Scammers know many Veterans rely on the Department of Veterans Affairs (VA) for services and support, and they try to take advantage of that trust. Whether it’s a fake email, a cloned voice or a look-alike website, the goal is the same: to steal your personal information, your money or your benefits.
You don’t need to be a technology expert to protect yourself. You just need to know what to look for.
Scammers rely on three common tactics: phishing, deepfake impersonation and typosquatting. Here is what each one looks like, and simple steps you can take right now.
What is phishing?
Phishing happens when a scammer sends a fake message that seems to come from a trusted source like VA. They rely on urgency, realistic branding and look‑alike email addresses to trick you. Their goal is always to make you act before you think.
Deepfake impersonation. Phishing gets a new disguise
Deepfake impersonation is a newer, more advanced form of phishing that uses highly realistic AI-generated content designed to look and sound real. Scammers now use AI to create fake voices, videos or messages that sound and look like someone you trust. It might be a caller who sounds like a VA representative, a bank employee or even a family member.
These scammers may say there is a problem with your medical records, your benefits or your account. They want you to feel scared or rushed enough to share sensitive information on the spot, like your Social Security number, date of birth or banking details.
Don’t rely on how the message sounds. Always verify it through a separate, trusted source. If a call or video claims to be from VA or your bank, and asks for personal information or money, hang up and contact them directly using a number or method you know you can trust.
In another common tactic, a criminal clones a family member’s voice to fake a kidnapping or emergency and demand ransom. Don’t assume a distress call is legitimate just because it comes from the person’s actual phone number. Call other family members, friends or anyone close to the person to confirm their safety.
What is typosquatting?
Typosquatting happens when scammers create website addresses that look almost identical to real ones, hoping you’ll mistype the URL. These fake sites can look legitimate, but entering your information can put your identity and benefits at risk.
In April 2026, VA identified two fraudulent websites ending in “va.com” and “va.biz” that were designed to mimic VA’s official VA.gov website. These fake sites were linked to phishing activity and the spread of harmful software, and VA acted quickly to shut them down.
Behaviors to watch for
Scammers rely on a few key tricks, no matter which method they use:
- Creating a sense of urgency or fear.
- Pretending to be someone you know or trust.
- Asking for personal or financial information out of the blue.
- Sending links that look real but lead somewhere else.
- Using pressure so you act before you think.
Threat actors rely on split-second mistakes. When users pause to confirm a URL or email sender before logging in or responding, they help safeguard VA data, protect Veteran information and strengthen our overall cyber security posture.
Simple steps you can take right now
Slow down. If a message or call demands immediate action, immediately pause.
Verify another way. If someone claims to be from VA, do not use the phone number or link they gave you. Contact VA directly by visiting the VA Contact Us page at https://www.va.gov/contact-us/.
Check the web address. Look closely at spelling before you click or enter information.
Never share sensitive details on the spot. Do not give out passwords, Social Security numbers or banking information because of an unexpected call, text or email.
Use extra login protection. Turn on multi-factor authentication wherever it is offered. This adds a second step to verify it’s really you.
Watch what you share online. Public videos, photos and posts can give scammers material to build more convincing fakes.
Report it. If you believe you have been targeted by a scam, you have several places to turn:
- Report any scam related to your VA healthcare or benefits by calling the VSAFE Fraud Hotline at 833-38V-SAFE (8-7233).
- File a complaint with the Internet Crime Complaint Center (IC3), run by the Federal Bureau of Investigation (FBI), at IC3.gov.
- Report the scam to the Federal Trade Commission (FTC) at consumer.ftc.gov/scams.
- Report the incident to Cybersecurity and Infrastructure Security Agency (CISA) directly at myservices.cisa.gov/irf.
Stay informed. New scams show up all the time. Check in periodically with trusted sources that track emerging threats:
- Review CISA Cybersecurity Advisories for alerts on new scams and attack methods.
- Check FBI Cyber Alerts for warnings about scams targeting the public.
- Follow VA News for updates on scams specifically targeting Veterans.
Stay safe online
If something feels off, it probably is. Take a moment, check it out and protect yourself, your identity and your benefits.
To learn more, check out these articles from VA’s DigitalVA Cyber Spot Blog:
0 Comments