After a government data breach, treat unexpected messages about the incident as unverified—even if they include your name or another accurate detail. Scammers can reuse exposed information to make an impersonation feel convincing. Don’t click, reply, open an attachment, pay, or share personal information or a sign-in code; verify the claim through the agency’s independently located official website or phone number instead.
Why breach-related phishing can look convincing
A breach may expose details criminals can reuse in a targeted message. CISA warned about this risk in a September 2017 alert concerning the Equifax breach: stolen information can make phishing seem more credible. That alert is a historical example, not evidence that every government breach produces a measured increase in phishing or that every affected person will receive a scam.
As an Amazon Associate I earn from qualifying purchases.
A familiar name, address, agency seal, employee number, or caller ID display does not authenticate a message. Such details can be copied, spoofed, or drawn from exposed information.
Warning signs in a message or call
- Unexpected contact: Someone claims to represent an agency, breach-response vendor, bank, or credit bureau and contacts you about the incident.
- Pressure or threats: The sender says you must act immediately, or threatens that you will lose benefits, money, or account access. An unexpected refund or special compensation offer can also be bait.
- Requests for sensitive information: The message asks you to confirm a password, Social Security number, bank or payment-card details, or a one-time sign-in code.
- A link or attachment presented as necessary: You are told to click, download, or open something to verify your identity or fix an account.
- Unusual payment demands: You are asked to pay by gift card, wire transfer, cryptocurrency, cash, or payment app. The FTC says government agencies do not contact people through calls, emails, texts, or social media to demand money or personal information.
Phishing is not limited to email. It can arrive by text, social media, phone, or a fake website. See the CISA phishing tip card, the FTC’s phishing guidance, and the FTC’s government-impersonation guidance for more examples.
How to verify a government message safely
- Pause. Don’t click a link, reply, open an attachment, call a number in the message, pay, or provide information or a sign-in code.
- Find the agency independently. Type an official website address you already know or locate the agency’s site through a trusted source. Use contact information published there—not a link, phone number, or QR code in the message.
- Ask through that verified channel. Contact the agency and ask whether it sent the notice and whether action is required. Caller ID and official-sounding titles can be faked, so an incoming call is not proof either.
- Report and remove the message. In the United States, the FTC says to forward phishing emails to [email protected], forward phishing texts to SPAM (7726), and report scams at ReportFraud.ftc.gov.
The FTC’s advice is direct: “Don’t click on any links in unexpected emails, texts, or social media messages.”
What to do if you clicked or shared information
Use recovery steps that match what happened. Go to the real website or account—not the message link—and follow the affected organization’s verified instructions. The FTC’s breach guidance points consumers to IdentityTheft.gov/databreach for steps tailored to the information exposed.
- If you entered a password: Change it through the real service. If you reused it elsewhere, change it on those accounts too. Enable multifactor authentication (MFA) where available. MFA adds account protection; it does not establish whether an unsolicited message is genuine.
- If you gave a one-time code: Contact the affected service through its verified channel promptly and secure the account. Do not share any further codes with the person who contacted you.
- If you shared financial or identity information: Follow the FTC’s breach-specific steps and contact affected financial institutions using independently verified details. If your Social Security number was exposed, review your credit reports.
- If a link downloaded a file or software: Update your security software and scan the device, as the FTC recommends. If you entered credentials afterward, change them through the genuine service as well.
For MFA, a passcode, authenticator app, or security key can serve as a factor. A password manager can help you use long, unique passwords. Neither a security key nor any other account-security tool tells you whether a message is authentic.
Recommended Free Tools
Consider a credit freeze or fraud alert if identity details were exposed
A credit freeze and a fraud alert address new-account risk, not phishing messages themselves. The FTC describes freezes as free; a freeze does not affect your credit score and must be placed separately with Equifax, Experian, and TransUnion. A fraud alert asks businesses to verify your identity and can be placed with one bureau, which must notify the other two. The initial fraud alert lasts one year, according to the FTC.
| Option | What it does | How you place it | Consider if |
|---|---|---|---|
| Credit freeze | Restricts access to your credit report, which can make it harder for someone to open new credit in your name. | Contact each of the three national credit bureaus separately. It is free and can be lifted when needed. | You want the stronger restriction and are prepared to lift the freeze when applying for credit. |
| Fraud alert | Asks businesses to verify your identity before opening credit in your name. | Contact one bureau; it must notify the other two. The FTC says an initial alert lasts one year. | You want a less restrictive alert or expect to apply for credit soon. |
You can choose either or both based on your circumstances. The FTC explains the differences in its credit-freeze or fraud-alert comparison and provides credit-freeze guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use official breach instructions, not look-alike messages
Because this topic does not identify a particular incident, the right remedy depends on which agency and information were involved. Find the affected agency’s notice independently and check what data it says may have been exposed, what assistance it actually offers, and how to contact it. If the organization offers free monitoring or identity-theft insurance, the FTC says to take advantage of those services; a paid service is not required to verify a message or follow breach-recovery steps.
The FTC’s phishing guidance puts the next step plainly: “If you think a scammer has your information, like your Social Security, credit card, or bank account number, go to IdentityTheft.gov.” These reporting and credit-bureau steps are U.S.-specific; readers elsewhere should use their government’s official reporting and identity-protection channels.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
