The Social Security Administration lets account holders freeze the electronic side of their record in about the time it takes to read a benefit letter, and that single control defeats the fastest-moving theft aimed at older Americans: the redirected direct deposit. A locked online account cannot be used to change a bank routing number, a mailing address, or a payment election until the owner deliberately unlocks it. The step is free, reversible, and takes roughly two minutes, yet a large share of beneficiaries have never switched it on, leaving open the one door a thief actually needs.
The anatomy of a redirected-deposit theft
A deposit hijack rarely starts with a hacked bank. It starts with a criminal who has already assembled a target’s Social Security number, date of birth, and address, usually bought from a data breach or coaxed out through a phishing call. Armed with those details, the thief creates or signs into the victim’s online account and quietly edits one field: the direct deposit destination. Nothing appears broken on the victim’s end until a monthly payment simply fails to arrive, by which point the money is gone.
The rerouted funds move to a prepaid card or a mule account and are withdrawn within hours, which is why recovery is slow and frequently incomplete. The account credential is the lever the entire scheme turns on, because the same my Social Security portal that lets a genuine beneficiary manage payments lets an impostor reroute them. The event is not a technical breach of the agency’s systems; it is the misuse of a legitimate self-service tool by someone holding stolen identity data.
That distinction explains why a stronger password alone does not close the gap. A thief working from stolen personal information can attempt to establish an account in the victim’s name before the victim ever registers one. Once the electronic profile is claimed by the wrong person, that person controls the channel. Freezing the record removes the ability to make changes through it at all, regardless of who holds the login or how convincing their story sounds.
Free retirement updates: Scam calls targeting retirees change every week. Our free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
What the freeze blocks, and what it leaves exposed
Locking the account suspends online access to the record until the owner lifts it, so no routing number, mailing address, or benefit election can be altered through the website while the block holds. The measure complements a separate tightening of the agency’s phone line, where representatives now route direct-deposit changes to online verification or an in-person field office rather than processing them over the telephone. Together the two steps close the remote paths a scammer most often exploits, forcing any change through a channel the account holder controls.
The freeze is not total protection, and treating it as such would be a mistake. It does nothing about a forged change-of-address filed on paper, a caretaker with physical access to documents, or funds already diverted before the lock went on. It also does not undo the underlying identity theft: a criminal holding the same data can still target a bank, a brokerage, or a tax refund. The lock secures one specific and heavily attacked channel, not a beneficiary’s entire financial identity.
Understanding that boundary is what makes the tool useful rather than falsely reassuring. The redirected deposit is attractive to thieves precisely because it is high-value and low-effort, converting months of guaranteed income with a single edit. Sealing that edit changes the math for the attacker without pretending to solve every other exposure a stolen Social Security number creates.
Turning the block on, and off
Switching the control on runs through the account’s security settings, where the holder chooses to block electronic and automated telephone access; reversing it follows the same path and takes effect once the owner reconfirms their identity. The design deliberately puts the on-off switch in the beneficiary’s hands rather than a call center’s, so a caller impersonating the account holder cannot talk a representative into undoing it. Registering an account and then locking it also denies a thief the chance to open one first, since an unclaimed record is easier to seize than a claimed and frozen one.
Anyone who spots a payment that never landed or a change they did not authorize can report it to the agency’s Office of the Inspector General, which investigates benefit fraud and identity misuse. Timing is decisive, because diverted deposits are pulled from mule accounts quickly; the sooner the agency and the receiving bank are alerted, the better the odds of recovering a payment. The report also feeds the broader fraud picture the agency uses to spot patterns across accounts.
The economics are what make the two minutes worthwhile. A criminal who has already invested in a stolen identity needs exactly one successful edit to turn a retiree’s benefit stream into cash, and the online record is where that edit happens. Removing the ability to make it turns a lucrative, repeatable target into a dead end, which is a rare instance where a free administrative step meaningfully outmatches the threat it addresses.
What the option cannot do is substitute for watchfulness across the rest of a household’s accounts, because the same information that threatens a Social Security record threatens everything tied to it. The lock is best read as sealing the single most-attacked entry point rather than as a verdict that the identity behind it is safe. For a payment millions rely on to the dollar each month, closing that one entry point is the step that most directly protects the check.
This article was produced with AI assistance and reviewed by The Money Overview editorial team.
More Financial Reading
