Number and Keep Your Information Safe
- Add a Direct Deposit Fraud Prevention block. This separate block stops anyone from changing your direct deposit information or address through your online account or a financial institution. You can request it through the same SSA phone number or at a local office.8Social Security Administration. Fraud Prevention and Reporting
- Freeze your credit. Contact all three credit bureaus (Equifax, Experian, and TransUnion) to place a credit freeze, which is free under federal law. The bureaus must activate a freeze within one business day when you request it online or by phone. A frozen file stops anyone from opening new accounts in your name.12Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts
- File a report at IdentityTheft.gov. The FTC site generates a personal recovery plan, an official Identity Theft Report you can show to businesses, and pre-filled letters and forms for disputing fraudulent accounts. If your Social Security number was exposed but not yet misused, the site offers a separate set of monitoring steps at IdentityTheft.gov/Info-Lost-or-Stolen.13Federal Trade Commission. IdentityTheft.gov Helps You Report and Recover from Identity Theft
- Contact your bank right away. If you sent money by wire transfer, call within minutes if you can. Wire transfers become final once the funds are credited to the recipient’s account, and recovery after that point is very difficult. A recall request filed the same business day has the best chance of working.
Run antivirus software on any device where you opened an attachment or clicked a link. Scam attachments often install malware that captures keystrokes or monitors your activity. Change your passwords for email, banking, and my Social Security accounts from a different, clean device if one is available.