The Social Security Administration has closed one of the oldest routes that thieves used to steal retirement checks: a beneficiary can no longer redirect a benefit payment to a new bank account by calling the agency’s phone line. Routing changes must now be made through a verified online account or in person at a field office, a deliberate barrier aimed at the deposit-hijacking scheme in which a caller poses as a beneficiary and reroutes the monthly payment before anyone notices. The change trades a few minutes of added friction for the elimination of a fraud that could drain an entire month’s benefit with a single phone call.
The phone-based theft this rule shuts down
Direct-deposit fraud worked because the telephone offered anonymity that a bank branch does not. A criminal who had assembled a target’s name, date of birth, and Social Security number could call, impersonate the beneficiary, and ask that future payments go to an account the thief controlled. Because the change took effect quietly between benefit cycles, victims often discovered the theft only when a check failed to arrive, by which point at least one payment had already been captured.
Removing the phone channel matters because it forces the fraudster onto ground where identity is harder to fake. An online change runs through the agency’s credential system, and an in-person change requires a photo identification presented at a counter. Neither is impossible to defeat, but both demand more than the recited personal facts that made the phone method so efficient. The restriction narrows the attack to methods that leave a stronger trail and take more effort, which is the point of the friction. The change appears in an overview of the agency’s recent policy changes, listed among a set of identity-protection measures tightening how account details can be altered.
Free retirement updates: Scam calls targeting retirees change every week. Our free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
The two channels that still work
The agency now routes legitimate banking changes through a personal my Social Security online account, where a beneficiary signs in with verified credentials and updates the deposit information directly. Establishing that account is itself an identity check, requiring the person to confirm details that match the agency’s records and, in most cases, a second verification step tied to a phone or email the beneficiary already controls.
For anyone who cannot or prefers not to manage the change online, the field office remains open. An in-person visit lets a beneficiary present identification and make the update at the counter, and it serves as the fallback for people who never set up an online account or who have been locked out of one. The practical effect is that the agency has not removed the ability to change a deposit account, only the ability to do it through the one channel that could not reliably confirm who was calling.
The restriction fits a broader tightening of how the Social Security Administration verifies identity across its services, part of a push to close the routes that let a caller act as someone else using only stolen personal data. Layering the change onto the online and in-person channels means the same credential and document checks that already guard other sensitive account actions now guard the deposit account as well. That consistency is deliberate, because a fraud channel is only as strong as the weakest way in, and the telephone had become that weak point.
What the change asks of beneficiaries
The main adjustment falls on people accustomed to handling everything by telephone, who will find that a bank switch now requires either a login or a trip. That is a real inconvenience for beneficiaries without internet access or reliable transportation, and it is the cost the agency has decided is worth paying to close the fraud. The tradeoff is deliberate: convenience for everyone is reduced slightly so that impersonation over the phone can no longer move a payment.
The measure also changes how a beneficiary should read an unsolicited contact. A call, text, or email claiming that a deposit account must be updated by phone now contradicts the agency’s own procedure, which makes any such request a signal of fraud rather than a routine notice. Under the current rules there is no legitimate telephone path to reroute a payment, so a demand to do exactly that is itself the warning.
That inversion is the quiet value of the rule for an audience that scammers target relentlessly. Where the phone channel once forced beneficiaries to guess whether a caller was genuine, the procedure now supplies the answer: any pressure to move a payment over the phone is inconsistent with how the agency operates, no matter how convincing the caller sounds or how much personal information they recite. A rule that removes the ambiguity is worth more than a warning that merely urges suspicion, because it gives people a fixed line to hold rather than a judgment call to make under pressure.
Closing the phone channel does not end benefit fraud, since criminals adapt to whatever barrier is raised, but it removes the specific low-effort method that made deposit hijacking attractive. The lasting significance is that the safest way to change where a Social Security payment lands is now the same as the way to verify one has not already been changed: signing into the account or standing at the counter, where identity is confirmed before any money moves.
This article was produced with AI assistance and reviewed by The Money Overview editorial team.
More Financial Reading
