An email saying that your Social Security statement is ready should not decide where you sign in. Open the official Social Security website independently and check the account through that route. You can investigate a real notification without using the message’s button, attachment or support number, which removes much of the pressure to judge an email perfectly.
The US Social Security Administration’s Office of the Inspector General published a warning on February 19, 2026 about fraudulent statement emails. The warning concerns impersonation, not proof that every statement notification is fraudulent or that the recipient’s account has already been accessed. What matters next is the action the message requests and whether you have already disclosed information, downloaded something or moved money.
Pause the action the email is trying to start
Read the request before studying the branding. Is it asking you to download a statement, verify a password, send an identity document or telephone someone immediately? Each requested action creates a different risk. A familiar logo and a convincing signature do not establish the sender’s authority to make that request.
Leave the message alone while you open your own route to SSA. You do not have to reply to explain that you are checking. If the email threatens the loss of benefits or demands secrecy, stepping away from its instructions is especially useful. A genuine account issue can be investigated through the agency’s established channels without continuing a conversation with the sender.
Use the official account entry point
Type ssa.gov/myaccount into the browser yourself or use a bookmark you previously established through the official site. Check the address before entering any information. Starting from an independent route means you are no longer relying on an embedded button that may show one address while leading somewhere else.
Follow the sign-in options offered there. SSA’s current account help identifies Login.gov and ID.me as its sign-in services; an existing account with one of those providers may already be the relevant route. Do not create another account simply because an email says your old access has expired. Use the official account help to resolve a sign-in problem.
A notification and a demand are different things
A message can announce that information is available without being a safe place to supply identity or banking details. Treat the announcement as something to verify in the actual account. The decisive evidence is what you find after opening the official service, not the confidence of the wording in your inbox.
For example, a fictional email might say “Your statement requires immediate confirmation” and offer an attachment named after the current year. You can check whether a statement is available without opening that file. If the requested confirmation is not supported by the real service, keep using the official support route rather than returning to the email for an explanation.
Check sender details without making them a guarantee
Expand the sender information if your mail app makes it easy, but do not rely on the display name. A visible name such as “Social Security Records” can be chosen by someone who does not represent SSA. A copied logo or a correct agency employee’s name adds appearance, not independent proof of the message’s origin.
SSA says most of its emails use a .gov address and its account help documents some additional sending arrangements. That is a reason to consult the current guidance rather than invent a universal rule from a single screenshot. Sender inspection can reveal a mismatch. It cannot replace opening the official account independently when sensitive action is requested.
Keep sign-in codes inside the sign-in you started
If you initiate a legitimate login, a second-factor prompt may be expected. Read what it authorizes and enter a code only in the verified sign-in flow you opened. Do not read a code to a caller or send it back to the email sender as proof that you own the account.
A scammer may say that a code is needed to cancel an unauthorized request. That story does not change the function of the code. It may help authorize the very access you are trying to stop. If a prompt appears when you did not start a login, do not approve it; investigate through the sign-in provider’s own security and recovery guidance.
Do not open an attachment to establish legitimacy
An attachment can look like a statement, a security update or an official notice. Its filename does not verify its contents. A message that asks you to install a viewer, enable content or run a command to see your statement has moved beyond an ordinary notification into an instruction that needs to be stopped.
Use the actual account to obtain documents available there. Do not upload an attachment containing personal data to an unfamiliar “scam checker” just to get a verdict. You could expose a genuine private document in the process. If an organization needs the suspicious file for an investigation, use its verified reporting process and follow its instructions.
Work out what actually happened
Before changing everything, write a brief factual account. Did you only read the email, open its link, type a password, enter a code, send an identity document or make a payment? Did a file download, and did you open or run it? “I clicked it” is a starting point, but these details determine which systems need attention.
Avoid treating a lack of visible damage as proof that nothing happened. At the same time, reading a message does not establish that your identity has been stolen. A useful response follows the exposure you can describe. The diagram below separates account access, personal identity information and money so that one protective action is not mistaken for a complete fix.
If a password or approval was exposed
Go to the genuine sign-in provider through the official SSA route and secure the affected account. Follow that provider’s process to change an exposed password, review authentication methods and investigate unfamiliar access. Tell support if you entered a one-time code or approved a request, because that detail can matter beyond the password itself.
If the password was reused, change it on the other affected services as well. Prioritize the email account used for recovery if it shares that password. Do not make these changes through another link supplied by the original sender. A replacement “security email” can be part of the same conversation rather than an independent recovery channel.
If you shared a Social Security number or identity document
A password change does not retract personal details already sent to someone else. The FTC directs people whose sensitive information was exposed to IdentityTheft.gov for a recovery plan based on what was lost. Use that official route instead of buying a generic “identity reset” from someone who contacts you after the incident.
Record which details you supplied and whether an actual document image was involved. Do not include the full number in an ordinary public post asking for advice. When dealing with the relevant agency or institution, use its verified private process. You can explain the category of exposure to a helper without distributing another copy of the sensitive material.
If you paid or gave banking information
Contact the relevant bank or payment provider promptly using a trusted route. Explain the method, time, amount and what you were told the payment would do. Say whether it was an unauthorized transaction or a payment you made after being deceived. The provider needs an accurate account to assess the available response; recovery is not guaranteed.
Do not make a second payment because someone promises to release the first one or protect the remaining balance. SSA’s scam guidance warns about demands for unusual payments and offers to move money for protection. A caller knowing the amount you lost does not establish that the caller is from your bank, SSA or an investigation team.
If a file or command was involved
Treat a downloaded program, an opened suspicious attachment and an executed command as separate facts worth reporting. The FTC advises updating security software and scanning when a phishing interaction may have downloaded harmful software. If the device is managed by an employer, contact its IT team rather than carrying out an improvised cleanup that could interfere with its response.
Avoid using a possibly compromised device to enter fresh passwords until you have obtained appropriate guidance. Do not install another cleanup program offered by the same page or caller. A reassuring message saying the computer is now clean is only a claim when it comes from the source of the original deception.
Keep enough evidence to make a useful report
Save the message through the mail app if you can do so without opening attachments. Record its subject, sender address, arrival time and the requested action. Add any transaction references and the time you contacted the relevant organization. Keep these records private because even a screenshot can reveal account details or an identity number.
SSA OIG provides a reporting route for Social Security impersonation. Reporting the attempted scam and securing an exposed account are separate tasks, so do not wait for an investigation response before protecting access or contacting a payment provider. Use the official reporting site’s current instructions for what to submit and avoid sending the same sensitive information to unverified intermediaries.
Help a relative without taking over their identity
If you are assisting someone, start with what they remember doing and avoid criticism. A person may have stopped before entering anything important, or may be reluctant to mention a payment. Calm questions about the sequence are more useful than asking whether they “fell for it.” Help them reach the official site themselves.
Keep their passwords and verification codes private. You can sit beside them while they use their own device without collecting those secrets into your notes or messages. If they need an authorized representative for an agency matter, use the agency’s real process. Informal access to someone’s inbox is not a substitute for the permissions the service requires.
Make the next statement check predictable
Set up a trusted route while you are not under pressure. Keep a verified bookmark and know which sign-in provider you use. A short private note can identify the official account entry point and where to find help, without containing the password or codes. That preparation removes the need to improvise from an alarming email.
When another notification arrives, repeat the same process: leave the message, open the known service and verify the claim there. If you already acted, separate account access, identity exposure, device changes and payments. You can respond in a controlled order even when the original message looked convincing and the full outcome is not yet known.
Questions about Social Security statement emails
Does receiving a phishing email mean my SSA account was hacked?
No. Delivery of an impersonation message alone does not prove account access. Check the actions you took and any changes visible through the official service. A login you did not initiate, altered account details or information you entered into a fake form needs its own response, but the email’s arrival is not enough to establish those events.
Can SSA ever send a genuine email?
Yes. Do not use a rule that labels every SSA-related email fraudulent. Its account help describes legitimate sending arrangements. You can avoid relying on a difficult email-authenticity judgment by opening the official account yourself. Verify the message’s claim there rather than treating a genuine-looking sender as permission to follow every instruction.
Is a .gov address in the message enough?
It is not enough to verify every part of the message. The visible text of a link can differ from its destination, and a display name can imitate an organization. Check through your own official route. Do not enter sensitive information solely because a logo, address fragment or button contains familiar government wording.
Should I reply to ask whether the statement is real?
Use the agency’s independently reached support or account service instead. A reply goes to the sender of the message you are trying to verify and can prolong the deception. You can investigate the statement without engaging that sender or disclosing more information about the accounts and contact details you use.
Is changing the password enough after I shared my SSN?
No. It can protect an exposed account credential but does not retract an identity number or document. Use the official identity-theft recovery resources for the information involved. If banking details or a payment were also part of the incident, contact the relevant financial institution separately and keep a private record of the response.