Fake Social Security Statement Email? Don't Click the Link

By Muhammad Imran · Reviewed for accuracy against SSA OIG guidance · Last updated October 2026.

On February 19, 2026, the Social Security Administration's Office of the Inspector General (OIG) warned the public about a significant increase in government imposter emails that falsely claim to provide access to a recipient's Social Security statement. The warning is plain about what happens next: clicking links inside these emails may lead to identity theft, financial loss, or compromised data. Michelle L. Anderson, Assistant Inspector General for Audit, put it directly: "These messages are not from Social Security. Anyone who receives one should delete it immediately and report it."

This is the email cousin of the fake SSA letter we covered in our fake Social Security letter guide. The letter threatens suspension. The email offers convenience. Both want the same thing: for you to use the scammer's own route instead of Social Security's.

How the email works, step by step

1. It arrives looking official. The message copies Social Security's logos, colors, and formal language. Imposter messages in this family have also used real SSA employee names to look more convincing.
2. It claims your statement is ready. The usual line is that your Social Security statement is ready to download, or that a monthly statement is available for review. Sometimes it thanks you for signing up for electronic statements, whether you did or not.
3. It offers one easy route. A button or link labeled as a statement download, a preview, or an official document. Sometimes an attachment instead of a link. Either way, the email wants one click.
4. It adds pressure. Act now, review before a deadline, confirm before your record changes. The urgency is there to stop you from checking through your own channel.
5. The click delivers the payload. The OIG names two outcomes. The link may install malware on your computer, or it may take you to a fake website built to steal your personal and financial information. In recent reported variants, the download is a remote-access program, covered below.

One reported variant, so you can recognize it

Scam emails change their wording constantly, so treat this as one reported example, not the only version. In October 2026, a reported email carried the subject line "[Confirmation] Your statement is here," announced that a monthly statement was available for review, and offered a "Preview and Download" link. That link did not lead to Social Security's website. It led to a page on an unrelated website that looked like a guide to accessing Social Security statements, and the page attempted to download a program called ScreenConnect. Another reported variant used the subject "Annual Reminder to Review Your Social Security Statement" with the sender name "SSA.GOV," and its link appeared to point to a Social Security address but redirected elsewhere.

ScreenConnect is a legitimate program that lets a helper see and control a computer from far away, the same way a technician fixes your computer remotely. In a scammer's hands, that same control lets them open your files, watch you type passwords, and install more harmful software. That is what makes this variant nastier than a plain fake login page: it does not just steal what you type, it takes over the machine you typed it on.

Why this email fools careful people

• The statement is real, so the email feels expected. Your Social Security statement genuinely exists, and you may genuinely want to check it. The email offers exactly what you already wanted.
• The branding is copied, not invented. Logos, colors, and formal wording are easy to copy, and the OIG says these emails use official-looking language, logos, colors, and formatting to mislead recipients.
• The sender name lies. A display name like "SSA.GOV" proves nothing. What matters is the actual sender address, and even that must end in .gov to be genuine. Check the real address, not the name shown.
• Real names add false authority. The fake-letter variant has used real SSA employee names. A real name on a fake email is still a fake email. Judge the message by what it asks you to do, not by whose name sits on it.
• It arrives in your inbox, not as a cold call. An email feels less aggressive than a threatening call, so your guard is lower. The OIG warning exists because this quiet version works.

The one safe check

The OIG gives this advice in three words: TYPE, Don't Tap. To see your statement, type ssa.gov/myaccount yourself into your browser and sign in there. Never follow a link from an email to reach your Social Security account, and never download a statement file from an email. If you are unsure about an email you received, paste its text into our Scam Checker for a plain-English verdict before you touch any link in it.

Two quick sender checks help, but neither replaces typing the address yourself. First, a real Social Security message comes from an address ending in .gov. A sender address that does not end in .gov is an instant giveaway. Second, look past the display name to the actual address. A friendly name at the top of an email is easy to fake; the address behind it is harder to hide.

What to do if you got the email

1. Do not click the link or download the attachment. Do not reply to the email, and do not call any number inside it.
2. Do not enter information anywhere the email sends you. Not your Social Security number, not bank details, not a username or password.
3. Delete the email. That is the OIG's own instruction for these messages.
4. Check your statement the safe way, if you want to. Type ssa.gov yourself and sign in to your my Social Security account. If anything about your record needs attention, it will be there.
5. Report it. Report Social Security-related scams at ssa.gov/scam, and file with the FTC at ReportFraud.ftc.gov. Keep the email, including its sender address and subject line, for the report.
6. Warn the people around you. If one of these landed in your inbox, it landed in other people's too. A quick warning to family or friends breaks the chain.

What to do if you clicked or downloaded

1. If you only clicked and closed the page, you are almost certainly fine. Clicking by itself rarely causes harm. The damage starts when you download a file, run a program, or type information into a fake page. Close the page, delete the email, and do not download anything.
2. If you downloaded a file but did not open it, delete it now. Do not run it to see what it is. A downloaded file that never opens cannot take over your computer.
3. If you opened or ran the file, disconnect the computer from the internet at once. Turn off Wi-Fi or unplug the cable. Do not use that computer for banking or email until it has been checked.
4. Get the computer checked. Run a full antivirus scan, or ask someone you trust for help. A remote-access program can hide, so a quick glance at your desktop is not enough.
5. Change your important passwords from a different device. Start with email and banking, then any account that shares those passwords.
6. If you banked on that computer, call your bank right away using the number on the back of your card, and ask what protections they recommend.
7. Report it at ssa.gov/scam and to the FTC at ReportFraud.ftc.gov. If you shared personal information, visit IdentityTheft.gov for steps matched to what you shared.

What to do if you already shared information

1. Call your bank right away if you shared bank or card details, using the number on the back of your card.
2. Change passwords from a different device for every account that shares a password you typed into the fake page.
3. Place a credit freeze with Equifax, Experian, and TransUnion. A freeze is free by federal law, does not affect your credit score, and stops new accounts from being opened in your name.
4. Visit IdentityTheft.gov for a recovery plan matched to exactly what you shared.
5. Report it at ssa.gov/scam and to the FTC at ReportFraud.ftc.gov. Keep the email, the link, and any file name for the report.
6. Do not pay a "recovery" fee. Anyone who contacts you promising to remove the malware or restore your account for a fee is running a second scam.

Our scam recovery guide walks through every step in order, and our SSN suspended call guide covers the phone version of this same impersonation.

Not the same as three other SSA tricks

Three related tricks are easy to confuse with this one. The first is the fake SSA letter: a paper or attachment on fake OIG letterhead threatening to suspend your Social Security number within 24 hours, covered in our fake letter guide. The second is the phone version, where a caller claims your number is suspended or linked to a crime, covered in our SSN suspended call guide. The third is a message asking you to call to "activate" a benefit increase, such as a cost-of-living raise. Benefit increases are automatic and never need activation or a fee, as our COLA scams guide explains. All four are fake, and all four are handled the same way: do not use the message's own link or number, and check through Social Security yourself. But they are different scripts, so do not let one message's details convince you about another.

Sources: Social Security Administration, Office of the Inspector General, Quarterly Scam Update, Issue 19 (October 1, 2025 to March 31, 2026), confirming the February 19, 2026 alert, SSA Office of the Inspector General Warns Public of Surge in Fraudulent "Social Security Statement" Emails; Taxgirl, Fake Social Security Statement Scam Targets Your Computer (October 21, 2026); Botcrawl, Social Security Email Scam Delivers ScreenConnect Malware Through Fake SSA Notices; Federal Trade Commission, ReportFraud.ftc.gov. Last updated October 2026.