I got phished

Couple of tells in the 2nd sentence of the message itself. The common noun "phone" is capitalized and the wording of the sentence is unprofessional sounding.
Check the headers and see if it looks like this where it shows ssa.gov handing off to your email server:
Received-SPF: Pass (protection.outlook.com: domain of ssa.gov designates 137.200.4.65 as permitted sender) receiver=protection.outlook.com; client-ip=137.200.4.65; helo=sscbulk18.ssa.gov; Received: from sscbulk18.ssa.gov (137.200.4.65) by HE1EUR04FT006.mail.protection.outlook.com (10.152.27.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.19 via Frontend Transport; Sat, 1 Jun 2019 08:37:56 +0000 X-IncomingTopHeaderMarker: OriginalChecksum:GYUJTDFYHU1A76FB4432F4EF76876B72C 567791AB;UpperCasedChecksum;FE4399AB59B080DFF29C36 1D4A17F733D532029555545FF289E4234AB2E33;SizeAsRece ived:1308;Count:11 Received: from nsc-prd-mail-bulk-039.ssa.gov (unknown [10.24.29.41]) by sscbulk18.ssa.gov (Postfix) with ESMTP id 4GD7FlGTyz3
 
Last edited:
More notes, "nsc" is National Support Center, located near Frederick, MD. "ssc" is Secondary Support Center, located in North Carolina (both replaced the NCC, which was at HQ in Woodlawn, MD). Those server names also follow the usual internal naming standard. So that header checks out.
 
The approval should show on your mySS account. My husband applied iJanuary 1st for an April start and it shows it’s approved in his account. But won’t get a letter until the middle of April it says.
I applied on January 9th for a benefit start in March (first SS check in April), and all I get is a goose egg (I really want to say a middle finger because that's how it feels right now). "We started step 2 of 3 of the review process for your application."

I wonder since I also checked the box in the SS application to start Medicare in April if that has slowed down the process. Most here have said to be patient, but as time has gone on, I keep reading about situations such as yours where someone has been approved on a similar timeline.
 
Last edited:
The first indication that my Social Security application was approved was when that first check was deposited in my bank account. The website never showed any status beyond Step 1 "Received". I finally got an approval letter in the mail a week after the check had already arrived.
 
More notes, "nsc" is National Support Center, located near Frederick, MD. "ssc" is Secondary Support Center, located in North Carolina (both replaced the NCC, which was at HQ in Woodlawn, MD). Those server names also follow the usual internal naming standard. So that header checks out.
The OP never posted a header and disappeared. The header I posted was from one of my ssa.gov emails, which I know was legitimate as an example.
 
The OP never posted a header and disappeared. The header I posted was from one of my ssa.gov emails, which I know was legitimate as an example.

Yes I know. I was listing these details for everyone else that may want to check an email header from an SSA email, so they know what to look for. Since this was a corollary to my job at SSA.
 
Stupidly, I moved the bogus SSA email to my spam folder and it got deleted. I did send a copy to the SSA inspector's office.

Another place where I screwed up: The automated answering recording I got when I opted for a callback instead of waiting on hold gave me a phone number to look for. I should have googled that number as well: (800) 997-9540. Robokiller rates the call positive, but when you look into the comments it's reported as a social security scam line.

https://lookup.robokiller.com/p/800-997-9540
 
Stupidly, I moved the bogus SSA email to my spam folder and it got deleted. I did send a copy to the SSA inspector's office.

Another place where I screwed up: The automated answering recording I got when I opted for a callback instead of waiting on hold gave me a phone number to look for. I should have googled that number as well: (800) 997-9540. Robokiller rates the call positive, but when you look into the comments it's reported as a social security scam line.

https://lookup.robokiller.com/p/800-997-9540

If you sent a copy via email, the copy is probably still in your sent folder.

I don't know anything about that specific phone number so I'm not saying it's not a scam.
But be aware that these "scam/spam caller databases" are just people clicking to report a number... and sometimes people are ornery. You can check legit phone numbers from Wells Fargo, Fidelity, etc. and they will have instances of being reported as spam/scam by someone.
 
Stupidly, I moved the bogus SSA email to my spam folder and it got deleted. I did send a copy to the SSA inspector's office.
I just made the same mistake (deleting it first). The email I got was a notification of a statement from SSA. Given I have been waiting two months to determine if I will start receiving SS next month, along with starting Medicare, I was excited at first. Until I noticed the link provided went to a Google Drive address.
 
I should have googled that number as well: (800) 997-9540. Robokiller rates the call positive, but when you look into the comments it's reported as a social security scam line.

https://lookup.robokiller.com/p/800-997-9540
Any number you're receiving a call from, even if it's legitimate, could be spoofed by the calling party. So, you can't fully trust any number as legitimate unless you're making the call based on a legitimately publicized number. Although as mentioned earlier, the protections from spoofing appear to be improving through telecommunication companies. That might explain why I don't get so much spam calls anymore, many which used to show my area code.
A copy won't have the original header info. You must have the original incoming email.
That's true, unless the entire email is encapsulated into a new email, which I've never had anyone do when I worked in IT and got forwarded "concerning" emails.
 
Last edited:
If you sent a copy via email, the copy is probably still in your sent folder.

I don't know anything about that specific phone number so I'm not saying it's not a scam.
But be aware that these "scam/spam caller databases" are just people clicking to report a number... and sometimes people are ornery.

You mean people are not good and nice?? :angel:
 
I'm afraid I had to walk away for a while from the forum's delve into my unfortunate error. My goal was just to warn people that these phone scams are getting sophisticated. I thought I was too smart to fall for them, but they got me.
 
I'm afraid I had to walk away for a while from the forum's delve into my unfortunate error. My goal was just to warn people that these phone scams are getting sophisticated. I thought I was too smart to fall for them, but they got me.
Thanks for sharing, even if there is some uncertainty on whether the original email was actually from ssa.gov. The scam could have worked, either way.
 
Any number you're receiving a call from, even if it's legitimate, could be spoofed by the calling party. S... That might explain why I don't get so much spam calls anymore, many which used to show my area code.

I get as much spam calls as ever. It is trivially easy for callers to spoof the caller ID to show anything they want it to be.

The callers seem to rotate, probably a list of numbers to call gets passed around to other scammers.

For a long time I was getting calls from "Experian, about your credit report".
Then it was something else.
Then it was dead air for 10 seconds then a "bloop" sound--whereupon I just hung up.

Now I am getting a dozen calls a day that nomorobo is catching. You can tell those by the ring cutting off before the first ring is complete. For the longest time, more than a year, there were none of these. I got ot thinking that nomorobo wasn't working anymore.
 
How !@#$ ironic and timely. Just TODAY I got a SSA phishing email. Obviously incorrect header info (came from an outlook.com server) with a fake return email address. Deleted!
 
I get as much spam calls as ever. It is trivially easy for callers to spoof the caller ID to show anything they want it to be.

The callers seem to rotate, probably a list of numbers to call gets passed around to other scammers.

For a long time I was getting calls from "Experian, about your credit report".
Then it was something else.
Then it was dead air for 10 seconds then a "bloop" sound--whereupon I just hung up.

Now I am getting a dozen calls a day that nomorobo is catching. You can tell those by the ring cutting off before the first ring is complete. For the longest time, more than a year, there were none of these. I got ot thinking that nomorobo wasn't working anymore.
It shouldn't be as trivial as before, but it depends on the carriers apparently, which I thought were supposed to have been implemented by now. I can tell you that I regularly used to get unknown callers originating from the same area code (most certainly spoofed). And I haven't gotten any of those in a long time and get few others. I did get 2 calls in late February from a different area code, and they were autoblocked by Android's call spam blocker. I don't have any apps installed for blocking anymore because it hasn't been an issue. I'm using T-mobile via Tello.

See:
https://www.fcc.gov/call-authentication
 
Last edited:
I get as much spam calls as ever. It is trivially easy for callers to spoof the caller ID to show anything they want it to be.

The callers seem to rotate, probably a list of numbers to call gets passed around to other scammers.

For a long time I was getting calls from "Experian, about your credit report".
Then it was something else.
Then it was dead air for 10 seconds then a "bloop" sound--whereupon I just hung up.

Now I am getting a dozen calls a day that nomorobo is catching. You can tell those by the ring cutting off before the first ring is complete. For the longest time, more than a year, there were none of these. I got ot thinking that nomorobo wasn't working anymore.


In the last year I've noticed a precipitous drop in the number of spam call I get. I use T-Mobile.
 
I should clarify that I responded to an email. Phone providers are not germaine to my experience. Just to clarify.
 
I'm afraid I had to walk away for a while from the forum's delve into my unfortunate error. My goal was just to warn people that these phone scams are getting sophisticated. I thought I was too smart to fall for them, but they got me.

Hey, we all think that way. I know I am better than I used to be detecting these scams (and a little better than DW :hide:), but any of us could fall one at the right time and place.

Thanks for sharing what happened to keep us all alert.
 
Back
Top Bottom