Social Security gives phone callers who want to change a direct deposit an eight-digit PIN that works for three hours. The agency says in a Federal Register notice that it expects 26,343 people a year to fail that check over the phone. The process is meant to stop a thief from rerouting someone else’s benefit to a different bank account.
Anyone who wants to change where a payment goes has three routes: a personal my Social Security account, a call to the agency with a one-time code, or a visit to a field office. Benefits keep going to the bank account on file until one of those checks is passed. A beneficiary who does nothing is not affected.
Retirement deadlines, in your inbox: Miss an enrollment or claim deadline and the money can be gone. Join the Retirement Money Brief and we’ll send you our 2026 Government Check Reality Tracker as a welcome gift.
Get the Brief + the check tracker →
We may earn a commission from links on this page.
How the three-hour PIN works
The agency described the process in a March 31, 2026 notice seeking comment on its “Security Authentication PIN.” A caller is placed in a callback queue. A technician asks whether the caller has a my Social Security account. If so, the caller signs in, completes multifactor authentication and generates the eight-digit PIN, which is valid for three hours.
Social Security says the process replaces knowledge-based questions. The notice calls those questions vulnerable to compromise for higher-risk direct deposit changes. The agency’s page on proving identity says callers get the code at ssa.gov/PIN and read it to the representative at 1-800-772-1213.
What the agency expects to go wrong
The notice carries annual estimates of how many people go through each route. It counts 528,626 phone users of the PIN process and 26,343 who fail it by phone. Another 2,084,532 drop out of the process and use a different method, and the filing totals 2,639,896 respondents in all.
Those are estimates for a paperwork-burden review, not a count of attempted fraud. The notice does not say how many of the callers who failed were thieves and how many were beneficiaries who could not finish. It adds that the burden has no charge to respondents.
The agency also keeps an exception. A “dire need” case, approved by Social Security management on Form SSA-553, allows knowledge-based verification instead. Field office visitors without acceptable identification can use the PIN process too.
The filing puts the total at 358,521 hours a year and $28,474,742 in what it calls theoretical opportunity cost. Comments were due April 30, 2026, under docket SSA-2026-0331. The notice gives no effective date. It says the Office of Management and Budget granted an emergency approval earlier, after an April 18, 2025 request, and that this notice starts the full renewal.
The 30-day hold that ended
The hold on changes is older. In a March 18, 2025 announcement, Social Security said online direct deposit changes had been held for 30 days. It said both online and in-person changes would now be processed within one business day. Lee Dudek, then the acting commissioner, said, “Americans deserve to have their Social Security records protected with the utmost integrity and vigilance.”
The same announcement said the agency planned to use the Treasury Bureau of the Fiscal Service’s Account Verification Service, which gives instant bank verification to help prevent direct deposit fraud. It said stronger identity proofing would be enforced starting March 31, 2025.
The identity page, last updated April 28, 2025, does not mention any holds or waiting periods. It says customers who change only their direct deposit do not need an appointment at a field office.
The in-person route is the fallback. The identity page says anyone who cannot change a deposit online or generate a one-time code must go to a Social Security office. A person changing any type of benefit must prove identity in the office. Customers who only need a direct deposit change do not need an appointment, and the office locator on ssa.gov or the national line at 1-800-772-1213 finds the nearest one. Until a change clears, the page says benefits continue to go to the bank account already on file, without any new proof of identity.
What the agency says about proof and scams
The agency’s page says identity verification procedures “prevent bad actors from stealing current and future benefits.” It also says that once someone creates a my Social Security account, there is no need to prove identity online again.
Two other rules on the page affect the same people. Paper check recipients must visit an office before changing a mailing address. And Social Security says it will never contact anyone by text message about their identity, so a text asking for a code or PIN is not from the agency.
A person who cannot create an account has fewer choices. The page says to visit a local Social Security office or arrange the direct deposit through the person’s bank. The agency’s notice lists a bank’s automated enrollment as another route.
The open question for most beneficiaries is simple: is the bank account Social Security has on file the right one, and would they notice if a payment stopped arriving? The 2026 payment calendar is the quickest way to tell when a deposit is late.
Is the bank account on file for a Social Security payment really locked?
A deposit that quietly goes to the wrong account is hard to spot until the day a payment does not arrive. The agency’s checks apply to changes, but nothing in them tells a beneficiary when a deposit is late, short or missing.
The Social Security Check Protection Kit is a 75-page guide with a section called Locking the Check Down and the 2026 payment calendar, so the expected arrival date is written down in advance. It also includes a first-24-hours plan for a late or missing payment.
Get the lock-down kit and payment calendar for the direct deposit on file →
This article was produced with AI assistance and edited for accuracy against the sources linked above.
