Claim your Social Security account before someone else does

You have a Social Security record. It has an address on the internet, a sign-in page, and a set of controls behind it that include where your benefit payments get deposited. None of that depends on whether you have ever logged in.

Social Security lists what the account does. Request a replacement card. Change your address or direct deposit. Get your Social Security Statement. Review earnings for accuracy. Monitor for unusual activity. Those controls exist for whoever gets through the sign-in page.

So the job is to be the person who gets through it.

What changed in 2025

If you remember a Social Security username and password from years ago, that's gone. The agency's own FAQ page is specific. "Effective June 7, 2025, Login.gov and ID.me are now the only sign in options to access Social Security online services. We have removed the option to sign in using a Social Security username and password."

Social Security describes no migration path. Anyone with an old username creates an account with one of the two providers instead. Login.gov's own page for SSA users puts it as needing "to transition to a new or existing Login.gov account to have continuous access to SSA online services."

Login.gov is the government's own sign-in service, run by the General Services Administration, and Social Security lists it as "Best for" "Most users in the United States." ID.me is the other option, and the agency points users "inside or outside the United States" to it. You need one, not both. Social Security says so directly. "You only need an account with one of these providers."

Creating the account

You need to be 18 or older with a valid email address. Start at ssa.gov/myaccount and pick your sign-in service. Taking the Login.gov lane, here is what it asks for.

An email address. Login.gov's own advice is the useful part. "We recommend a personal email address that you'll always be able to access rather than a work email address." A work address stops being yours the day you leave the job.

A password of at least 12 characters, which "should not include commonly used words or phrases." This is one for the password manager.

At least one authentication method. Login.gov sorts them into two tiers. Its "more secure" list is face or touch unlock on your device, a security key, and a government PIV or CAC card. Everything else, including authenticator apps and text messages, sits in the less secure list. Take one from the top tier if you can, and an authenticator app ahead of text codes otherwise, for the reason laid out in the piece on locking your phone number.

Then identity verification. Login.gov asks for photos of a "U.S. Driver's license, state ID, or passport book/card," and "in some cases, you'll be asked to take a selfie to confirm that you are the owner of your ID." It then sends a code to your phone number.

Two fallbacks may be available if the phone step fails. Login.gov says it "may be able to verify your address by mail instead," with a letter that takes "about 5-10 days" and a code that "will expire 21 days after" you requested it. It also says you "may also be able to verify your identity in person at a United States Post Office near you." Both are slower than finishing it while your ID is in your hand.

What to look at once you are in

Your earnings record. Social Security's own feature list includes "Review earnings for accuracy," and the reason is that your future benefit is computed from those numbers. A missing year or a wrong employer is fixable while you still have the pay stubs and the W-2.

Your Statement, which shows the benefit estimates at different ages and "the estimated Social Security and Medicare taxes you've paid."

If you already receive benefits, the direct deposit screen. "Sign in to your account to update your bank information. This is the fastest way to make changes," the agency says, though it adds that "depending on your benefit type, you may need to call us." Your bank can also send the new details to Social Security for you.

Why the direct deposit part matters

The direct deposit screen is why this belongs in a security column, and the reason comes from the agency's own inspector general.

In a September 2025 release, the Social Security Office of the Inspector General reported on telephone direct-deposit changes it audited from late 2023. It identified 3,109 beneficiaries whose direct deposit was changed that way, and estimated that "approximately 1,197 of the 3,109 (38.5 percent) beneficiaries had benefit payments misdirected" for a total of "$2.2 million," of which about $2 million had not been recovered. That's the group the inspector general examined, rather than a rate across all beneficiaries. It was enough of a problem to change the rules.

What a caller used to need was the ability to confirm information the agency already had on file. As of April 28, 2025, a phone change requires a one-time code that you generate by signing into your own my Social Security account at ssa.gov/PIN. Online changes are no longer held for 30 days, and the agency said in March 2025 that it would process every direct deposit change, in person or online, in one business day.

So the phone route now runs through the online account. Holding the account is what puts you in the middle of a change somebody else tries to make.

The calls that aren't from Social Security

Since we are here, the agency's own anti-scam pages are short and useful.

Social Security "will never ask for sensitive or personal information through social media, email, or text message." The inspector general's list covers the rest. "SSA and OIG will never ask you to transfer money to protect it, meet you in person to exchange cash, gift cards, crypto currency, gold bars, or require you to keep information secret or confidential." And of the agency itself, that it "will never threaten, scare, or pressure you to take an immediate action."

The threat to suspend your Social Security number is on the agency's own list of scammer tactics. A real agency problem survives you hanging up and calling 1-800-772-1213 yourself.

The scale is in the FTC's numbers. Americans reported losing about $920 million to government impersonators in 2025, out of $3.5 billion reported lost to imposter scams overall. Those are self-reported figures, so the real number is higher.

If you want the door closed instead

There's a second option that does the opposite. Social Security calls it Block Electronic Access, and the effect is total. Once it's on, "no one, including you, will be able to see or change your personal information on the Internet or through our automated telephone service."

That includes you. Everything goes back to paper, field offices, and live phone calls. The agency aims the option at people with particular reasons to want nothing reachable online, including identity theft victims and domestic violence victims, and it can be undone by contacting Social Security and asking to unblock it.

For almost everyone else, the account is the better answer, because you cannot use the account and hold the block at the same time.

While you're at it

Two neighboring moves belong to the same afternoon.

The IRS will give you an Identity Protection PIN, a six-digit number that "prevents someone else from filing a tax return using your Social Security number." You opt in, you get a new one every year, and "the fastest way to receive an IP PIN is to request one through your online account." The catch is the renewal. The new number is in the account "starting in mid-January through mid-November," and anyone who enrolled online has to go get it, because the IRS will not mail it to them.

And freeze your credit if you haven't. It's free, it stops new accounts being opened in your name, and it takes three separate requests, one to each bureau.

Do it this weekend

Sit down with your driver's license and your phone in front of you. Go to ssa.gov/myaccount, create the Login.gov account, verify, and then look at your earnings record while you are in there. That last part is the reason people are glad they did it, separate from the security argument.

If you have an old Social Security username in a notebook somewhere, cross it out. It stopped working in June 2025.

Did your earnings record match what you expected? I'd like to hear about any missing years, because I suspect they are more common than anybody thinks. joel@freshfromcache.com