The Treasury is sending Trump Account activation emails in waves right now, and it took scammers roughly no time at all to notice. Banks have already warned about fake “activation” messages like this one making the rounds: “Your child’s $1,000 is waiting. Activate your Trump Account now - funds forfeit in 48 hours.”

Before the parent version of this note, the disclosure: in a previous career I was an engineer on Gmail’s spam and phishing detection teams. I spent years thinking about how fake emails fool people. The good news is that the five-second checks below catch nearly everything, and the fakes in this wave are not sophisticated. Here is the parent version of what I used to do for a living.

(If you’re new here: we walked through the whole claim process already - twenty minutes, mostly making sure you’re on the real website. This note is the deep dive on that last part.)

The Five-Second Check

Work top to bottom. The first fake you find wins, and you can stop.

1. Read the actual email address, not the display name.

The display name is a costume - anyone can type “U.S. Treasury” into that field. The real address is the part after the @. On your phone, tap the sender’s name and it expands to show the full address. Legitimate program mail comes from a real government domain ending in .gov. Anything else - outlook.com, gmail.com, a lookalike like treasury-us.com, some random string - is a costume. This one check kills most fakes.

2. Look at the link before you touch it.

On a computer, hover over the button and watch the corner of your browser - it shows where the link really goes. On your phone, press and hold the link (don’t tap) and a preview pops up. The real portal is trumpaccounts.gov. If the preview shows anything else - a .com, a .net, a .gov that’s misspelled by one letter - you’re looking at the business end of the scam.

Then close the email, and if you want to claim, type the address into your browser yourself. That habit makes almost every phishing email harmless, because you never needed its link in the first place.

3. Read it like an editor.

Odd spacing. Weird characters. A mix of fonts that don’t belong together. Greetings like “Dear Beneficiary” instead of your name. Countdown threats - “funds forfeit in 48 hours.” Government mail is written by career bureaucrats and reviewed by lawyers; it reads like it. It does not have exclamation points, and it does not panic you. Panic is the product. Banks warning about this wave flag the same tells: urgent deadlines, offers to “speed up” your $1,000, and any processing or “activation” fee. The program has no fees. Nobody legitimate can expedite your money for a charge.

4. For the curious: make the email show its papers.

This one is optional, but it’s the closest thing to proof. In Gmail, open the message, hit the three dots, and choose “Show original.” You’ll see whether the message passed the email world’s identity checks - SPF, DKIM, DMARC. In plain terms: did this message really come from the domain it claims, cryptographically verified. A message “from” treasury.gov that fails those checks is a forgery, full stop. You don’t need to understand the acronyms - look for the word fail next to any of them and you have your answer.

What the Real Email Will Never Do

  • Ask you to reply with personal information. Your SSN, your kid’s SSN, bank details - never by reply. The real claim happens inside the portal, after you typed the address yourself.
  • Charge anything. No processing fee, no activation fee, no verification charge. The scam alerts all lead with this one. A fee to claim free money is the whole con.
  • Come with an attachment. Government benefits mail doesn’t ship spreadsheets. Don’t open attachments you weren’t expecting, full stop.
  • Threaten forfeiture in 48 hours. As we covered in the claim guide, the money isn’t lost the day you skip it. Nobody at Treasury is watching a stopwatch.

If You Already Clicked

Don’t panic - clicked and exploited are different events.

  • Clicked but closed without typing anything: you’re fine. Close the tab.
  • Typed an email and password: change that password now, everywhere you reused it (and stop reusing it).
  • Entered an SSN or financial details: go to the real portal by typing the .gov yourself, check your child’s account status, put a fraud alert on your credit files at any one of the three bureaus, and report it at ReportFraud.ftc.gov.

One Last Thing: Report It

In Gmail, don’t just delete a fake - open the three dots and hit Report phishing. Not “report spam.” Phishing reports feed the detection systems that protect everyone else’s inbox, including your mother’s. I used to sit on the other side of those reports. They matter more than you think, and they’re the closest thing to a neighborhood watch the internet has.

The short version of this whole note: the display name lies, the address after the @ doesn’t. Type the .gov yourself. Twenty minutes, and your kid’s $1,000 is claimed from the real thing - here’s the walkthrough, and here’s what it grows into once you’ve claimed it.

A quiet note: I’m a parent taking notes, not your security or financial advisor, and even ex-anti-phishing engineers can be fooled on a bad night of sleep. The official portal is trumpaccounts.gov - typed, not clicked. For anything that feels off about your own situation, ReportFraud.ftc.gov is the right door.