Social Security & Medicare

not mean the email is OK.

Its been well-known for years that phone numbers can be spoofed, so that a perfectly legitimate number can show up in caller id, but actually its a scammer. I learned a couple of months ago that the same is now true of email addresses. So like you say, the only certain recourse is to log into the official website (not the one in the email) and check for messages / notifications.