Do not click, reply, open an attachment, or call a number in an unexpected breach message. Open the retailer’s app yourself or type a website address you already know, then check for an account notice and contact support through that independently reached channel. A retailer can have a genuine breach while criminals simultaneously send fake “breach” messages, so the incident itself does not authenticate the message.
The safest way to check a breach message
Treat the email or text as untrusted until you verify it out of band. “Out of band” means using a route that did not come from the message: the retailer’s official app, a web address you type yourself, a phone number printed on a payment card or statement, or another contact method you already know is genuine. The Federal Trade Commission (FTC) gives the same core advice for phishing: look up the company’s website or phone number yourself instead of using information supplied in an unexpected message (FTC phishing guidance; FTC consumer alert, December 2024).
As an Amazon Associate I earn from qualifying purchases.
Sign in through that genuine route and look for a security or breach notification. If nothing appears, ask customer service whether the retailer sent the message, whether the stated incident occurred, what information was involved, and how the company will contact customers. Do not disclose a password, one-time code, card number, bank details, or Social Security number while making that inquiry.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhy a real breach does not make a message genuine
Attackers monitor public breach news and copy a retailer’s name, logo, colors and wording. They may include a real order number or a plausible account detail obtained elsewhere. Conversely, a legitimate business may notify customers by email or text. The channel, branding and timing therefore prove nothing on their own.
The FTC says impersonators commonly pretend to be familiar companies, create urgency and ask people to click or share sensitive information (FTC, “Cybersecurity for Small Business: Phishing”). A trustworthy-looking message can still lead to a counterfeit sign-in page or a payment diversion. Verification must happen through a separate route.
Warning signs in an email or text
Use these clues to decide whether to stop and verify. None is an absolute test: a sophisticated phish may be polished, and a genuine notice may contain an error. Several warning signs together warrant treating the message as malicious.
| What you notice | Why it is risky | Safe response |
|---|---|---|
| Pressure to act immediately | “Your account closes today,” a countdown, threats, or an unusually urgent refund claim are designed to bypass careful checking. | Pause and verify through the retailer’s app or a typed, known address. |
| An unexpected link or attachment | The destination can imitate the retailer, install malware, or collect credentials even when the visible text looks familiar. | Do not tap or open it. Navigate independently. |
| Requests for a password, one-time code, card, bank or identity data | Unexpected requests for secrets are a central phishing pattern. A request to “update payment” through a message link is especially suspect. | Refuse to provide the information in a reply or linked form. |
| Sender address, domain or phone number does not match | Look-alike domains, free-mail addresses, extra words and unfamiliar numbers can indicate impersonation. | Inspect the complete address or number, but do not treat a matching one as proof. |
| Spelling, formatting or odd wording | Errors can reveal a mass scam or copied template. | Save details for reporting, then verify elsewhere. |
| Unusual payment demand | Gift cards, cryptocurrency, wire transfers or payment to a new account are common fraud tactics. | Stop. Contact the retailer and, if money was sent, the financial institution through a known number. |
Perfect grammar, a familiar logo, a correct-looking display name or a message that mentions a genuine breach cannot certify authenticity. The FTC’s advice is to check before clicking, downloading or sharing sensitive information (FTC phishing guidance).
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A safe verification sequence
- Pause. Do not tap links, open attachments, call numbers in the message or reply. Leave the message available while you record its sender, wording and requested action.
- Inspect without interacting. Note the full sender address or originating number, spelling of the domain, any pressure, and whether it asks for payment or secrets. Do not assume a logo or display name is an identity check.
- Open a trusted route. Type the retailer’s known web address yourself, use a bookmarked address you created previously, or launch the official app. Avoid searching for the company and selecting a sponsored result when you can use a known address; do not use contact details supplied by the suspicious message.
- Check your signed-in account. Look for a security center, inbox notice or banner describing the incident. A missing banner does not conclusively disprove a breach, because companies use different notification processes.
- Contact support independently. Use the phone number or chat function on the site you reached yourself, a number printed on a card or statement, or another previously verified source. Ask whether the message was sent, what data categories were involved, and which channels the retailer will use for future contact.
- Compare the explanation. A legitimate breach notice should explain what happened, identify the types of information involved and provide recovery information. The FTC’s business guidance also says explaining how the organization will contact people in the future can help customers distinguish later phishing attempts (FTC Data Breach Response guide). Those details are useful checks, not proof that a message is authentic.
- Act only after confirmation. Follow instructions displayed on the independently verified site or provided by verified support. Keep the original message and technical details until you have finished any report.
How a legitimate breach notice may differ
A genuine notice may arrive by email, text, letter or an account message, so its delivery method is not decisive. It normally states the incident’s basic facts, the information categories involved and steps for recovery. It may explain how the retailer will communicate later. Check those details against the retailer’s independently accessed website or account.
Do not expect every real notice to contain the same wording or offer the same remedy. The FTC guidance cited here is general United States consumer and business guidance; retailer policies and legal notification requirements differ by jurisdiction. A polished counterfeit can reproduce every item on a checklist, which is why out-of-band confirmation remains necessary.
If you clicked, opened an attachment or entered information
You clicked but entered nothing
Close the page and do not download anything it requests. If a file downloaded, do not open it; use your device’s security tools or your organization’s IT process to have it examined. From a clean, trusted device, sign in to important accounts through their genuine sites and review recent activity. Preserve the message, link and time of the event for reporting.
You entered a password or one-time code
Immediately visit the real retailer site by typing its address and change the affected password. Change every other account that reused it, starting with your email account because control of email can enable password resets. Review active sessions and sign out unknown devices. Never provide a replacement one-time code to someone who contacts you about the incident.
You entered payment or identity information
Contact the card issuer, bank or other affected institution using a number from its card, statement or independently reached website. Explain that the information was submitted to a suspected phishing page and ask what monitoring, replacement or dispute steps apply. If a Social Security number or other identity information may be misused, use the FTC’s independently reached IdentityTheft.gov recovery process. Do not purchase a service or follow a recovery link solely because the unsolicited message recommends it.
You installed software or gave remote access
Disconnect the device from networks if appropriate, stop the remote session, and contact a trusted technician or your organization’s IT team. From another clean device, change passwords and review financial accounts. Keep records of what was installed or shared; that information helps responders determine the scope.
What to do when the breach is confirmed
Read the verified notice carefully and classify the exposed information before choosing a response. Different data creates different risks.
| Information identified by the retailer | Priority actions |
|---|---|
| Retailer login credentials | Change the affected password on the genuine site, change reused passwords elsewhere, enable multifactor authentication if offered, and review account sessions and orders. |
| Payment-card or bank-account details | Contact the financial institution through a known channel, ask whether replacement or transaction monitoring is appropriate, and review statements for unauthorized activity. |
| Social Security number or other identity data | Follow the retailer’s official recovery instructions and use IdentityTheft.gov for a personalized identity-theft recovery plan if misuse occurs or is suspected. |
| Contact information only | Expect more convincing follow-up scams. Be especially cautious with later calls, texts and emails that reference the incident; verify each through the retailer’s known channels. |
The FTC’s breach-response guidance says organizations should provide recovery information and may consider identity-theft protection or restoration support particularly when financial information or Social Security numbers were exposed (FTC Data Breach Response guide). Such support is conditional on the confirmed data exposure; buying a service cannot establish whether an unsolicited message is real.
How to report a suspected phishing message
- Text messages: Forward the suspicious text to SPAM (7726), the reporting number cited by the FTC. Your mobile provider may request the sender’s number and message content.
- Email and other phishing: Report it to the FTC at ReportFraud.ftc.gov. The FTC also identifies [email protected] for forwarding phishing email.
- The retailer: Use a fraud or security address found on the retailer’s independently reached website, not a reply address in the suspicious message.
- Your financial institution: If money or payment data was involved, call the institution’s known fraud number immediately.
After retaining the sender, links, screenshots and timestamps needed for reporting, delete the message and block the sender where your device supports it. Do not forward a dangerous link to friends or coworkers; share a warning without making the link clickable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common situations and the right decision
“The retailer really announced a breach.”
That makes the scam believable, not genuine. Find the retailer’s announcement or account notice independently and ask support whether this specific message and requested action are part of the company’s process.
“The sender address looks exact.”
An address can be spoofed, a look-alike domain can differ by one character, and an account may have been compromised. Use the address as one clue, never as authentication.
“The text says I will lose access unless I act.”
Urgency is a manipulation signal. Close the message and sign in through the official app or a typed address. If action is genuinely required, the account should show it through that route.
“The message asks only for a one-time code.”
A one-time code is still a secret. An attacker who already has your password may need that code to take over the account. Never disclose it in response to an unexpected contact.
“Customer service confirms the incident but not the message.”
Follow only the instructions support provides through the verified channel. Ask how the company will contact customers and what information categories were involved, then ignore conflicting links or phone numbers in the original message.
A compact decision checklist
- Did the message arrive unexpectedly or create pressure?
- Does it include a link, attachment or unusual payment request?
- Does it ask for a password, one-time code, payment data or identity number?
- Have you verified the incident through the retailer’s app, typed website or known phone number?
- Do the retailer’s independently provided details match the message’s claims and requested action?
- If you already shared data, have you changed reused passwords and contacted the affected financial institution?
- Have you reported the message to the appropriate service before deleting or blocking it?
If any answer in the verification portion is “no,” do not use the message’s links or contact details. Verification is the control that prevents a real breach from becoming the pretext for a second crime.
Frequently asked questions
Can a real retailer send a breach notice by text?
Yes. A legitimate business may use text, email, letter or an account notification. The channel alone cannot establish authenticity; verify through an independently reached account or support route.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteShould I reply “STOP” to a suspicious breach text?
Do not reply to an unsolicited message while investigating it. Preserve the details, forward the text to SPAM (7726), report it through the FTC’s channels, then block or delete it.
What if I cannot remember the retailer’s real website?
Use an official app you installed previously, a bookmark you created before receiving the message, a printed card or statement, or another trusted record. Avoid using the suspicious message’s link or phone number as your way to find the right one.
Does a notice offering free identity protection prove it is real?
No. A scammer can promise monitoring or restoration to obtain more information or payment. Confirm the breach and the offer through the retailer’s known channels before enrolling.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
