Email from Social Security Administration

[HOSED]

I just got this yesterday and am afraid to open it. did anyone else get one from SSA with subject "A special message from social security"
Thanks, Joe

 

[lxskllr]

Why would they have your email address? The government doesn't do anything important over email. If they really want you to know something, they'll send a letter. I'd delete it.

 

[Elixer]

Do view all headers, and post them here.
It is 100% a fake, either way.

 

[seepy83]

I got one of these that gmail filtered as spam yesterday (and that spam filter looks like a false positive). If I remember to later (I'm on my mobile right now), I'll post the headers. This one actually doesn't look fake. SSA has your email address if you've signed up for an account on their website. It was sent via govdelivery.com, which is used by many government agencies. All links, sources of image content, etc looked completely legitimate.

The content of the email is related to logging into your SSA account to retrieve tax docs if you misplaced the ones that were mailed to you and you need them to file taxes.

 

[corkyg]

Just delete it. SSA does NOT send emails to individuals.

 

[seepy83]

Just delete it. SSA does NOT send emails to individuals.

Yes, they do - if you signed up for an account on their website.

 

[seepy83]

The full header info is below, with my email addr redacted. Like I said earlier, this appears to be legit. The US Social Security Administration does have an account with govdelivery.com, and they do use the services to send out emails to people that have registered for a MySSA account.

If you're really interested, or think I'm wrong, I can post the content of the email. But, like I said earlier, all of the links, image content, etc look completely benign.

Delivered-To: REDACTED@gmail.com
Received: by 10.170.115.202 with SMTP id h193csp490850ykb;
        Tue, 17 Feb 2015 08:54:02 -0800 (PST)
X-Received: by 10.43.139.13 with SMTP id iu13mr35995166icc.55.1424192041865;
        Tue, 17 Feb 2015 08:54:01 -0800 (PST)
Return-Path: <info99@service.govdelivery.com>
Received: from mailer190221.service.govdelivery.com (static-221.service.govdelivery.com. [208.42.190.221])
        by mx.google.com with ESMTP id k10si13070779igx.62.2015.02.17.08.54.00
        for <REDACTED@gmail.com>;
        Tue, 17 Feb 2015 08:54:01 -0800 (PST)
Received-SPF: pass (google.com: domain of info99@service.govdelivery.com designates 208.42.190.221 as permitted sender) client-ip=208.42.190.221;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of info99@service.govdelivery.com designates 208.42.190.221 as permitted sender) smtp.mail=info99@service.govdelivery.com
X-VirtualServer: VSG002, mailer190221.service.govdelivery.com, 172.25.0.221
X-VirtualServerGroup: VSG002
X-MailingID: 16792330::20150217.41700811::1001::MDB-PRD-BUL-20150217.41700811::REDACTED@gmail.com::756505_0
X-SMHeaderMap: mid="X-MailingID"
X-Destination-ID: REDACTED@gmail.com
X-SMFBL: Y29saW4ucC5lZHdhcmRzQGdtYWlsLmNvbQ==
Content-Transfer-Encoding: 7bit
Content-Type: multipart/alternative;
	boundary="----=_NextPart_682_F84F_457E59CE.53984C6C"
x-subscriber2: 2.TsA6nk0UKsRb38rH92nihqw1D0E6N1zySiHkK32Muhk=
x-subscriber: N57PRK2VPXS0LKaSZE5npLJ+Yh/Eqn2ABkGK1ZzXIEQ=
X-Accountcode: USSSA
Errors-To: info99@service.govdelivery.com
Reply-To: subscription.service@subscriptions.ssa.gov
MIME-Version: 1.0
Message-ID: <16792330.756505@subscriptions.ssa.gov>
X-ReportingKey: LJJJ2EWJK23GSJJ5F5BKJJ::REDACTED@gmail.com::REDACTED@gmail.com
Subject: =?US-ASCII?Q?A_Special_Message_From_Social_Security?=
Date: Tue, 17 Feb 2015 10:50:07 -0600
To: REDACTED@gmail.com
From: "=?US-ASCII?Q?Social_Security_Administration?=" <subscription.service@subscriptions.ssa.gov>

 

[JEDIYoda]

iT must be important if its from the Guberment!!!

 

[corkyg]

Yes, they do - if you signed up for an account on their website.

OK - but barring that, one should never get an email from SSA. This case is a phishing scam by a hacker.

 

[seepy83]

This case is a phishing scam by a hacker.

Did you even read my posts? I have the full headers and content of (very likely) the same email that the OP is referring to. It arrived in my email yesterday, with the same subject. The email I received is legitimate and I've looked at all of the content and verified it is not malicious.

Is it smart to be suspicious of emails like this? Yes, absolutely. But my trained eye says this particular email is clean. If you don't believe me, I'll be happy to share the raw content with you so that you can analyze it yourself.

 

[KeithP]

http://www.ssa.gov/myaccount/internetphishingalert.html

When in doubt, ignore the email and go directly to their web site.

-KeithP

 

[corkyg]

http://www.ssa.gov/myaccount/internetphishingalert.html

When in doubt, ignore the email and go directly to their web site.

-KeithP

That's what I would do.

 

[HOSED]

 Return-path: <info99@service.govdelivery.com>
Received: from mailer190223.service.govdelivery.com ([208.42.190.223])
by vms172073.mailsrvcs.net
(Oracle Communications Messaging Server 7.0.5.34.0 64bit (built Oct 14 2014))
with ESMTP id <0NJX00AOUGQ28NI0@vms172073.mailsrvcs.net> for
redacted Tue, 17 Feb 2015 12:14:50 -0600 (CST)
Date: Tue, 17 Feb 2015 12:03:30 -0600
From: "=?US-ASCII?Q?Social_Security_Administration?="
<subscription.service@subscriptions.ssa.gov>
Subject: =?US-ASCII?Q?A_Special_Message_From_Social_Security?=
X-Originating-IP: [208.42.190.223]
To: redacted
Errors-to: [EMAIL="info99@service.govdelivery.com"]info99@service.govdelivery.comEMAIL]
]Reply-to:[EMAIL="subscription.service@subscriptions.ssa.gov"][SIZE=1]subscription.service@subscriptions.ssa.gov[/SIZE][/EMAIL]
[SIZE=1]Message-id: <16792330.3070777@subscriptions.ssa.gov>
MIME-version: 1.0
Content-type: multipart/alternative;
boundary="Boundary_(ID_+Lw2fXrBghb77s5v6aHTag)"
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.1 cv=QbHRZXfq c=1 sm=1 tr=0 a=RsyoSazGvaIVQJSaBOFM5Q==:117
a=RsyoSazGvaIVQJSaBOFM5Q==:17 a=jPJDawAOAc8A:10 a=yxO3Op9WAAAA:8
a=oR5dmqMzAAAA:8 a=-9mUelKeXuEA:10 a=0HtSIViG9nkA:10 a=VS1gBTv3AAAA:8
a=6qoi9rgrAAAA:8 a=vnREMb7VAAAA:8 a=JqEG_dyiAAAA:8 a=3j4BkbkPAAAA:8
a=sS8pAsIuAAAA:8 a=o1OHuDzbAAAA:8 a=nflCx2DRGhttJOVsaYUA:9 a=NqZ7E3qYAmkA:10
a=9mLj6qvI0hwA:10 a=7uugYIB1MYQA:10 a=SSmOFEACAAAA:8 a=PkHdHjoZgAYTgz-cQS0A:9
a=M-RvQD9Ds3jhPokA:21 a=_W_S_7VecoQA:10 a=p403mkujtbAA:10
X-VirtualServer: VSG002, mailer190223.service.govdelivery.com, 172.25.0.223
X-VirtualServerGroup: VSG002
X-MailingID: 16792330::20150217.41700811::1001::MDB-PRD-BUL-20150217.41700811::redact::3070777_0
X-SMHeaderMap: mid="X-MailingID"
X-Destination-ID: redact
X-SMFBL: am9zZW00NEB2ZXJpem9uLm5ldA==
x-subscriber2: 2.w5rYpEZekhqsWRArQfNcAUFBLFkPxvYA/3MC1NQn+6k=
x-subscriber: WcQ5dYrbCU+MjLNxa2mzbNrd9kMH6cgF
X-Accountcode: USSSA
X-ReportingKey: LJJJ2EWJK23GSJJ14AD5ZJJ::redact
Original-recipient: rfc822;redact
X-ZohoMail: SS_1 SFP_TS_NL SFPD SFPP UW2468 UB2468 FMWL SFP_WHTLST ZMKF-MKSP ZFF-RCPO_5 ZDF-GV_1 COSF ODL SGR3_1_11025_120
X-ZohoMail-Sender: Social Security Administration

thanks for all the replies, it turns out I do have an account on the site
https://secure.ssa.gov/RIL/SiView.do but never set a favorite for it (I have favorites set for all sites requiring a password but this one slipped by me).
This community is awesome!!
so this looks legit to me
(This is the site I am directed to in the email and am sure it is legit)
https://secure.ssa.gov/RIL/SiView.do

OFF TOPIC : to view headers I had to open the email (I am using Zoho a web based client) it there a way to see headers without opening?

 

[Elixer]

X-Originating-IP: [208.42.190.223]

OFF TOPIC : to view headers I had to open the email (I am using Zoho a web based client) it there a way to see headers without opening?

Yep, that IP checks out to be from govdelivery.com
I never use web based clients, since that is a direct vector for attacks, if they don't block javascript or other stuff.
That is why I use thunderbird, or other programs that can get the mail from the mail providers.
If you were to use thunderbird, then, it is as simple as clicking on 'other actions' then select view source, and it will show the full headers & message in raw format.

 

[HOSED]

Thanks for confirmation Elixer and the tip about thunderbird. I am trying to move to Bodhi Linux 100% & thunderbird will be my next move!Seepy83, thanks for the tip on

 tags!!!

 

[tsiunltdus]

It is always better safe than sorry. I got an email also but I didn't open it. Instead I logged into my account at social security. If they sent a message it would also show there. Anyway it was for checking your information for retirement. How much money you have made over the years.