Assume a breach-related email is unverified until you confirm it through a channel you already trust. Do not click its links, open attachments, reply, or provide passwords, payment details, Social Security numbers, or other personal information. Instead, visit the company’s known website by typing the address yourself or use a phone number from a statement, card, contract, or previously saved contact. If you are an employee, report the message through your employer’s security process. Consumers in the United States can forward suspected phishing email to [email protected] and file a report at ReportFraud.ftc.gov.
This guide is U.S.-focused. Breach-notification duties, credit remedies, and reporting options can differ by state, industry, and the type of data exposed.
As an Amazon Associate I earn from qualifying purchases.
Why a real breach does not prove an email is real
After a company announces unauthorized access, people expect messages about password resets, fraud monitoring, or exposed information. Criminals exploit that expectation by copying the company’s name, logo, writing style, and account-alert language. They may know that a breach occurred from public reporting, a notification posted on the company’s website, or information circulating online. That context makes a fraudulent message feel plausible, but it does not authenticate the sender.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The Federal Trade Commission (FTC) says a legitimate company will not unexpectedly email or text a link asking you to update payment information. The FTC also recommends using a website address or telephone number you already know is genuine, rather than contact details in the unexpected message. See the FTC’s phishing guidance.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Email is a particularly common delivery method: an FTC consumer alert published in April 2025 reported that email was the top way scammers contacted people in 2024. That statistic covers scams generally, not specifically phishing connected to data breaches. Read the alert at Protect yourself from phishing scams.
Warning signs in a breach-related message
An unexpected link or attachment
A message that urges you to “secure” an account, download a report, view an invoice, or open a document deserves scrutiny. Hover over a link on a computer without clicking it and inspect the destination. A look-alike domain, misspelling, extra words, or an unrelated address is a warning. Do not open an attachment simply to see what it contains; malicious files can run code or exploit an unpatched application.
Pressure to act immediately
Threats such as “your account will be closed today,” “you have 30 minutes to respond,” or “legal action is pending” are designed to stop you from checking independently. A genuine incident-response process may have deadlines, but you can still verify it through the company’s known website or a trusted telephone number before taking action.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Requests for credentials or sensitive data
Be suspicious of requests to confirm a password, one-time authentication code, Social Security number, bank details, card number, or full identity profile. A familiar logo and polished layout do not make such a request safe. Never send a password or an authentication code by replying to an unsolicited message.
Invoices, refunds, and payment changes
Fraudsters often combine a breach story with an unfamiliar invoice, a refund offer, or a request to change the bank account used for billing. Verify any payment change through a known account portal or a phone number printed on an existing statement. Do not call the number in the email.
Account-lock or suspicious-login stories
Messages claiming that someone logged in, that your account is locked, or that a security check is required can be legitimate notifications or phishing lures. Open the company’s app or type its established web address manually and inspect alerts there. If the alert does not appear in the authenticated account, treat the email as suspicious.
Branding is not authentication
Logos, colors, signatures, legal disclaimers, and a sender name that matches the company are easy to copy. Even a message that uses details from a genuine breach notice can be forged. Judge the message by independent verification, not appearance.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How attackers use the breach story
The most convincing lures often mirror the sequence of a real incident. A criminal may send a fake “initial notice,” then a password-reset request, followed by a message about credit monitoring or a refund. Each message can refer to facts that are publicly known while directing you to a fraudulent page. Treat every follow-up as a separate, unverified contact, even if an earlier email from the company was genuine.
Compare the timing and instructions with the company’s independently obtained notice. If the official notice says the company will mail information, use a named website, or call a specific number, an email that substitutes a different link or contact route is a warning. A real breach creates a plausible subject; it does not validate a later request for credentials or money.
What to do when you receive the email
- Stop interaction. Do not click, download, reply, call a number in the message, or enter information into a linked page. Leave the message open only long enough to record details needed for reporting.
- Preserve useful evidence. Note the sender address, subject, date and time, displayed links, attachment names, and the claim being made. If your organization permits it, use its phishing-report button so security staff receive the original headers. Do not alter or redistribute the message unnecessarily.
- Verify through a known channel. Type the company’s established address into your browser, use a trusted bookmark, open its official app, or call a number from a card, statement, contract, or prior correspondence. Do not use a link, QR code, reply address, or telephone number supplied by the suspicious message.
- Check the actual breach notice. Find the company’s announcement through its known website or a letter you received independently. Compare the affected dates, data categories, and support instructions. A legitimate notice should explain how the company will contact you in the future; the FTC says clear future contact information can help people avoid phishing tied to the breach. Its business guidance is available at Data Breach Response: A Guide for Business.
- Report using the correct route. Follow the employee or consumer process below. Keep the report separate from any account-recovery steps.
- Delete the message after reporting. The FTC’s consumer guidance recommends deleting a reported phishing email or text so you do not accidentally revisit it.
Where to report it
| Situation | Action | Destination |
|---|---|---|
| Work account or company device | Use the employer’s phishing-report feature or incident procedure and contact the security or IT team promptly. | Your organization’s designated security channel |
| Consumer phishing email | Forward the message, then file a fraud report. | [email protected] and ReportFraud.ftc.gov |
| Phishing text message | Forward the text to the FTC’s short code. | 7726 (SPAM) |
| Impersonated company | Notify the company through its independently verified website or telephone number. | The company’s official support or breach-response channel |
The FTC’s small-business cybersecurity guidance supports reporting workplace phishing to the appropriate security team. Do not broadly forward a malicious email to coworkers; use the organization’s designated mechanism instead. See Cybersecurity for Small Business. CISA also publishes phishing-reporting reminders, including its 2024 phishing security postcard and phishing infographic.
What to include in a report
Give the reporting team the sender address, subject line, date and time, the displayed destination of each link, attachment names, and the action requested. Explain whether you clicked, opened, replied, or disclosed anything. If you are reporting from a work account, use the organization’s reporting button or procedure rather than creating a new forwarded copy. Security staff may need the original message and its headers to investigate; follow your organization’s instructions for preserving them.
For a consumer report, describe the company being impersonated and the breach claim. Do not include a password, authentication code, or unnecessary personal information in the report. The report is a record of the suspected scam, not a place to complete the account-security task requested by the email.
If you clicked a link or opened an attachment
Act according to what happened, not merely what the email claimed. A click without entering information is different from submitting a password or running a file.
You clicked but did not enter information
Close the page. Do not download anything it offers or approve an unexpected browser prompt. Record the address and report the message. If the page asked you to sign in, assume that credentials may have been targeted and consider changing the password for that account from its genuine website.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
You entered a password or authentication code
- From a trusted device or manually entered account address, change the password to a long, unique one that you have not used elsewhere.
- Sign out of the account on all devices and sessions.
- Enable two-factor authentication if the service offers it. A security key can be one possible factor, but the account must support it and a security key does not identify phishing emails.
- Check recovery email addresses, telephone numbers, authorized devices, connected apps, and email-forwarding rules. Remove changes you did not make.
- Review recent sign-ins, sent mail, deleted mail, and account notifications for unauthorized activity.
The FTC’s October 2024 guidance, Email or social media hacked? Here’s what to do, provides this account-recovery sequence. If you cannot sign in or see unauthorized changes, use the provider’s official account-recovery process and contact its support team through a known channel.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You provided a bank or card number
Call the bank or card issuer using the number on the back of the card or a statement. Explain that the details were disclosed in a suspected phishing incident, ask what transactions or account changes should be monitored, and follow the issuer’s instructions for replacement or additional controls. Do not wait for the suspicious email to produce a charge before reporting the disclosure.
You provided a Social Security number or other identity data
Use IdentityTheft.gov for a recovery plan matched to the information exposed. If a Social Security number was involved, the FTC’s breach guidance discusses placing a credit freeze or fraud alert and checking credit reports for unfamiliar accounts or inquiries. Start with the actual breach notice to see whether the organization offers identity-theft assistance, but do not assume a paid monitoring plan is necessary or that every breach includes one.
A file may have installed malware
Disconnect the affected device from sensitive accounts while you seek help, update its security software, and run a scan. Do not use that device to change passwords until it is reasonably clean; use a trusted device instead. For a work computer or phone, follow the organization’s incident process and contact IT or security immediately. Preserve the suspicious file only if your security team asks you to; do not open it again.
Use the breach notice as a verification checklist
A genuine breach notification should let you establish what happened and how the organization will communicate. Compare the message with independently obtained information:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Incident description: Does the company’s verified notice identify the affected system and relevant dates?
- Data categories: Does it say whether names, contact details, login credentials, financial data, or Social Security numbers were involved?
- Future contact method: Does it name the website, telephone number, mailing address, or sender domains the company will use?
- Customer actions: Are password resets, fraud alerts, credit freezes, replacement cards, or account-recovery steps described on the official site?
- Support authenticity: Can you reach the stated help line by typing the address yourself or using a number from a trusted document?
If the email asks you to do something absent from the independently verified notice, pause and contact the company. The FTC’s breach-response guide explains that clear information about future contact channels can reduce confusion and phishing risk.
Match your response to the information at risk
| What happened | Priority response |
|---|---|
| Only received the message | Do not interact; verify independently; report it; delete it. |
| Clicked a link or opened a document | Close it, avoid further prompts, report it, update security software, and scan. Use workplace incident procedures when applicable. |
| Entered a password or code | Change the password from a trusted site, sign out everywhere, enable multifactor authentication, and inspect recovery settings and activity. |
| Shared bank or card details | Contact the issuer through a trusted number and follow its fraud and replacement instructions. |
| Shared a Social Security number or identity data | Use IdentityTheft.gov; consider a credit freeze or fraud alert and inspect credit reports as appropriate. |
| Lost account access or saw unauthorized changes | Use the provider’s official recovery process and contact support through a verified channel. |
Questions about credit freezes, alerts, and monitoring
A breach notice may mention credit monitoring, identity-theft restoration, a fraud alert, or a credit freeze. These are not interchangeable instructions, and the appropriate response depends on the data involved and your circumstances. Read the notice on the company’s verified website or from an independently received letter, then use IdentityTheft.gov for steps matched to the information disclosed. Do not enroll through a link in an unexpected email, and do not assume that a paid plan is required simply because a message uses the words “monitoring” or “protection.”
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If the notice says a Social Security number was involved, the FTC’s breach guidance specifically discusses credit freezes and fraud alerts, along with checking credit reports for unfamiliar accounts or inquiries. If only an email address was exposed, the immediate priority may instead be protecting the email account and watching for additional lures. Let the actual categories in the official notice determine the next step.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes that make the situation worse
- Using the email to verify the email: Calling its number or following its “unsubscribe” link still gives the sender a way to manipulate you.
- Relying on the visible sender name: The displayed name can be forged; inspect the address and verify outside the message.
- Forwarding it to colleagues: A forwarded malicious link can create additional victims. Report through the security team’s tool instead.
- Changing passwords on a possibly infected device: If malware is present, the new password may be captured. Use a trusted device and involve IT.
- Assuming a breach means every follow-up is genuine: A real incident supplies the story criminals need; it does not validate subsequent requests.
- Waiting for proof of fraud: Early notification to a bank, card issuer, employer, or account provider can limit damage.
- Searching for support through an advertisement: A search result or sponsored listing may lead to an impostor. Start from a saved bookmark, a card, a statement, or the company’s manually typed address.
- Reusing a replacement password: A password changed after a phishing event should be unique. Reusing it elsewhere lets one compromised account expose another.
A printable five-minute response
- Stop: no clicks, replies, calls, downloads, or data entry.
- Record: sender, subject, links, attachment names, and the claim.
- Verify: use the company’s known website, app, or trusted phone number.
- Report: employer security for work messages; APWG and the FTC for consumer email; 7726 for texts.
- Recover: follow the branch for passwords, financial data, identity data, malware, or account access.
These steps reflect the FTC’s consumer advice to recognize, independently verify, report, and then delete phishing messages. The FTC’s consumer guide states: “If you got a phishing email or text message, report it.” Read the full guidance at How To Recognize and Avoid Phishing Scams.
Frequently Asked Questions
Can a phishing email be genuine if the company really had a breach?
Yes. A real breach can provide the story and branding needed for a convincing imitation. Verify every message through the company’s known website, official app, or a telephone number you already trust.
Should I click the link just to see where it goes?
No. Do not click, open attachments, scan QR codes, reply, or use the message’s phone number. If you need to check your account, type the established web address yourself or use a trusted bookmark.
Where should an employee report a suspected breach-related email?
Use the employer’s phishing-report button, security mailbox, or incident procedure and contact IT or security promptly. Do not broadly forward the message to coworkers.
Where should a consumer report phishing?
Forward a phishing email to [email protected] and report it at ReportFraud.ftc.gov. Forward a phishing text to 7726 (SPAM). You can also notify the impersonated company through a verified channel.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat if I entered my password but nothing appears to have happened?
Change the password from a trusted device, sign out of all sessions, enable two-factor authentication if available, and review recovery settings, connected apps, forwarding rules, sign-ins, and account activity. Use the provider’s official recovery process if access is lost.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What if I gave the sender my bank or card number?
Call the bank or card issuer using the number on the card or a statement. Explain the disclosure, ask what activity to monitor, and follow instructions for replacement or other controls. Do not wait for a fraudulent charge.
What should I do if I gave out my Social Security number?
Use IdentityTheft.gov for a plan tailored to the information exposed. FTC breach guidance discusses a credit freeze or fraud alert and checking credit reports for unfamiliar accounts or inquiries when a Social Security number is involved.
Do I need paid credit monitoring after a breach?
Not automatically. Start with the official breach notice and IdentityTheft.gov. An organization may offer identity-theft assistance, but the appropriate action depends on the data exposed and your circumstances.
Should I keep the suspicious email?
Record the details needed for reporting and follow your employer’s preservation instructions if it is a work message. After reporting, the FTC’s consumer guidance recommends deleting a phishing email or text so you do not revisit it accidentally.
What if I opened an attachment on my work computer?
Stop interacting with the file, follow the organization’s incident process, and contact IT or security immediately. Update security software and run a scan as directed. Use a trusted device for password changes until the work device is assessed.
The Bottom Line
A breach-related email is still unverified until you confirm it independently. Do not interact with it; report it through the right workplace or consumer channel; then take recovery steps matched to what you clicked, disclosed, or downloaded.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
