Is That Really America.gov? A Scam-Spotting Checklist

The government launched America.gov on September 29, 2026 as a single front door for federal services — and within days, security researchers were reporting look-alike domains registered to catch the confused traffic. This is the standard pattern. Every time a new official portal appears, from Healthcare.gov onward, impostors follow within weeks. Here is the checklist our editors use, and that we recommend to family members who ask why we are paranoid about government emails.

The twelve checks

1. Real federal sites end in .gov — but so do some fakes’ neighbors. The genuine article is america.gov. Impostors use america-gov.com, america.gov-claims.net, americagov.info, or hide the real domain behind a link shortener. Read the address from the right side backwards: the last part before the first single slash is the only part that matters.

2. .com is never a federal agency. No federal service lives at a commercial suffix. If the address ends in .com, .net, .org or .xyz, it is not the government, whatever the logo says.

3. HTTPS is not proof of legitimacy. The padlock means the connection is encrypted, not that the owner is honest. Every phishing site shipped in the last five years has a padlock. The padlock tells you nobody is eavesdropping on the scam.

4. The government does not ask for fees to release money. A refund, a benefit, a grant, an expedited passport — releasing it never requires a payment by gift card, wire transfer, crypto or payment app. “Pay a small processing fee to unlock your $500” is the oldest sentence in the scam book, and it is now circulating in America.gov-branded versions.

5. The government does not demand speed. Real deadlines exist (enrollment windows, appeal clocks), but no agency gives you minutes to act or your account gets closed. Manufactured urgency is the pressure mechanism that makes you skip checks 1–4.

6. Unsolicited contact is the tell. The government initiates most routine business by mail. An unexpected call, text or email claiming your “America.gov account was flagged,” with a link, is a phishing attempt until proven otherwise. Do not click — open a new tab and type the address yourself.

7. One login, one place: Login.gov. The only sign-in for America.gov runs through Login.gov. Nobody legitimate will ever ask for your Login.gov password over phone, text or email — not support staff, not “verification teams.” If a message asks, it is theft in progress.

8. They never ask for full identifying details out of nowhere. Agencies already have your Social Security number if they need it. A caller who needs you to recite it “for verification” is verifying that you are worth defrauding.

9. Payment method reveals the game. Gift cards, wire transfers, cryptocurrency, Zelle/Venmo/Cash App — no government office accepts these, ever. Legitimate government payments to you arrive by direct deposit or check, never require a “confirmation payment” first.

10. Family members are targets too. Impostor scams disproportionately hit older adults, precisely because Medicare and Social Security are the services moving to America.gov. One five-minute conversation about checks 1–4 is cheap insurance.

11. Verify sideways. For anything that matters, hang up / close the message and contact the agency through a number or address you find yourself: usa.gov lists every official contact. Ten minutes of delay costs nothing; one wrong form fill can cost years.

12. Report what you catch. Report fraud to the FTC at reportfraud.ftc.gov, identity theft at identitytheft.gov, and internet crime to the FBI’s IC3 at ic3.gov. Reporting feels futile; it is what feeds the takedown and enforcement system.

Why this matters more right now

The rollout of America.gov creates a window in which legitimate confusion is high: people genuinely do not know what the portal does yet, whether they have an “account” there, or whether Medicare enrollment has moved. Scammers thrive on exactly this kind of ambiguity — the victim’s uncertainty about what is normal is their working capital.

Two things are reliable anchors during the rollout:

• What the site does is published in the executive order and on america.gov itself. If a message describes something the portal does not yet do — “complete your enrollment in chat now” — that alone is disqualifying.
• Preserved channels are real channels. The order explicitly keeps agency websites, phone lines and in-person service available. When anything feels off, the slow official route is always open.

If you already engaged with a fake

Act in this order: change your Login.gov password from a clean device; if you gave financial details, call your bank’s fraud line immediately; if you gave your Social Security number, visit identitytheft.gov and follow its recovery plan (it generates the paperwork); report the site at reportfraud.ftc.gov and ic3.gov; and watch your credit reports. Speed matters far more than embarrassment.

The rule that survives every new portal and every new scam generation: the government will never rush you, never charge you, and never ask you to keep it secret. Any message doing one of those three is answered before it is opened.