Social Security direct-deposit theft usually leaves no broken lock and no missing card. A thief who has gathered enough personal information can try to reroute a monthly benefit into an account they control, and the first sign is often a payment that simply never arrives. The Social Security Administration lets beneficiaries shut that door in a matter of minutes by locking online access to their record, a free step that stops anyone — including the accountholder — from changing direct-deposit or address details until the block is lifted in person or by phone.
How a deposit-rerouting scam drains a monthly check
The mechanics are simple, and that is exactly what makes them dangerous. A scammer who has assembled a target’s name, date of birth, and Social Security number can attempt to create or take over a my Social Security account, then quietly switch the routing and account numbers so the next payment lands somewhere else. Because benefits arrive automatically, weeks can pass before the missing deposit is noticed, and by that point several payments may already be gone and difficult to trace.
The agency treats unauthorized benefit redirection as a priority category and routes complaints through its fraud reporting channel and the Office of the Inspector General. Clawing diverted funds back is possible but slow, which is why the agency leans so heavily on prevention. A locked record cannot be edited by a stranger who has stolen enough data to impersonate the beneficiary, so the payment stays pointed at the right bank account no matter what information a criminal manages to buy or guess.
Free retirement updates: A quiet rule change can shrink your Social Security or Medicare check, and no one warns you. The free Retirement Shield newsletter catches these early and tells you what to do. Get it free.
The electronic-access block that freezes account changes
Social Security offers a self-requested block on electronic access to a personal record. Once it is in place, no one — not a scammer and not the beneficiary — can change direct-deposit information or a mailing address online or through the automated telephone service. The agency describes the safeguard in its guidance on protecting personal identity, and it is available to any accountholder, not only to confirmed fraud victims who have already lost money.
The block works alongside the account itself at my Social Security, the free portal where beneficiaries view payment history, manage deposits, and check the earnings record that determines a benefit. Setting up that account first, even for someone who has never logged in, denies a thief the chance to register it in the beneficiary’s name — a common opening move in a takeover, since an unclaimed account is far easier to seize than one that already has a verified owner.
The agency has also tightened the front door itself. Since the summer of 2025 Social Security retired its old username-and-password logins and now routes every online sign-in through Login.gov or ID.me, the same credential-verification services the federal government uses across its agencies, forcing a stronger identity check before anyone reaches a record online. That change raises the bar for a criminal working from stolen data, and a beneficiary who claims the account under the newer system ties it to verified credentials that are far harder to reproduce than a guessed password.
Locking the record, and what it takes to lift it
A block can be requested by calling Social Security or visiting a field office, and the agency’s page on how to update direct deposit makes clear that legitimate changes still flow through verified channels rather than an open online form. Removing the block later requires contacting the agency again and confirming identity, so a beneficiary who wants to switch banks down the road trades a few minutes of friction for a far higher wall against theft.
That friction is the point. The safeguard deliberately slows down every change, including the accountholder’s own, on the theory that a monthly benefit rarely needs to move and a criminal is counting on speed and silence. For a retiree who relies on a Social Security deposit to cover rent, groceries, and medication, a payment that disappears for even one month is a genuine emergency, not an inconvenience.
Layered protections make the block stronger still. Beneficiaries can add extra login verification to a my Social Security account, watch for unexpected mail confirming changes they never requested, and report anything suspicious immediately rather than waiting for a missing deposit to force the issue. Each measure closes a different avenue a scammer might use, and together they turn a record that was open by default into one that resists a takeover.
Other locks that close the same door
A frozen Social Security record is one layer, but the same identity a thief uses to reroute a benefit can be turned against a retiree in other systems, and each has its own separate lock. A credit freeze at the three major bureaus stops new accounts from being opened in a person’s name, and it costs nothing to place or lift. The Internal Revenue Service issues a six-digit Identity Protection PIN that must appear on a tax return before a refund can be paid, which shuts down a criminal trying to file a fraudulent return under a stolen number and pocket the money.
Employment is another target that a benefit-focused block leaves untouched. A stolen Social Security number can be used to get hired or claim work authorization, and E-Verify’s Self Lock lets a person place a hold on their own number so that any employer who runs it through the system receives a mismatch until the owner unlocks it. None of these safeguards talks to the others — a beneficiary has to set each one separately — but together they wall off the credit, tax, benefit, and employment systems that a single leaked number can otherwise unlock.
The larger lesson is that the tools already exist and cost nothing. A retiree does not need to wait to become a victim before locking down a benefit, and the handful of minutes it takes to create the account and request a block buys a standing defense against a fraud that can otherwise unfold in silence. In a scam built entirely on speed and stolen data, the beneficiary who has already frozen the record has removed the one thing the thief needs most.
This article was researched and drafted with the assistance of AI and reviewed by The Money Overview editorial team.
More Financial Reading
