myPay Account Protection & Security
At DFAS you and your family's financial security is of the highest priority. Here are some tips and tricks to help keep your myPay account safe.
On This Page...
Use the Right URL - It only takes a moment to make sure you are going to a safe destination. Before you click a link or login into myPay make sure you are visiting the correct web address: https://mypay.dfas.mil/#/. As part of the federal government and the DoD, the official myPay website uses the “An official website of the United States government” banner at the top of the site and the .mil domain. For more information about how to spot a spoofed government website read US General Services Administration’s Scam Alert: Beware of Fake Websites That Mimic Legitimate Official U.S. Government Websites
Don’t Use Third Party Websites or Apps - Some financial websites and apps promise early delivery of pay but require giving up your personal myPay login credentials. Protect your data and yourself – just don’t do it!
The increase in differing methods to manage your personal finances can lead to unexpected changes, especially when used without carefully reading the apps’ Terms of Service. Even when you know what to expect, it’s a good idea of routinely check your myPay account to make sure it reflects what you want. Remember, if you’ve provided your myPay login credentials there’s always a chance that this information may fall into the wrong hands.
Your myPay account contains a lot of information about you. Not only where your pay goes (allotments and direct deposit), but your tax statements, phone number, email address, home address, and family members . Giving access to your myPay account opens up a lot of doors for others to possibly use for their own profit.
.
Beware Unsolicited Contact – DFAS does not call about payroll mistakes or debts. DFAS will not demand payment or personal information by telephone or mobile payment apps.
Fake SmartDocs emails and text messages are being sent with links, requesting personal information or even reporting false problems with your pay. Real DFAS SmartDocs don’t ask for information and won’t provide active links.
Educate Yourself on the Latest Scams. - Protecting yourself and financial assets online is more important than ever. To learn how to protect yourself online and about developing online scams, visit Scams and Identity Theft | consumer.gov.
Practice good online habits. - Protecting yourself and financial assets online is more important than ever. While we use the best security to make sure your information is safe, you are the best and last line of defense in protecting yourself.
The basics…
- Do not use a public computer, public WiFi (for example, at a coffee shop or airport), or kiosk system to access myPay
- Consider using a Virtual Private Network (VPN) service to secure your connection to the internet
- Keep antivirus software and personal firewalls including antivirus signatures up-to-date
- Do not e-mail personal or financial information
- Secure your personal email and mobile phone number; both essential for access to various accounts
- Do not use your email address as your public identity on any site
There are plenty of resources available to learn about online security and many apply to some of the accounts you use on a regular or periodic basis (such as myPay). Here’s some you might find useful:
Know Before You Click - DFAS will only communicate through official DFAS emails or letters. Don’t click on links in unexpected emails or texts. Visit How To Spot a Suspicious Email or Text below for more information.
Bad actors have perfected the art of crafting messages that seem real, but the request may not be what meets the eye. Before you take any action on an email or text, ask yourself the following:
- Is the sender’s email or text suspicious looking? Did you hover over the email address to verify it, even if it has an official logo?
- Are there punction or grammatical mistakes?
- Is there awkward or strong language encouraging action, missing words, extra spaces, or other signs that the text was rushed or written unprofessionally?
- Is there a way to contact their customer service via another method?
- Does the email ask you to go to a different website outside myPay, DFAS.mil, and Ask DFAS?
These are all red flags that may be part of a scam, attempting to get you to enter personal or financial information or provide access to your account. When in doubt, don’t click links or respond to the message directly. Instead, contact us at DFAS Customer Service to verify the message is legitimate.
DFAS will never ask for personal or confidential information (such as your login ID, password, or account information) via text, email, or over the phone. If you call us with a question or issue, we will take steps to verify your identity to keep your account safe. Customer service representatives can then help confirm if and email, text of phone call is legitimate or not.
If you believe you may have revealed sensitive information about yourself or your organization, please contact myPay immediately at
ASK myPay Online Customer Service or contact us at 888-332-7411. Select the option associated with the customer population you belong to and follow the prompts for support using the myPay website.
Below are some steps you can take to protect yourself online if you believe you’re a victim….
- Watch for any unexplainable changes to your account. Pay attention to messages from SmartDocs, the official email/text notification method for myPay. In myPay, view Account Access History and Pay Changes to check for recent activity.
- Contact DFAS and alert us of any suspicious or unusual activity.
- Recent advancements in Artificial Intelligence (AI) are causing a rise with cybercrime and fraud. Cyber actors are using AI to develop new tricks to deceive customers with emails, calls, videos, and texts that appear realistic. If it’s not from a DFAS source you expect, do not act on it. If you are unsure about what you received, reach out and only ask DFAS for assistance.
- Immediately change any passwords you might have revealed. If you used the same password for multiple resources, make sure to change it for each account, and do not use that password in the future.
- Review and update your myPay login ID, security questions, and two-factor authentication preferences.
- Consider reporting the attack to your local police and file a report with the Federal Trade Commission – Identity Theft.
Return to myPay System Information Home
Page Updated: Jan. 28, 2026