Scammers copy Social Security statement emails down to the agency logo
Fake sender hides behind non-government domain loradmiadministraciones.com, the real agency sends official mail through echosign.com and approved marketing firms
Images
'We know how to find you': FBI issues direct video warning to ShinyHunters hacking group
foxnews.com
A fake Social Security statement email
foxnews.com
A fake Social Security statement email
foxnews.com
A person typing on a laptop
foxnews.com
Scammers are circulating emails that reproduce the Social Security Administration's statement notifications down to the agency logo, the subject line and the blue "View statement" button. The agency's Office of the Inspector General has warned of the campaign since February, and the copies are close enough that the official countermeasures amount to a forensics exercise.
The fake message carries the subject line "Statement Support Was Posted to Your Account Details Report" from a sender displayed as "Social Security Administrator." It announces that the recipient's 2025 statement is ready, shows a formatted box with the year and the status "Ready," and invites the recipient to review an earnings record and benefit estimates online. The web address displayed in the message appears to be the agency's own. The sender's actual domain is loradmiadministraciones.com, which has no relationship to the agency and does not end in .gov.
The campaign works because it copies mail the government genuinely sends. An official statement notification arrives uninvited, concerns money the recipient cannot afford to ignore, and is built around a button to click. The recipient has no way to verify any of it except by inspecting the sender — and the agency's own guidance concedes how little that inspection yields: most legitimate SSA emails come from government addresses, but the SSA confirms it also sends some communications through authorized outside services, including echosign.com and approved marketing firms. Every genuine statement that lands unbidden in an inbox trains the recipient to open the next one; the scam inherits the format at no cost.
The advice the agency gives is to examine the complete sender address and verify any unexpected request independently — a test its own authorized senders would not always pass.