Fake Social Security Emails Aim to Steal Personal Information

Fraudulent emails impersonating the Social Security Administration (SSA) are circulating, aiming to steal personal information by presenting fake "statement support" notifications. The emails, designed to look official, often contain the SSA logo and prompt recipients to click a "View statement" button, according to an analysis from Fox News.

The Social Security Administration's Office of the Inspector General issued a warning in February 2026 about an increase in such fraudulent emails. Scammers are leveraging the importance of retirement benefits and earnings records to exploit trust.

How the Scam Works

The deceptive emails typically arrive with subjects like "Statement Support Was Posted to Your Account Details Report" and appear to come from a "Social Security Administrator." They inform the recipient that their 2025 Social Security statement is ready to view online, often displaying a professional-looking box with a "Ready" status and a prominent "View statement" button.

Identifying the Fraud

A critical red flag is the sender's email address. While the display name may mimic an official source, the actual email address often uses a non-governmental domain, such as loradmiadministraciones.com in one example. Legitimate SSA communications generally originate from government email addresses, although the agency does utilize some authorized third-party services.

Recipients are warned not to trust the visual appearance of the email alone. The "View statement" button can redirect users to phishing websites designed to capture login credentials or sensitive personal data, and some malicious links may initiate malware downloads. The SSA's inspector general has specifically cautioned against these types of fake statement notifications.

Protecting Yourself

Experts advise several steps to avoid falling victim to these scams:

• Verify the sender's email address: Always check the full email address, not just the display name, for any discrepancies or unfamiliar domains.
• Inspect links cautiously: Hover over links without clicking to see the actual destination URL. If in doubt, do not click.
• Access accounts directly: The most secure method is to go directly to the official SSA website (ssa.gov) or use a known, trusted method to log into your my Social Security account. Avoid using any contact information or links provided in a suspicious email.
• Use strong security practices: Employ strong, unique passwords for online accounts, enable multifactor authentication, and keep antivirus software updated.
• Report suspicious emails: The SSA Office of the Inspector General provides a channel for reporting these scams at oig.ssa.gov/report/.

What to Do If You Clicked a Malicious Link

If a user clicks a suspicious link and enters login credentials, they should immediately change their password on the legitimate website and any other sites where the same password was used. If personal information like a Social Security number was shared, victims should visit IdentityTheft.gov and consider placing a credit freeze with the major credit bureaus. If a file was downloaded or opened, disconnect the device from the internet and run a security scan with antivirus software.