PBGC works to protect your information in My Pension Benefit Acount (MyPBA), My Plan Administration Account (MyPAA), and other PBGC web applications. That’s why MyPBA and other applications employ security features such as a two-step verification system that sends you a personalized code to enter after you enter your username and password. When you go to navigate to PBGC websites, always use the official URL and ensure it matches the official website exactly.
Recently, we became aware of fake websites and phishing emails that may appear to be from our official website PBGC.gov or a website connected to MyPBA and other PBGC applications. They are not official PBGC websites. The websites use a misleading domain name that is confusingly similar to our official domain or websites connected to PBGC applications.
For example, the fake websites might contain “.org,” “.com,” or another generic top-level domain or country domain while containing the letters “PBGC” or “MyPBA” or “.GOV” in their root URL. These websites may redirect PBGC users to malicious software that harvests personal information, prompt users to click on suspicious links or download attachments.
How to protect yourself
Check the sender’s email address
Before taking any action, always double-check the sender’s email address. Ensure it matches our official PBGC.gov domain or website of an official PBGC application exactly, without any typos or extra characters.
Only navigate to URL from official PBGC websites
Before taking any action, always double check the website URL. Ensure it matches our official domain or website of an official PBGC application exactly.
Avoid clicking on suspicious links
If you’re unsure about a link in an email, do not click on it. Instead, visit our official website directly by typing our URL into your browser or use your trusted bookmarked link.
Never share personal information
We will never ask for sensitive information, such as passwords or social security numbers, via email. If you receive such a request, it’s a scam.
Stay educated
Familiarize yourself with common phishing tactics and signs. Many attackers use urgency or threats to get victims to act hastily. Always take a moment to think before you click.
Don’t click on that link! Delete the message right away!
- You can tell a message is fake because it comes from an account that doesn’t have .gov in the domain name.
- Official websites use .gov. Secure .gov websites use HTTPS. A lock (
) or https:// means you’ve safely connected to the .gov website. - Share sensitive information only on official, secure websites. Remember, any message from PBGC or its web applications will have an address with .gov in the domain name.