The Social Security Administration now stops roughly 70,000 fraudulent attempts each year to reroute beneficiary payments to unauthorized bank accounts. The agency ended routine phone-based direct deposit changes in April 2025 after its own inspector general found that thousands of beneficiaries never approved switches made through the national 800-number. For the roughly 70 million people who receive Social Security payments, the shift means fewer ways for criminals to hijack deposits, but also new steps to complete legitimate bank updates.
Why SSA Shut Down Phone-Based Deposit Changes
The trigger was a three-month audit. The SSA Office of the Inspector General examined calls to the agency’s 800-number between October and December 2023 and identified 3,109 beneficiaries whose direct deposit information was changed during that window. The OIG concluded that beneficiaries “did not always authorize” those changes, meaning someone other than the account holder initiated the switch. Before April 14, 2025, any caller who reached a teleservice representative on the national line could request a new bank routing and account number, according to that same OIG release. Criminals exploited this by impersonating beneficiaries, diverting monthly payments into accounts they controlled.
The agency responded by eliminating that phone channel for deposit changes. SSA’s current guidance lists only two standard paths: the online my Social Security portal and bank-initiated automated enrollment. Beneficiaries who cannot use either option are directed to visit a local field office or call to schedule an in-person appointment, according to SSA’s own announcement of the policy shift. The change is designed to ensure that any new account is either verified through a secure online login or initiated by a financial institution with its own customer-identification procedures, rather than relying on answers to questions over the phone.
A separate safeguard, the Direct Deposit Fraud Prevention block, adds another layer. When this flag is placed on a record, SSA denies any request to establish, change, or cancel direct deposit, whether submitted online or through a financial institution’s auto-enrollment system. The block effectively freezes the payment destination until the beneficiary resolves the issue directly with the agency. In practice, that can mean a temporary delay while the person visits a field office or completes additional verification, but it also prevents repeated attempts to divert payments once a suspicious pattern has been detected.
One-Time PINs and the 70,000 Annual Blocks
SSA did not abandon phone-based identity verification entirely. For beneficiaries who need to complete a deposit change but lack online access, the agency introduced a one-time code workflow. A person generates a Security Authentication PIN at ssa.gov/PIN, then reads it to a representative during a phone call to prove their identity before any transaction proceeds. A March 2026 Federal Register notice confirmed that SSA continues to use this SAP/one-time PIN process for telephone identity proofing tied to direct deposit changes, even after the broader shutdown of routine deposit updates over the 800-number.
Under this model, the phone call alone is no longer enough to redirect a monthly benefit. The caller must demonstrate control over another channel-usually online access to SSA’s website-to obtain the PIN. That extra factor makes it harder for impostors who rely on stolen personal data but lack access to the beneficiary’s devices or email accounts. It also gives SSA a clearer audit trail of who initiated the change and when, which can be critical if a dispute arises about whether a payment was properly authorized.
The hypothesis that these combined measures will produce a measurable drop in successful unauthorized diversions within 12 months rests on straightforward logic. Eliminating the open phone channel removes the easiest attack vector the OIG documented, while the fraud prevention block catches attempts that slip through other channels. The roughly 70,000 annual blocked attempts represent the scale of pressure the system faces and suggest that criminals are still probing for weaknesses even as safeguards tighten.
Whether the successful diversion rate actually falls, however, depends on data SSA has not yet published. No post-audit statistics are available showing how many fraudulent changes were completed before and after the April 2025 policy shift, or how often the Direct Deposit Fraud Prevention block has been used. Without that transparency, it is impossible for outside observers to verify how many beneficiaries have been protected versus how many have experienced delays or complications when trying to update legitimate banking information.
For beneficiaries, the practical impact is a trade-off between security and convenience. People who are comfortable using the my Social Security portal or coordinating changes through their bank may notice little disruption beyond an extra login step. Those without reliable internet access, or who have difficulty traveling to a field office, may find the new process more burdensome. Advocates for seniors and people with disabilities have raised concerns in other contexts that security measures can unintentionally create barriers for the very populations they are meant to protect.
SSA’s challenge now is to refine these tools so they block criminals without locking out legitimate users. Clear communication about the one-time PIN process, realistic appointment availability at field offices, and eventual publication of anonymized fraud and error statistics would help beneficiaries understand what to expect and allow policymakers to judge whether the balance between protection and access is being struck in the right place.
Free for readers: The free Retirement Shield newsletter sends plain-English help keeping more of your money in retirement — the scams to dodge, the benefits you’re owed, and what’s changing with Social Security and Medicare, a couple times a week. Get the free newsletter.
