Reporting fraud and identity theft (SSA OIG)

The call came in the afternoon. A man who said he was "Officer Kevin Harris" from Social Security told Manny his number had been suspended — flagged for criminal activity tied to his name in Texas and Mexico — and that a warrant was out unless he cleared it with gift cards, today. Manny, 78, is sharp, but he was rattled enough to write down a callback number before he hung up. He didn't pay. But he was shaken, and so is his daughter Anita — furious, and stuck on one question: *now what?*

That's where most people freeze. Two thoughts arrive at once, and both are paralyzing. The first: *"Where do I even report this?"* The second, quieter and more corrosive: *"What's the point — nothing will come of it anyway."* This lesson answers both, plainly. There are clear, specific places to report — one right form, one right number for each kind of trouble — and reporting genuinely matters, even when your own money can't be recovered. We'll walk Anita through it, start to finish.

One boundary first, because it's the difference between this lesson and the last one. Lesson 149 taught you how to *recognize* the scam — the impersonation call, the text, the four tells (pretend, problem, pressure, pay). Manny already cleared that bar: he knew it was fake. This lesson is what you do *after* you know — the reporting itself. And Lesson 152 picks up the harder case, where money actually moved or a number was actually used. Here, nothing was taken. Anita is reporting a near-miss — which, as you'll see, is still very much worth reporting.

The reason "where do I report?" feels overwhelming is that there isn't *one* place — there are four, each owning a different slice. But you don't have to memorize a flowchart. One question sorts almost every case: were you *targeted*, or was something actually *taken*?

• Targeted — a scammer *tried*, but no benefit was stolen and (as far as you know) no number was misused. Manny's near-miss. The lead route is the SSA OIG scam report, and you also log it with the FTC.
• Taken — a benefit is actually being stolen or misused, or a Social Security number has actually been used to open accounts or file a fake tax return. That's the SSA OIG fraud report (for benefit theft/misuse) and identitytheft.gov (for a misused number) — and it's mostly the territory of the next lesson.

Read the card top to bottom and the whole system fits on one page: the SSA OIG for Social Security scams and program fraud; the FTC for scams and identity theft (log here *in addition* to OIG); SSA itself to protect the actual account; and local law enforcement for a crime that crossed a dollar line or when there's an in-person or elder-fraud angle. Most incidents touch two or three of these — reporting isn't either/or, it's *both/and.* Anita will use three of the four before she's done.

The primary route for anything Social Security-shaped is the SSA OIG — the Office of the Inspector General. Every large federal agency has an Inspector General: an independent internal watchdog whose job is to investigate fraud, waste, and abuse in that agency's programs. The SSA's OIG is the office that chases down people who steal benefits, misuse others' funds, and — the part that matters here — run the impersonation scams that target beneficiaries like Manny.

You met the OIG's name in Lesson 149 as the office the scammers *pretend* to be calling from. Here it's the real thing, and it's on your side. Its public reporting front door is oig.ssa.gov/report — a plain government web page, free to use, no account required. That single page is where a Social Security scam or a Social Security fraud gets reported. The trick is that the page offers two different forms, and picking the right one is the first real decision.

This is the single most common mistake people make when they report, so it's worth getting exactly right. oig.ssa.gov/report opens with a choice between two forms — and they are not interchangeable:

• Report a Scam — for when you were targeted by someone impersonating Social Security or the OIG: the phone call, the text, the email, the letter. No actual benefit was stolen; you were the *intended* victim, whether or not you fell for it. This is Manny's form — he was targeted, he paid nothing, nothing was taken.
• Report Fraud — for actual Social Security program fraud: someone collecting benefits they aren't owed, a beneficiary who has died while someone keeps cashing the checks, a person working while claiming disability and hiding the earnings, or a representative payee misusing a beneficiary's money. Here something real is being taken *from the program or from a beneficiary.*

If you genuinely can't tell — say a scammer's contact *and* a suspicious benefit change both seem to be in play — it's fine to file both, or to call the hotline and let a person point you to the right one. A mis-filed report still gets read; it just takes a detour. But most of the time the one-line test decides it in a second.

Anita opens oig.ssa.gov/report on her laptop, chooses Report a Scam, and starts filling it in. The form is short and asks for exactly what you'd expect — how the scammer made contact, when, what they said, and anything that identifies them. Here is the whole flow with her (fake) answers, so you know what a finished report looks like before you ever sit down to file one:

Every field, in the order Anita meets it — what it is, what she puts, and why it matters:

• Choose a form → Report a Scam. *What it does:* routes the report to the impersonation-scam team, not the program-fraud team. *Why it matters:* it's the fork from the last section — get it right here and the rest of the form asks the right questions.
• How were you contacted? *Anita picks:* Phone call. *Why it matters:* the OIG tracks scams by channel — phone, text, email, mail, in person, social media — because a wave of one type is a pattern worth flagging.
• Date of contact. *Anita puts:* on or about May 12, 2026. *Why it matters:* you don't need it to the minute; an approximate date is fine and helps the OIG line your report up with others from the same operation.
• Who did they claim to be, and what did they say? *Anita writes:* the caller claimed to be "Officer Kevin Harris" from Social Security / the OIG, said Manny's SSN was suspended over criminal activity in Texas and Mexico, and demanded about $2,400 in gift cards to clear a warrant. *Why it matters:* the *script* is the scam's fingerprint — the OIG matches wording across thousands of reports to identify a single ring.
• Suspect information — anything that identifies them. *Anita puts:* the name used (Kevin Harris), a claimed badge number, the caller-ID number that showed on Manny's phone (noted as likely spoofed), and the callback number the "officer" gave. *Why it matters:* even a spoofed number is data — patterns in spoofed numbers and callback lines help investigators; and flagging it as *likely spoofed* keeps the OIG from chasing an innocent phone owner.
• Did you lose money? Did you share personal or financial information? *Anita answers:* No and No — Manny paid nothing, and gave up no bank details, no SSN, no card. *Why it matters:* this is what makes it a *near-miss* rather than a theft — and it tells the OIG no recovery or account-lock is needed. (If the answer were *yes*, that's the signal to jump to Lesson 152.)
• Description — tell us what happened. *Anita writes:* a short plain narrative — the time of day, the threat, the gift-card demand, that her father grew suspicious and hung up, and that he received no genuine SSA notice about any of it. *Why it matters:* the free-text story gives investigators context a checkbox can't.
• Your contact information (optional). *Anita puts:* her own name and email, and notes she's reporting on her father's behalf. *Why it matters:* it's optional — you can report anonymously — but leaving it lets the OIG follow up if they need one more detail.

Anita hits Submit, and the screen changes to a confirmation: her report is received, and it carries a reference number — a short string that identifies this specific report in the OIG's system. This is the single most important thing to walk away with, and most people close the tab before they save it.

An OIG reference number is your proof and your thread. It's proof that you reported — and *when* — and it's the thread that lets you (or an investigator) find this exact report later. Anita does two things with it: she writes it down somewhere she'll find it in a year, and she keeps the confirmation page (a screenshot or a saved PDF). It costs thirty seconds and it's the difference between "I think I reported that" and "here's the reference number and the date."

Everything above assumed a laptop and a web form. But you do not have to report online. The OIG fraud hotline is a real, staffed phone line, and it still operates: call 1-800-269-0271, generally 10 a.m. to 4 p.m. Eastern time, Monday through Friday (excluding federal holidays — the current hours are posted on the page). For anyone who never fills out web forms — and for a lot of older beneficiaries like Manny — this is the front door.

The hotline isn't a lesser option; it's the *same report* by voice. And there's more than one non-online path, so no one gets shut out:

• Phone — 1-800-269-0271 (10 a.m.–4 p.m. ET, M–F). A person takes the report and can tell you which form your situation fits.
• TTY — 1-866-501-2101, for callers who are deaf or hard of hearing.
• Fax — 410-597-0118, or mail to: SSA Fraud Hotline, Office of the Inspector General, P.O. Box 17785, Baltimore, MD 21235.

The OIG report is filed — but Anita isn't quite done, because reporting is *both/and.* Two more short calls-to-action close the loop and widen the net.

First, she calls SSA itself at 1-800-772-1213 (8 a.m.–7 p.m. local time, weekdays; TTY 1-800-325-0778). The OIG investigates the *scammer*; SSA protects the *account.* Anita's ask is simple: *my father got this impersonation call — can you confirm that no changes were made to his record?* SSA can verify that no one redirected his direct deposit, changed his address, or touched his benefits. For a near-miss where nothing was shared, this is usually a two-minute reassurance — and if anything *had* been changed, this is the call that catches it.

Second, she files with the FTC at reportfraud.ftc.gov (or by phone, 877-382-4357 — that's 877-FTC-HELP). The FTC runs the country's central complaint database for scams and fraud, shared with thousands of law-enforcement agencies. Adding Manny's phone number, the fake name, and the script to that database is how a single near-miss becomes one more data point in a national pattern. It takes a few minutes and asks for no sensitive information about Manny.

Manny's was a near-miss — but suppose it weren't. Suppose a Social Security number had actually been used: an account opened in someone's name, a fraudulent tax return filed to grab a refund, a government benefit claimed by an impostor. That's no longer just a scam to log — it's identity theft, and it has its own dedicated tool.

The FTC runs identitytheft.gov — a free site built specifically for identity-theft *victims,* and it does something the other channels don't: it builds you a personalized recovery plan. You describe what happened, and the site generates a step-by-step plan tailored to your exact situation.

• It creates an FTC Identity Theft Report — the official record that unlocks many of your recovery rights.
• It pre-fills the letters, forms, and affidavits you'll need to send — to credit bureaus, banks and businesses, debt collectors, the police, even the IRS — so you're not drafting them from scratch.
• It walks you through each step in order, updates the plan as your case moves, and tracks your progress so nothing falls through the cracks.

Here's the honest heart of it — the thought that stops most people from reporting at all: *if I probably won't get my money back, why bother?* The honest answer has two halves, and you deserve both.

The hard half: for money already handed to a scammer — wired, gift-carded, crypto'd away — individual recovery is often not possible. That cash is usually gone, and no honest source will promise otherwise. If that's your situation, you are not foolish and you are not alone; being targeted is a crime committed *against* you, not a mistake you made.

The half that changes everything: your report is not about *your* case in isolation — it's a data point in a system that catches organized rings. The OIG doesn't investigate scam calls one at a time; it aggregates thousands of them, matching phone numbers, scripts, and money trails to identify the operations behind them. Enough matching reports become an investigation; investigations become fraud alerts the OIG publishes to warn the public; and, again and again, they become prosecutions of the large-scale operations running these calls. Your report is what protects the next person — the one who *would* have paid.

The volume is real. The OIG receives so many scam and fraud reports that it publishes a Quarterly Scam Report and a Semiannual Report to Congress just to track them — reporting that peaked in fiscal years 2019–2021 and has fallen since, partly *because* awareness and reporting rose. (Those trend figures are illustrative of scale; the OIG's report series carries the current counts.) Every report you file joins that stream — and the stream is what the investigations run on.

Because a report's payoff can arrive months later, your records are worth guarding. After she's filed, Anita keeps a small folder — physical or a note on her phone — with everything she'd want if this resurfaces:

• The OIG reference number and the confirmation page (screenshot or saved PDF).
• Any FTC confirmation from reportfraud.ftc.gov, and — if identity theft were ever involved — the FTC Identity Theft Report from identitytheft.gov.
• A one-line note of her SSA call (the date, and that SSA confirmed no account changes).
• The details of the scam itself while they're fresh: the date, the numbers, the name used, the script.

This lesson's danger is a quiet one — not a play a scammer runs on you, but the trap of not reporting at all, talked out of it by the voice that says *"nothing will come of it."* That silence is exactly what the operations count on: an unreported scam is one they get to run again, on someone else, unflagged.

The tell that cuts through the cynicism: even when your own case is unrecoverable, every report feeds the OIG's pattern database — and organized rings get shut down precisely because enough people reported. Report to the SSA OIG (oig.ssa.gov/report or 1-800-269-0271), give SSA a heads-up (1-800-772-1213), and log it with the FTC (reportfraud.ftc.gov). Being targeted is never your fault — and reporting is how you turn it into someone else's protection.

If part of you is bracing for "this is a waste of time," read this before you close the tab. That feeling is understandable — and it's wrong in a specific, checkable way.

The through-line: the OIG uses aggregated reports to identify fraud rings, issue public alerts, and support prosecutions. You probably won't get your money back if it's gone — but you will make a difference, and you'll have a reference number on hand if the trouble ever resurfaces. And if you're not sure where to turn, you're not doing this alone: free, unbiased help is real, and it's the subject of Lesson 153. The move is to file — not to sit with the sense that it's hopeless.

Which form do I use — the scam report or the fraud report?

Scam report if you were targeted by an impersonator — the call, the text, the email — whether or not you fell for it. Fraud report if actual Social Security benefits are being stolen or misused: someone collecting a dead person's checks, hiding earnings while on disability, or a payee misusing funds. One-line test: *targeted → scam; benefits actually taken → fraud.* If you truly can't tell, file both or call the hotline and ask.

Can I just call instead of filing online?

Yes. The OIG fraud hotline still operates: 1-800-269-0271, generally 10 a.m.–4 p.m. Eastern, weekdays (TTY 1-866-501-2101; fax and mail also work). It is the *same report* by voice — no lesser option — and it's the natural front door for anyone who doesn't use web forms. Just remember: call the real number *you* looked up, never a callback number a scammer handed you.

What information do I need to include?

As much as you have, but don't stall for perfection: how they contacted you (phone/text/email), the approximate date, what they said or demanded, any caller-ID or callback number (note if it looks spoofed), the name or badge they used, and whether any money was paid or information shared. A scam report does not need your Social Security number — it's about the scammer, not about proving who you are.

Is there a deadline to report?

There's no hard deadline — a report is welcome whenever you make it. But report promptly anyway: memories and details fade, and a dated reference number is most useful the sooner it exists. If a near-miss turns into something real later, having reported early is exactly the record that helps.

I reported — now what happens?

You'll get a confirmation and a reference number. You generally won't get a personal case update — OIG investigations are confidential and rarely loop reporters back in. Your report is aggregated with others to spot patterns, fuel investigations, and support prosecutions. Individual recovery of lost money is often not possible, but your report protects the next person.

Should I report to SSA too, not just the OIG?

Yes, for a different reason. The OIG investigates the *scammer;* SSA (1-800-772-1213) protects your *account.* Call SSA to confirm no changes were made to your record — no address change, no redirected direct deposit, no benefit change. For a near-miss it's a quick reassurance; if something *was* changed, it's the call that catches it early.

What's identitytheft.gov, and when do I use it?

Use identitytheft.gov when a Social Security number or identity was actually misused — an account opened, a fake tax return filed, a benefit claimed by an impostor. It's the FTC's free recovery-plan tool: it builds an FTC Identity Theft Report, pre-fills the letters and forms you'll need, and tracks your steps. It's distinct from reportfraud.ftc.gov (the general complaint site). The full compromised-number playbook is Lesson 152.

Try the routing on a handful of real situations. Pick what happened, and the finder shows which route fits — which OIG form, the FTC, identitytheft.gov, SSA, or the police — with the exact web address and phone number for each. It starts on Manny's near-miss.

This reads the routing rules on examples — it never asks for your personal information and nothing you pick is saved. For a real situation of your own, the doors are worked, for free, by the SSA OIG (1-800-269-0271) and SSA (1-800-772-1213) — and free, unbiased help is the subject of Lesson 153.

• SSA OIG (Office of the Inspector General) — Social Security's independent internal watchdog, which investigates fraud, waste, abuse, and the impersonation scams that target beneficiaries. Public reporting front door: oig.ssa.gov/report.
• Scam report (OIG) — the form to file when you were *targeted* by someone impersonating Social Security or the OIG; no benefit was actually stolen. Manny's form.
• Fraud report (OIG) — the form to file for *actual* Social Security program fraud: benefit theft, cashing a deceased person's checks, hiding earnings while on disability, or a representative payee misusing funds.
• OIG reference number — the identifier you receive after filing a report; your proof that you reported, and when. Keep it (and any confirmation pages) for at least a year.
• OIG fraud hotline — the staffed phone line for reports, 1-800-269-0271 (generally 10 a.m.–4 p.m. ET, weekdays); still operating — you never have to file online.
• FTC (Federal Trade Commission) — the federal consumer-protection agency that runs the national scam-and-fraud complaint database at reportfraud.ftc.gov (877-382-4357).
• identitytheft.gov — the FTC's free tool for identity-theft *victims:* it builds an FTC Identity Theft Report and a personalized, step-by-step recovery plan with pre-filled letters and forms. Distinct from reportfraud.ftc.gov.
• FTC Identity Theft Report — the official record generated by identitytheft.gov that unlocks many identity-theft recovery rights.
• The four P's — the scam tells (pretend, problem, pressure, pay) taught in Lesson 149; how you recognize the scam this lesson teaches you to report.