Social Security impersonation emails: how to spot and report them

Social Security is one of the most impersonated names in the US because nearly everyone has a number and many people depend on the payments. Criminals use that by email as well as by phone. This guide covers the common email versions, what SSA itself says it will never do, how to check your real account safely, and how to report a fake.

What do fake Social Security emails look like?

In an alert dated February 19, 2026, the SSA Office of the Inspector General (OIG) warned of "a sharp increase in fraudulent emails designed to look like official Social Security Administration communications." The emails "falsely claim to provide access to a recipient's Social Security statement." They use official-looking language, logos, colors and formatting. Once clicked, the links "may install malware or direct victims to fake websites intended to steal personal and financial information."

The fake statement email is the newest version. Others have been around for years:

An earlier OIG alert, dated January 8, 2021 on the page (its web address carries a 2025 date), describes the tactics used to make these messages convincing: real SSA and OIG officials' names, many of which are public, law enforcement "badge numbers," email attachments containing personal information about an "investigation," and texted links to "learn more" about a problem with your number.

What will Social Security never do?

The OIG has published two lists. Together they're the clearest test you can apply to any message.

From the February 2026 alert, the SSA and SSA OIG will never:

1. Demand immediate payment.
2. Send unsolicited attachments or direct download links.
3. Threaten legal action, arrest, or benefit suspension because you don't agree to pay immediately.
4. Ask you to pay with gift cards, prepaid debit cards, wire transfers, cryptocurrency, cash, or gold bars.
5. Offer to move your money to protect it.

From the OIG's earlier warning about phone scams, Social Security will never:

1. Suspend your Social Security number because someone else has used it in a crime.
2. Threaten you with arrest or other legal action unless you immediately pay a fine or fee.
3. Require payment by retail gift card, wire transfer, internet currency, or mailing cash.
4. Promise a benefit increase or other assistance in exchange for payment.
5. Send official letters or reports containing your personal information via email.

The same alert adds what SSA actually does: "If you owe money to Social Security, the agency will mail you a letter with payment options and appeal rights."

The FTC backs this up across government: "The real Social Security Administration won't threaten you or suspend your Social Security number," and "Government agencies will never call, email, text, or message you on social media to ask for money or personal information."

How do you spot a fake Social Security email?

The OIG lists four warning signs:

• Messages claiming your Social Security statement is ready to download.
• Embedded links or attachments labeled as statements or documents.
• Messages creating urgency or pressure to act immediately.
• Sender addresses that do not end in ".gov."

Add these checks of your own:

1. Look past the display name. "Social Security Administration" can be typed into any sender's name field. Expand the From line and read the actual address.
2. Read the whole domain. ssa.gov.statement-portal.com ends in .com, not .gov. The part just before the last dot and the ending are what count.
3. Hover over links. A link to anything other than ssa.gov is fake. Even a real-looking link isn't worth using; type the address instead.
4. Distrust attachments. A "statement" as a PDF, HTML file or archive is a red flag on its own, given SSA says it doesn't send unsolicited attachments. Our guide to PDF phishing attachments explains how these files hide links.
5. Notice the payment method. Any mention of gift cards, crypto, wire transfers, cash or gold is a scam, full stop.

A .gov address in the From line still isn't proof, because the From address can be forged. If you're curious, the Email Header Analyzer shows which server sent the message and whether it passed authentication. You don't need it to decide, though: if you never use the email's links, the scam fails. For the general warning signs, see how to spot a phishing email.

How do you check your real Social Security account?

The OIG's advice is short: "TYPE Don't Tap!"

1. Open a new browser window.
2. Type ssa.gov/myaccount yourself. Don't use a search ad or a link from any message.
3. Sign in to your my Social Security account. Your statement and any genuine messages are there.
4. If you'd rather talk to someone, call SSA on the number published on ssa.gov, not one from the email.

This works for every variant. A genuine issue will show up when you go to SSA directly. A fake one won't.

What should you do if you get one?

1. Don't click links or open attachments.
2. Don't respond or provide personal information. Don't call any number in the message either. Our guide to callback phishing explains why phone numbers in emails are a trap.
3. Report it to the SSA OIG at oig.ssa.gov/report. The OIG's February 2026 alert asks people to report suspicious emails immediately.
4. Delete it. As the OIG put it: "These messages are not from Social Security. Anyone who receives one should delete it immediately and report it."

If you got it at work, use your mail client's report button too, so IT can remove other copies. See how to report a phishing email.

What if you clicked, downloaded or shared information?

The OIG lists these steps for anyone who clicked a link, downloaded an attachment or provided personal information:

1. Stop all communication with the suspected scammer.
2. Contact financial institutions to protect your accounts.
3. Report the incident to the SSA OIG at oig.ssa.gov/report.
4. File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov.
5. Report the scam to the Federal Trade Commission.
6. If you lost money, contact local law enforcement.

Two more steps help in practice. If you gave out your Social Security number, the FTC points victims to IdentityTheft.gov for a recovery plan. If you opened an attachment on a computer, run a full security scan or ask IT for help, and change the passwords you use on that device from a different, clean device. Our guide on what to do after clicking a phishing link has the full checklist.

How big is government impersonation fraud?

The FBI's 2025 IC3 Annual Report doesn't break out Social Security on its own, but it does count government impersonation:

The report also describes "Operation Chakra," a December 2025 joint operation with India's Central Bureau of Investigation that dismantled a call center network accused of duping more than 600 US citizens through tech-support scams and by impersonating agencies including the Social Security Administration. Victim reports to IC3 tied more than $48.7 million in losses to that network.

These are complaints filed with the FBI, so the real totals are likely higher. The OIG says older adults are "frequently targeted by these scams," which is why it asks people to share its warnings with friends and family.

How should a business handle SSA impersonation emails?

Work inboxes get these emails too, and staff may open them on work devices. A few steps help:

• Warn staff when a new wave appears, with a screenshot of the fake. The OIG's February 2026 alert is a good template.
• Filter on the sender, not the logo. Mail that claims to be from a government agency but comes from an unrelated domain, fails authentication or carries an archive or HTML attachment should be held for review.
• Make reporting one click. Fast reports let IT pull other copies before more people open them.
• Remember the HR angle. Payroll and HR teams hold Social Security numbers for every employee, and related lures go after that data. Our guides to W-2 tax season phishing and payroll diversion scams cover those.

Other government and authority impersonation follows the same pattern. See our guides to fake court and jury duty emails and fake bank alerts.

Next steps

1. Bookmark ssa.gov/myaccount and use only that to check your statement.
2. Share the OIG's "will never" list with older relatives and colleagues.
3. Report any fake you receive at oig.ssa.gov/report, then delete it.
4. At work, check that suspicious attachments and impersonated senders are held before they reach inboxes. iBlockSpam filters phishing, spoofing and malware at the MX for Microsoft 365, Google Workspace and cPanel; see how it works.

Browse our other phishing and threat guides.