From a report by Social Security's Office of Inspector General (OIG):
In May 2012, the Social Security Administration (SSA) introduced my Social Security — an Internet services portal that allows individuals to create a personal online account to access their own information. In January 2013, the Agency enhanced my Social Security to allow individuals to change their direct deposit bank information. Shortly after SSA made this change, the Agency and the Office of the Inspector General began receiving fraud allegations related to unauthorized direct deposit changes....
Based on our random samples, we estimated that $10.9 million in benefit payments for about 7,200 beneficiaries was misdirected in CYs [Calendar Years] 2014 through 2016. ...
We also estimated SSA prevented about $14.1 million in benefits from being misrouted from about 11,900 beneficiaries whose direct deposit bank account was changed without their authorization.
Comparing our analysis of the CY 2014 through 2016 data the Agency provided to our prior review of CY 2013 data showed that the amount of benefits misdirected through my Social Security decreased. Also, we made recommendations to SSA related to verifying the identities of my Social Security users in our September 2016 report. As a result, we are not making any additional recommendations for corrective action at this time. ...