Millions of Americans who depend on Social Security payments face a specific, documented threat: someone else can log into a my Social Security account and redirect monthly deposits to a different bank. A review by the Social Security Administration’s Office of the Inspector General found that from October through December 2023 alone, 3,109 beneficiaries had their direct deposit changed by SSA’s national 800-number staff and later reported they never authorized the switch. Locking electronic access to the account takes roughly two minutes and shuts down the primary digital pathway scammers exploit.
Why direct-deposit diversion is a live threat in 2025
SSA has allowed beneficiaries to change direct deposit information online since 2012, according to OIG congressional testimony on identity fraud. That convenience created an attack surface. Anyone who gains access to a beneficiary’s login credentials can navigate to the profile settings and reroute payments to a new account. SSA also accepts changes through its 800-number and through bank-initiated automated enrollment, giving fraudsters multiple entry points.
The OIG’s findings, published in a September 2025 news release, confirmed that many beneficiaries did not always authorize the telephone-initiated changes that diverted their deposits. The 3,109 recorded cases in just three months represent only the subset routed through SSA’s call center. No published OIG data breaks out how many additional diversions occurred through the online portal during the same period, leaving the full scale of the problem unclear.
SSA does send alerts when someone attempts to change an address or direct deposit on a verified account, according to the agency’s own scam-protection page. But an alert is useful only if the real account holder sees it in time and knows how to act. Scammers who already control the login can update email, phone, and mailing details before the beneficiary reacts, potentially intercepting or suppressing future warnings.
For older beneficiaries, people with limited internet access, or those who rely on family members or caregivers to manage their accounts, the risk is compounded. A criminal who redirects a single month of benefits can create immediate hardship; if the diversion continues for several months before detection, the victim may face rent arrears, utility shutoffs, or skipped medications while SSA investigates and restores payments.
How the electronic-access block compares to the 30-day hold
SSA currently applies a 30-day hold on online direct-deposit changes made through my Social Security. The agency explains that this delay is meant to give beneficiaries time to notice and report unauthorized activity before funds begin flowing to a new account. Telephone-initiated changes, however, do not carry the same automatic hold, which helps explain why the OIG’s investigation focused on the 800-number channel where diversions can take effect more quickly.
The electronic-access block is a separate, stronger measure. After a beneficiary requests it by phone, SSA locks both automated telephone access and online access so that, in the agency’s words, “No one, including you” can view or change personal information through those channels. Reversing the block requires proving identity in person, typically at a local office, which makes it far harder for a remote attacker to undo. SSA’s public services widget highlights this option as a way to add a layer of protection beyond passwords and multifactor codes.
By contrast, the 30-day hold is a passive safeguard: it slows down a change but does not prevent someone with stolen credentials from attempting one. A determined fraudster might still succeed if the victim overlooks the notification or cannot reach SSA in time. The access block, while less convenient for people who like to manage benefits online, effectively removes the digital channel that scammers most often exploit.
What beneficiaries can do now
Beneficiaries who are comfortable managing their accounts online can reduce risk without giving up digital access entirely. Using strong, unique passwords and enabling multifactor authentication help protect the login itself. Regularly reviewing account details and bank statements can catch suspicious changes early. If anything looks wrong, calling SSA directly and documenting the date, time, and representative’s name can speed up any later investigation.
Those who rarely use the my Social Security portal, or who feel uneasy about online financial tools, may want to consider requesting an electronic-access block as a proactive step. This is especially relevant for people who have already experienced identity theft, data breaches, or phishing attempts. The trade-off is that future updates, such as address or account changes, will require an in-person visit, but the upside is a much smaller attack surface for remote criminals.
Anyone who does choose to manage payments online should understand how to legitimately update direct deposit information through SSA, and be wary of unsolicited calls, texts, or emails urging them to “fix” their account. SSA emphasizes that it does not suspend Social Security numbers, demand immediate payment, or request banking details through aggressive or threatening messages. When in doubt, beneficiaries should hang up or ignore the message and contact SSA using a verified phone number or website.
Direct-deposit diversion is not an abstract cybersecurity issue; it is a tangible risk to monthly income for millions of retirees, disabled workers, and survivors. Understanding the difference between a 30-day hold and a full electronic-access block, and choosing the level of protection that matches one’s comfort with technology, can make the difference between a quickly resolved scare and a prolonged financial crisis.
Free for readers: The free Retirement Shield newsletter sends plain-English help keeping more of your money in retirement — the scams to dodge, the benefits you’re owed, and what’s changing with Social Security and Medicare, a couple times a week. Get the free newsletter.
