"Dear Beneficiary" is the tell

The subject line reads "Statement Support Was Posted to Your Account Details Report", which is clumsy enough that you would think nobody would fall for it. Plenty do, because everything underneath looks right: the SSA logo, tidy official formatting, a sender name of "Social Security Administrator" and a blue button marked View statement.

Expand the sender and the whole thing collapses. The address behind that friendly display name sits at loradmiadministraciones.com, which has no connection to the US government and, more to the point, does not end in .gov. Real Social Security email comes from .gov addresses, full stop. The second tell is the greeting. "Dear Beneficiary" is what you write when you have bought a list and do not know who is on it. Click the button and you land on a page built to harvest the login to your my Social Security account, or to put something on your PC.

The Social Security Administration's Office of the Inspector General flagged a "significant increase" in exactly this sort of message back in February, and the campaign has not gone away because it keeps paying. Their advice is unglamorous and correct: official mail never arrives demanding immediate payment, never comes with unsolicited attachments, and never asks for gift cards. If a message is pushing you to act now, that urgency is the product.

The habit that makes the whole thing moot is reaching your account without touching the email. Type ssa.gov/myaccount into the address bar, sign in there, and see whether a statement is actually waiting. Suspicious messages go to oig.ssa.gov/report. If you already clicked and something installed itself, change the password from a known-good device first; Tendvane's Safety check lists what has recently appointed itself to start with Windows, which is usually where that kind of thing shows up.