Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Assume an unexpected email or text about a utility data breach, account security check, payment update, or service shutoff is phishing until you verify it through a channel you already trust. Do not click its links, open attachments, scan its QR code, reply, or call its phone number. Instead, type the utility’s known web address yourself or use the phone number printed on a paper bill.
The message may use the utility’s logo, your name, an account number, or details exposed in the breach. Those details do not prove it is genuine. The decisive test is independent verification: find the same notice after navigating to the utility yourself, or ask the utility through contact information you obtained before receiving the message.
As an Amazon Associate I earn from qualifying purchases.
Why a utility breach creates a perfect phishing pretext
A data breach gives criminals a believable story and possibly enough customer information to make a message look personal. They can claim that your account was exposed, that you must complete a “security check,” or that payment details need to be confirmed. A familiar logo and accurate address information can be copied from public records or stolen data.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The breach reference is therefore not evidence of legitimacy. It is a reason to slow down. A genuine utility may publish a breach notice, explain how it will contact customers, and direct customers to updates on its official website. The Federal Trade Commission (FTC) advises that breach communications should explain future contact methods and where updates will be posted. Verify those details independently rather than relying on the message’s instructions.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
FTC guidance also says legitimate companies do not unexpectedly email or text a link to update payment information. That applies even when the message appears to come from a company you use.
The 30-second decision rule
- Stop. Do not interact with the message while deciding whether it is real.
- Identify the claim. Is it asking for payment, a password, personal information, a download, or immediate action?
- Leave the message. Open a saved bookmark, type the utility’s address manually, or find the phone number on a bill.
- Check the account and notices there. Look for the same breach announcement, payment status, outage information, or service warning.
- Use only the independently found contact method. Ask whether the message was sent and what action, if any, is required.
If the utility cannot confirm the message through that separate route, treat it as phishing and report it. Do not “test” the link or reply to ask whether it is genuine; that confirms your address or phone number is active.
Red flags in utility breach emails and texts
| What you see | Why it is suspicious | Safe response |
|---|---|---|
| You do not have an account with the named utility | An unsolicited account notice is likely aimed at the wrong person or is a generic phishing campaign. | Do not correct the sender or provide details. Report and delete it. |
| “Pay now,” “same-day shutoff,” or “avoid fees today” | Urgency and threats are classic utility-impersonation tactics. FTC says real utility companies do not demand immediate payment to avoid same-day disconnection. | Check your account through the known website or the number on your bill. |
| Gift cards, cryptocurrency, wire transfer, payment apps, QR codes, or retail barcodes | These methods are difficult to reverse and are not normal ways to settle an unexpected utility demand. | Do not buy, scan, send, or read out any code. Contact the utility independently. |
| A link that opens a login or payment page | The visible text can hide a different destination, a look-alike domain, or a credential-stealing page. | Do not open it. Navigate to the utility yourself. |
| An unexpected attachment | An attachment can install malware or request information unrelated to normal billing. | Do not open it. If you already did, follow the malware-response steps below. |
| A sender address, domain, spelling, or branding that does not match | Small changes in a domain or display name can disguise an impostor. | Inspect the actual sender address and report the message without replying. |
| A breach-themed request for Social Security, bank, card, or password data | A real breach notice does not make an unsolicited message trustworthy, especially when it asks for new sensitive information. | Find the utility’s independently posted notice and ask what information, if any, is required. |
| A text about immediate shutoff | FTC states that no utility company will text you about a shut-off. A shutoff threat delivered by text is a strong scam signal. | Do not call the number in the text. Verify through a bill or official website. |
Urgency is a manipulation technique
Scammers want you to act before you have time to compare the message with your account. “Today,” “within one hour,” and “final warning” language is designed to make an unusual payment method seem acceptable. Even a real overdue balance is not proof that the message is real; criminals can pair a plausible account detail with a false demand.
Recommended Free Tools
Payment methods that should end the conversation
Gift cards, cryptocurrency, wire transfers, payment apps, QR codes, and barcodes supplied for payment are especially dangerous because recovery may be difficult. FTC guidance says no utility company will demand payment in cryptocurrency. A barcode that sends you to a retail counter is not a substitute for verifying the account through the utility.
Sender and link inspection
On a desktop, hover over a link without clicking to reveal its destination. On a phone, press and hold only if your device can show the destination without opening it. Compare the true domain with the utility’s known address; a familiar word in a longer, unrelated domain is not a match. Look for misspellings, unexpected subdomains, shortened links, and a request to sign in before you can read basic information.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Display names can be forged, and a message can include a correct customer name. Neither replaces checking the actual address and the destination. If you are uncertain, do not investigate inside the message; use the independent route.
How to verify a breach notice safely
1. Find the utility without using the message
Type the address you already know, use a saved bookmark, or search for a printed bill and use its phone number. Do not copy a number from the email, text, attachment, QR code, or caller ID. If you reach the utility’s site through a search engine, check the domain carefully before signing in.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute2. Check the account and public notices
After reaching the genuine site, look for an account alert, outage page, security center, or breach announcement. Compare the requested action with what the utility publishes there. If the message says your payment failed, check the account’s balance and payment history rather than following its payment button.
3. Ask a verified representative
Use the phone number printed on a bill or a contact route you saved before the message arrived. Ask whether the utility sent the email or text, what its normal breach communications look like, and whether any account action is required. Do not provide a password, one-time code, full payment number, or Social Security number merely because someone claims to be support.
4. Preserve useful evidence
Keep the original email or take screenshots of the text, sender, destination, and payment request before deleting it. Do not forward a malicious attachment to coworkers or family. Your utility, email provider, mobile carrier, bank, or investigators may need the details when you report it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to report the message
Reporting helps providers identify campaigns and can protect other customers. Use these channels after you have stopped interacting with the message:
- Forward a phishing email to [email protected].
- Forward a scam text to 7726, which spells SPAM on most phones.
- Report fraud to ReportFraud.ftc.gov.
- Notify the utility through its verified website or the number printed on your bill.
- If the message came through a work account, give the original message to your organization’s security or IT team using its normal reporting process.
After reporting, block the sender if your mail or messaging service offers that option. Deleting the message reduces the chance that you will open it later, but do not delete evidence before saving the information a provider may need.
If you clicked a link, opened an attachment, or entered information
Act according to what was exposed. A clicked link does not automatically mean your accounts are compromised, but entering credentials or downloading a file raises the risk substantially.
You entered a password or one-time code
- Open the genuine utility site independently and change the exposed password immediately.
- Change that password anywhere else you reused it. Use a different, long password for every account.
- Review account activity, recovery email addresses, phone numbers, active sessions, and forwarding rules. Remove changes you did not make.
- Enable multi-factor authentication (MFA). An authenticator app or security key can provide a second factor; MFA makes it harder for a thief to use a stolen username and password.
- If you entered a one-time code, tell the real provider that the code may have been captured and ask whether sessions, tokens, or recovery settings must be revoked.
Change credentials from a device you trust. If you suspect the device itself is infected, use a different device to secure accounts first.
You entered Social Security, bank, or card information
Use IdentityTheft.gov for a recovery plan tailored to the information lost. Contact your bank or card issuer through the number on the card or a statement, explain what happened, and ask what monitoring, replacement, or account restrictions are appropriate. Watch statements and account alerts for transactions or profile changes you do not recognize.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
You downloaded or opened a file
- Disconnect the device from the internet if you see suspicious behavior or a security warning.
- Update its security software and operating system.
- Run a full malware scan and remove detected threats according to the security software’s instructions.
- Change passwords from a clean device after the scan, especially if you typed them while the suspicious software was running.
- Seek qualified technical help if the device remains unstable, displays extortion messages, or you cannot remove the threat.
You sent money
Contact the bank, card issuer, payment-app company, retailer, or cryptocurrency service immediately. Explain that the payment resulted from a scam and ask whether it can be reversed or stopped. Speed matters, but do not send another payment to someone promising to recover the first one.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protecting the account, device, and recovery process
Account protection
MFA is the most important follow-up after a stolen password. Choose a method your accounts support, understand how you will recover access if the device is lost, and store backup codes securely. A security key can resist phishing better than a code typed into an impostor site, while an authenticator app avoids dependence on text messages. Availability and recovery options differ by account and platform, so confirm compatibility before buying or enrolling in a device.
- Use unique passwords stored in a reputable password manager.
- Turn on login alerts and transaction notifications.
- Review connected apps, forwarding rules, recovery contacts, and remembered devices after a suspected compromise.
- Keep your email account especially well protected because it can reset other accounts.
Device protection
Install operating-system and browser updates promptly, keep security software enabled, and use automatic updates where practical. A useful security setup should scan for malware, identify threats, and remove or quarantine them. No device tool can make a phishing message safe; prevention still depends on not opening the content and verifying requests independently.
Recovery and identity support
If you consider an identity-assistance or monitoring service after a breach, compare the actual scope of assistance, alert types, cancellation terms, privacy practices, and geographic availability. Such services may help with detection or recovery, but they do not prove that a utility message is legitimate or prevent phishing. Start with the free, incident-specific guidance at IdentityTheft.gov and the controls offered by your bank, utility, email provider, and mobile carrier.
Free tools Windows power users keep installed
One-click scans. No signup required.
What to tell other people on the account
Tell household members, caregivers, or coworkers who can access the same utility account that a breach-themed message is circulating. Give them the independent verification rule and the utility’s known contact route. If one person changes a shared password or payment method, coordinate the change so another person does not follow the scammer’s instructions later.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Organizations should warn staff not to forward suspicious attachments, approve urgent payment requests from email, or use a phone number supplied in a message. Ask employees to report the original message to the security team and verify payment changes through a separate, established channel.
Questions people ask after a utility breach
Can a message be real if it contains my account number?
Yes, a genuine message can contain account details, but an impostor may have obtained them from the breach or another source. Account-specific information is not authentication. Verify through the utility’s known website or the number on a bill.
Should I click the payment link just to see where it goes?
No. A destination can collect information, exploit a browser, or display a convincing login page. Do not open the link; navigate independently and check the account there.
What if the message says service will stop today?
Do not pay under pressure. FTC says real utility companies do not demand immediate payment to avoid same-day disconnection, and it warns that a utility company will not text you about a shutoff. Check the account through an independently found channel.
Is a QR code safer than a normal link?
No. A QR code is simply another way to send you to a destination you have not verified. Do not scan it. Find the utility’s site or phone number yourself.
What if I do not have an account with that utility?
Do not reply to correct the sender. An unsolicited message naming a company you do not use is likely phishing. Report it and delete it.
How quickly should I act after sending money?
Contact the payment provider, bank, card issuer, retailer, or cryptocurrency service immediately and request a reversal. Also report the fraud to the FTC and the utility through verified channels.
Quick Recap
The essential rules to remember
- A real logo, personal detail, or breach reference can be copied.
- Independent verification beats every clue inside the message.
- Urgent shutoff threats and demands for gift cards, cryptocurrency, wire transfers, payment apps, QR codes, or barcodes are scam signals.
- Legitimate companies do not unexpectedly send links to update payment information.
- Report emails to [email protected], texts to 7726, and fraud to ReportFraud.ftc.gov.
- After exposure, change reused passwords, enable MFA, scan affected devices, and use IdentityTheft.gov when identity information was involved.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
