How to Tell If a Data Breach Notice Is Real or Phishing

After a big breach, fake notices arrive within days. Here is how to check a message without clicking anything.

By Siddharth ShankarUpdated October 11, 2026

Real breaches generate real notices, and real notices generate fake ones. Scammers know that people are anxious after a breach and more likely to click. This guide gives you a safe routine to check a message before you act.

Why breach notices are a favorite disguise

A breach notice naturally asks you to do something: change a password, review an account or enroll in a free service. That is exactly what a phishing message asks, so criminals copy the format. They also exploit the fact that you may genuinely have been affected, which is why we cover the real response in your email was in a data breach: what to do next.

Warning signs

The FTC and CISA describe consistent red flags:

• Urgent or emotional language, such as "your account will be closed" or "act now".
• A generic greeting, instead of your name.
• A request for personal or financial information, such as a password, card number or Social Security number.
• A link or phone number to use, especially to update payment details. The FTC says legitimate companies will not email or text with a link to update your payment information.
• Claims your data is for sale on the dark web. The FTC warns such emails may be phishing.

Also look at the sender address and the link destination. A name can be forged, so hover over links on a computer to see the real address, and treat unfamiliar domains with suspicion.

A safe way to verify

What a genuine notice usually looks like

There is no single format, and we have not found an official template, so treat this as practical guidance rather than a rule. Genuine notices usually name the organization, describe what happened, say which types of data were involved and point you to resources on the company's own website. They may offer protective services, but real offers can be redeemed through the official site rather than through a link in the message.

If you cannot verify the message, assume it is not real.

If you already clicked

• If you entered a password, change it everywhere you used it, starting with email.
• If you entered payment details, contact your card issuer.
• If you shared a Social Security number, read what to do if your Social Security number was leaked.
• Run a security scan on the device if you downloaded anything.

Where to report

In the United States, report phishing at ReportFraud.ftc.gov. You can forward phishing emails to reportphishing@apwg.org and text messages to 7726 (SPAM). In the UK, report at reportfraud.police.uk. Reporting helps providers block the sender.