Social Security Phishing Scam

A phishing campaign targeting users' Social Security Numbers (SSNs) has been uncovered by cybersecurity experts. The initial stage of the scam campaign consists of the dissemination of lure emails presented as if being sent by the U.S. Social Security Administration. However, the real sender is just a random Gmail address. Details about the phishing operations were revealed in a report by the researchers at the email security company INKY.

According to their findings, the lure emails of the phishing campaign try to create a sense of urgency right from their subject line. They often contain the user's email address, Case ID, or a Docket Number in an attempt to appear as official communication about a serious issue. The subject lines of the emails may imply that the user's SSN has been connected to suspicious activity or that it will soon be discarded, discontinued, suspended, etc.

The emails also carry an attached PDF file. The file is not malicious but it adds another supposed layer of legitimacy. When opened, the document will feature prominently the logo of the Social Security Administration and a specific Case Number. The text and scenario presented in the PDF file may vary but it will always encourage the unsuspecting recipients to contact a provided phone number, described as belonging to the agency.

Instead, users will be contacting either the scammers or an operator working for them. The addition of this method known as vishing (voice phishing) could drastically increase the number of people falling for the scam. Once they are on the line, users could be asked to provide sensitive personal details via various social-engineering tactics. Victims could be asked to verify their social security number as well as state their date of birth and name to the phone operators. Users could be asked to provide their bank information or pay a bogus fee in the form of gift cards or a specific cryptocurrency.