Scammers are sending emails that claim a new Social Security statement is available through a link or attachment.
Fake websites can steal account credentials and financial information, while malicious downloads can infect a recipient’s device.
Social Security does send legitimate email notifications, but recipients should check their accounts by going directly to SSA’s website.
An email announcing that a new Social Security statement is ready may look like routine government correspondence. But clicking to retrieve it could expose a recipient’s personal information or computer to criminals.
The Social Security Administration’s Office of the Inspector General warned in February about a significant increase in fraudulent statement emails. The messages imitate official communications with government-style language, logos, colors and formatting, then encourage recipients to follow links or download attachments.
For retirees who closely monitor their benefits, the promise of an updated statement can provide a convincing reason to click.
Why the emails are dangerous
A phishing email uses a familiar organization’s identity to persuade someone to reveal information or download harmful software.
The FBI says links in these messages can lead to counterfeit websites that look nearly identical to legitimate ones. Someone who believes they are signing into a government account may instead be handing a criminal their password or other sensitive information. Scammers can also disguise the sender’s address to make an email appear trustworthy.
SSA’s inspector general says the statement scam can lead to identity theft, financial losses or compromised data. Some links or attachments may install malware; others direct recipients to websites designed to collect personal and financial information.
Social Security does send real emails
An important complication is that an email mentioning Social Security is not automatically fraudulent.
People with a my Social Security account can choose email or text notifications when a notice becomes available in their secure Message Center. They can also stop receiving paper copies of certain notices. Those courtesy notifications do not contain personally identifiable information.
SSA advises anyone uncertain about a notification to visit its website directly instead of responding to the message or opening its links or files.
How seniors can recognize the scam
Treat unexpected statement-download links and attachments with caution, especially when a message pressures you to act immediately. Official-looking graphics do not establish that an email is authentic. SSA’s warning also flags sender addresses that do not end in “.gov,” although an apparently correct sender address alone cannot guarantee legitimacy.
Requests for sensitive information or payment are additional warning signs. SSA says it never asks for sensitive personal information through email or text. Its scam guidance also warns about demands to provide information or money to activate a cost-of-living increase.
The safest approach is straightforward: Open a browser, type ssa.gov/myaccount yourself and sign in through the official site to check your information.
What to do after clicking
If you entered a password, change it immediately through the legitimate service and change it anywhere else you reused it. If you suspect a download installed harmful software, update your security software and run a scan. The FTC recommends visitingIdentityTheft.gov if you disclosed information such as your Social Security number.
Contact your financial institution if financial information was exposed. Report the suspicious message to SSA’s Office of the Inspector General, then delete it.