Phony Social Security statement emails are targeting older adults

The message says a recent statement is waiting behind a link

• Scammers are distributing emails that claim a new Social Security statement can be viewed through a link or attachment.

• Fake websites may capture account logins and financial details, while harmful downloads can infect a device.

• Social Security does send legitimate email alerts, but recipients should go directly to SSA’s website to verify any notice.

An email saying a new Social Security statement is ready can appear to be ordinary government correspondence. But opening it to retrieve the statement could expose personal information or a computer to criminals.

The Social Security Administration’s Office of the Inspector General warned about a sharp rise in fraudulent statement emails. These messages copy official communications by using government-style language, logos, colors and formatting, then push recipients to click links or download attachments.

For retirees who keep close track of their benefits, the promise of an updated statement can seem like a convincing reason to click.

Why the emails are dangerous

A phishing email relies on a familiar organization’s identity to trick someone into revealing information or downloading harmful software.

The FBI says the links in these messages can lead to fake websites that closely resemble real ones. A person who thinks they are signing in to a government account may instead be giving a criminal a password or other sensitive information. Scammers can also spoof the sender’s address to make an email look legitimate.

SSA’s inspector general says the statement scam can result in identity theft, financial losses or compromised data. Some links or attachments can install malware; others send recipients to websites built to collect personal and financial information.

Social Security does send real emails

One important complication is that any email mentioning Social Security is not automatically fraudulent.

People with a my Social Security account can opt in to email or text alerts when a notice appears in their secure Message Center. They can also stop receiving paper copies of certain notices. Those courtesy alerts do not include personally identifiable information.

SSA advises anyone who is unsure about a notification to go to its website directly instead of replying to the message or opening its links or files.

How seniors can spot the scam

Be cautious with unexpected statement-download links and attachments, especially when a message urges immediate action. Official-looking graphics do not prove an email is authentic. SSA’s warning also points to sender addresses that do not end in “.gov,” although a correct-looking address alone cannot guarantee legitimacy.

Requests for sensitive information or payment are another warning sign. SSA says it never asks for sensitive personal information by email or text. Its scam guidance also warns about demands for information or money to activate a cost-of-living increase.

The safest approach is simple: open a browser, type ssa.gov/myaccount yourself and sign in through the official site to check your information.

What to do after clicking

If you entered a password, change it right away through the legitimate service and update it anywhere else you reused it. If you suspect a download installed harmful software, update your security software and run a scan. The FTC recommends visiting IdentityTheft.gov if you shared information such as your Social Security number.

Contact your financial institution if financial information was exposed. Report the suspicious message to SSA’s Office of the Inspector General, then delete it.