How Fraudsters Invade Social Security Accounts and Steal Benefits

For the past two decades, Liz Birenbaum’s 88-year-old mother, Marge, has received her Social Security check on the second Wednesday of every month. It is her only source of income: she pays for her room at a long-term care center, where she ended up last October after a stroke.

When the deposit didn’t arrive in January, they checked into Marge’s Social Security Accountwhere they found some surprising clues: the last four digits of a bank account number that didn’t match hers, at a bank they didn’t recognize.

“Someone had come in,” said Ms. Birenbaum of Chappaqua, NY. “Then I pressed a panic button.”

It quickly became clear that a fraudster had forwarded the $2,452 benefit to an unknown Citibank account. Marge, who lives in Minnesota, had never banked there. (Ms. Birenbaum requested that her mother be referred to only by her first name to protect her from future fraud.)

Mrs. Birenbaum immediately started calling to straighten things out. When she finally made contact with a Social Security representative from a local office in Bloomington, Minnesota, the representative casually mentioned that this happens “all the time.”

“I was astounded,” Ms. Birenbaum said.

Social Security-related scams are generally ubiquitous: Fraudsters pose as employees and attempt to extract both money and valuable identification information from people in all kinds of evolving schedules. But this particular fraud — in which criminals use stolen personal information to break into online Social Security accounts or create new ones, and divert benefits elsewhere — has plagued people for more than a year. a decade.

Once fraudsters gain access to an individual’s online Social Security account, they can change the beneficiary’s address and submit deposit information directly, or request replacement cards.

Almost everyone is a potential target. The Social Security Administration sends checks to more than 70 million beneficiaries, including retirees and the disabled, at a total cost of nearly $120 million per month. An estimated 2,000 beneficiaries had their direct deposits diverted last year, according to Social Security Administration anti-fraud officials.

It can be a lucrative fraud and a devastating advantage to lose. According to the most recent audit from the Office of the Inspector General, an independent group responsible for overseeing investigations and audits at the Agency. Another $23.9 million in fraudulent redirects were prevented before they occurred during the same period.

“Fraudsters were able to obtain enough information about a real beneficiary to convince the Social Security Administration that they were that beneficiary,” said Jeffrey Brown, deputy assistant inspector general at the Office of the Inspector Generalthat the issue in 2019. “Once they got in, they were able to change their direct deposits.”

Social Security scams increased during the pandemic, according to OIG officials, when Social Security offices were closed to the public, forcing people to rely on the agency’s online services.

The Federal Trade Commission, which collects self-reported complaints from consumers, said more than 7,600 people reported having their benefits pushed back from 2019 through the end of 2023, with an increase in activity last year.

“Many consumers are telling us that they have discovered that their direct deposit has been diverted to another account or a fraudulent account,” said Maria Mayo, deputy director of the FTC’s Division of Consumer Response and Operations. “Often they say they got a call from an imposter and they gave them information, and they believe that information was used in that way to divert the benefit.”

In another twist, there were roughly 6,100 fraudulent claims last year, or 0.3 percent of all Internet-initiated retirement claims, involving criminals who filed for benefits on the earnings records of Americans who had reached retirement age but had not yet received benefits had requested. Social Security anti-fraud officials said.

Criminals use a variety of methods to gather the personally identifiable information they need, which they later use to break into government accounts or create fraudulent accounts. You need a Social Security number to create an online account with the agency, but you don’t need the full nine digits to crack an existing number.

Amy Nofziger, director of fraud victim services at AARP Fraud Watch Network, recently went through her database of cases and came across a handful of victims whose Social Security numbers were obtained by a third party within the past six months. An unsuspecting person gave it to an imposter who promised insurance subsidies. Another criminal posed as a representative of the victim’s bank. In yet another case, the fraudster pretended to be calling from a credit bureau to verify the victim’s Social Security number.

Sometimes identity thieves claim they are calling from a doctor’s office, and in other cases they can compromise someone’s device and collect valuable information such as passwords or other stored personal data.

When collecting various identifying information about a person, fraudsters can also turn to marketplaces on the dark web, where a lot of personally identifiable information – often stolen through security breaches – is available for sale.

Pam Dixon, executive director of the World Privacy Forum, a research group focused on data management and protection, said people living in medical or assisted living facilities are also often vulnerable to these crimes. “It’s one of the ugliest forms of identity theft,” she added.

Just months before Marge’s benefits were diverted, the OIG was issued a report that said the administration’s portal, called My Social Security, did not fully comply with federal identity verification requirements: It said it did not go far enough to verify and validate the identities of new registrants in all cases. And once an account has been created through one of two identity verification portalswhat is required to access my Social Security account, the agency does not require users to re-verify their identity with strong enough evidence (such as presenting a driver’s license along with a selfie, for example).

This was not the first time the independent investigators found shortcomings date back to the introduction of the my Social Security portal in 2012. The Office of the Inspector General recommended strengthening the digital identity verification process in 2016, and while the agency has made several improvements, OIG officials said it is still not fully complied with the rules when it issued its report. last audit in 2023.

The Social Security Administration said it had implemented several of the agency’s recommendations since the portal’s introduction, including adding a fraud analysis team for investigations. The agency has also updated its identity verification process to respond to emerging threats, it said, and is planning further updates.

“Our office continuously analyzes online transactions and we look for abnormal behavior. As we see new features, we flag them and implement additional controls to stop any behavior that may be fraudulent,” said Joe Lopez, Deputy Assistant Commissioner for Analytics. assessment and supervision in social security.

“The environment is constantly evolving,” he added, “and we adjust our models as necessary.”

The Social Security Administration is sending notices by mail to beneficiaries asking them to contact the agency if they did not consent to a recent change in their direct deposit information, which has thwarted millions of dollars in benefits because they were diverted and lost, they said OIG officials. It is also possible to block changes to the accounts.

The problem would have been impossible for someone like Marge to solve on her own. It was challenging enough for Ms. Birenbaum, a marketing consultant, and her brother, who lived near their mother in suburban Minneapolis, who worked together to get the benefits back and secure Marge’s account.

Ms. Birenbaum — who reported the crime to the OIG and the FBI and alerted her state and federal representatives — once spent two and a half hours on hold at the Social Security Administration before contacting a regional caseworker. The representative was able to see that her mother’s direct deposit information had changed in early December, the month before benefits disappeared.

Mrs. Birenbaum’s brother visited their mother’s local Social Security office and became Marge’s “representative beneficiary”, allowing him to manage her affairs (social security does not accept powers of attorney). They had to find ways to make the correction without bringing Marge into the office, which, according to Mrs. Birenbaum, would have been a “Herculean task.”

Marge received the missing money on March 1, about a month and a half after they discovered the problem.

“For her it ended on a happy note,” Ms. Birenbaum said, “but for many, who don’t have lawyers pushing every day, cybercriminals are winning.”

How to protect yourself from Social Security fraud

Consider locking your accounts. make a my social security accountbut then add one block e-services, a feature that prevents anyone, including you, from seeing or changing your personal information online. You must contact your local office to remove it.

Another feature, a direct deposit fraud prevention blocker, prevents anyone from signing up for direct deposit or changing your address or direct deposit information through your online account or a financial institution. You will need to contact a local office to make any changes or unblock.

Don’t trust, also verify. If your phone’s caller identification says “Social Security Administration,” don’t trust it: the number may be spoofed and only the agency to call to action beneficiaries in limited situations. Call the agency back at the main number 1-800-772-1213 or call a local location at office seeker.

Report suspected scam And fraud to the Office of Inspector General website or call 1-800-269-0271.

Contact the Federal Trade Commission if you suspect someone has used your personal information Through his website or call 1-877-IDTHEFT (1-877-438-4338).

Judgement from the Social Security Administration source page on how to spot a scam.