Treat any unexpected breach message as unverified until you have checked it yourself. Don’t click its link, open its attachment, reply, or call a number it gives you. Open the service through an app or web address you already use, look at the security activity there, and contact the company through a channel you know is correct if the picture is still unclear. The message itself can’t tell you whether it’s real, but your account can.
Why the message can’t vouch for itself
Logos, display names and professional wording are easy to copy. Federal Trade Commission (FTC) guidance on phishing says fake messages can look real and often claim suspicious activity or a problem with your account. A sender’s display name alone doesn’t prove who sent the message.
As an Amazon Associate I earn from qualifying purchases.
Real services also send security alerts. Google, for example, says it alerts users to important actions such as a sign-in from a new device or suspicious activity. So a breach notice isn’t automatically fake. Judge it by what you find when you check the account yourself, not by how the message looks.
Familiarity isn’t proof either. Google’s Gmail help warns that a message from someone you know can still be suspicious if it asks for unusual information or contains questionable links, because that contact’s account may be compromised.
#1 Best Overall
The verification routine
- Pause. Urgency is a standard pressure tactic. A real problem can still be checked in a few minutes without following the message’s instructions.
- Don’t engage with the message. Don’t click, download, reply or call. Don’t give a password, payment details or a verification code through it.
- Go to the service on your own. Open its official app or type the address yourself. For a Google account, the security notifications page is
myaccount.google.com/notifications. Reach it by typing the address, not through the message. - Compare the claim with the account. Google’s alert guidance says to review the device, time and location of the reported sign-in. Also look for password or recovery-detail changes and for active sessions you don’t recognise.
- If it’s still unclear, contact the organisation independently. Use a phone number or link you already know is correct. The FTC puts it this way: “If you’re concerned, contact the company directly using a link you already use or a phone number you know is correct.”
- Report it. Use the phishing or spam report option in your mail or messaging app. In the United States, the FTC points to ReportFraud.ftc.gov, and suspicious texts can be forwarded to 7726 (SPAM). These channels are US-specific.
Clues that raise or lower suspicion
None of these is a forensic test, because scammers can polish a message and legitimate companies do send alerts. Use them to decide how carefully to verify, not as a verdict.
- Pressure to act immediately or lose access.
- A breach or unfamiliar-login claim you can’t find in the account itself.
- A request to confirm credentials, payment details or a code. Google states it never asks for your account password in an email, message or phone call.
- An unexpected attachment.
- A link whose real destination doesn’t match its visible text.
- A sender name that doesn’t match the sender address.
The strongest sign of a genuine alert is that the same event appears when you check the account independently. A sign-in from an unfamiliar device or location shown there deserves action. Nothing there suggests the message was unfounded, though you should still stay cautious with anything that asked you to click.
Never approve or share on the message’s say-so
Don’t read out a one-time code and don’t approve an unexpected sign-in prompt just because a message says your account was breached. Those are exactly what an attacker needs when they’re trying to log in as you.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11If you already clicked or replied
- Change the password to one that’s unique, starting with the real service reached independently. If you reused it elsewhere, change it there too.
- Sign out other devices and sessions if the service offers it.
- Turn on two-factor authentication.
- Check recovery email addresses and phone numbers for changes you didn’t make.
- If a link downloaded a file, update your security software and run a scan, as the FTC advises.
- If identity or financial information was disclosed, IdentityTheft.gov (US) gives tailored recovery steps.
When there’s no message at all
An account can be compromised without any notice. The FTC lists these signs: a password or contact detail you didn’t change, a login notification for activity that wasn’t yours, being unable to log in, or messages sent from your account that you didn’t send. Check these through the provider’s own account or recovery process, then follow the steps above.
What the evidence does and doesn’t tell us
No reliable figure exists for what share of breach messages are genuine versus fraudulent, so treat any such percentage with suspicion. The FTC reported in 2025 that email was the top way scammers contacted people in 2024. That describes scam contact generally, not breach alerts specifically.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prevention going forward
A hardware security key won’t tell you whether a given message is real, but it limits the damage from phishing. Google describes security keys as its strongest verification step and says they protect against phishing. Check that a key is supported by your accounts and devices before buying one. Recovery steps and menu labels differ between providers and change over time, but the method holds: reach the provider yourself, and let the account confirm the event.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
