A retiree’s Social Security payment can be redirected to a stranger’s bank account without a single forged signature, using nothing more than the agency’s own website. Fraudsters who obtain enough personal information can create or hijack an online account and change the direct-deposit details, quietly steering a monthly check somewhere else. The defense costs nothing and takes only minutes: claiming the online account first, or asking Social Security to freeze the record, closes the door that these schemes rely on. For anyone living on a fixed benefit, it is one of the highest-value security steps available.
How a deposit gets rerouted without a break-in
The vulnerability is not a hacked bank; it is the beneficiary’s own file at Social Security. Direct-deposit information can be updated through a personal my Social Security account, and that convenience is exactly what a thief exploits. Armed with a name, date of birth, and Social Security number, often bought from a data breach, a fraudster tries to open an online account in the beneficiary’s name or take over an existing one, then changes where the payment lands.
Because the money keeps flowing on schedule, the theft can go unnoticed until a check simply fails to arrive. By then the payment has already been sent to an account the beneficiary cannot see, and unwinding it means proving the change was fraudulent and waiting for the agency to correct the record. The people most exposed are those who have never set up an online account at all, because an unclaimed record is the easiest one for someone else to claim first.
That is the logic behind the single most effective move: creating a personal my Social Security account before anyone else can. The agency no longer issues its own passwords and instead verifies identity through outside credential partners, tying the record to one secured login, so a stranger who later tries to register with stolen data runs into an account that already exists and identity checks they cannot pass. Setting up that login is the digital equivalent of claiming a seat before someone else sits in it, and it is why security experts describe an unregistered Social Security record as the vulnerable one.
Free retirement updates: A quiet rule change can shrink your Social Security or Medicare check, and no one warns you. The free Retirement Shield newsletter catches these early and tells you what to do. Get it free.
The blocks that freeze a benefits record
Beyond claiming the account, Social Security offers two stronger locks for people who want the record sealed. An electronic-access, or eServices, block prevents anyone, including the beneficiary, from viewing or changing personal information online, which shuts down the digital path a scammer would use. A separate Direct Deposit Fraud Prevention block freezes the banking and address details specifically, so the account number on file cannot be swapped and mail cannot be redirected.
The tradeoff is deliberate friction. Once either block is in place, future changes generally cannot be made online or over the phone; the beneficiary has to visit a local field office in person to lift the block or update information. For someone who rarely changes banks and wants maximum protection, that inconvenience is the point, because the same barrier that slows the account holder down stops a thief cold. The agency’s fraud-prevention resources explain how to request the blocks by phone.
Neither block interrupts the money itself. Payments continue to arrive on the normal schedule while the record is frozen, because the lock governs who can alter the file, not whether the benefit is paid. That distinction matters for anyone who hesitates to add security out of fear it will delay a check; the deposit keeps coming, only the ability to reroute it is removed.
Why the quick step is worth taking now
The reason to act before anything goes wrong is that recovery is far harder than prevention. Reversing a fraudulent deposit change means reporting the theft, documenting that the update was not authorized, and waiting through a correction process while a benefit a household depends on sits in someone else’s account. Setting up the account or requesting a block ahead of time avoids that entire ordeal.
The same login also doubles as a monitoring tool. A beneficiary who checks the account periodically can confirm the deposit destination has not changed and review the earnings and payment history for anything unfamiliar, turning a security setup into an ongoing early-warning system. Social Security’s own guidance on protecting personal information points people toward the account as a first line of defense rather than a last resort.
None of this requires special expertise or expense. Claiming the online record takes a few minutes and a working email, and requesting a block takes a phone call. The same holds for beneficiaries who rely on a family member or representative payee to manage their money, since the account and the blocks can be arranged on their behalf and reviewed together. Against the alternative, a monthly benefit quietly diverted and the weeks of paperwork it takes to claw back, the effort is trivial. The reroute scheme works only when the record is left open, and closing it is squarely within any beneficiary’s control.
This article was produced with AI assistance and reviewed against primary sources by The Money Overview editorial team.
More Financial Reading
