A data breach notification may be legitimate, but it can also become the pretext for a follow-up phishing scam. This reusable checklist explains how to verify the notice without clicking risky links, what information a credible notification should contain, and what to do after confirmation.
Overview
A breach notification is a message from an organization explaining that an incident may have exposed customer, employee, or account information. It may arrive by email, postal mail, an in-account message, or, in some cases, a text message. The message can be genuine even when the incident itself is still under investigation, so the notice may describe what is known, what remains uncertain, and what protective steps are available.
The problem is that criminals can imitate this process. A convincing message may use a real company name, a copied logo, a familiar incident description, or a link to a lookalike login page. The safest approach is to separate verification from response: first confirm that the notification is connected to a real organization and incident, then take protective action through independently verified channels.
Do not treat urgency as proof. A legitimate notice may ask you to review information or enroll in a monitoring service, but you should not need to surrender a password, payment-card number, authentication code, or identity document simply to confirm that you were affected. If the message demands immediate action, threatens account closure, or directs you to an unfamiliar site, pause before doing anything.
Checklist by scenario
If the notification arrives by email
- Read the message without clicking. Check the full sender address, not only the display name. A familiar brand name paired with an unrelated domain is a warning sign.
- Inspect the destination before opening it. On a computer, hover over links. On a phone, press and hold only if your device safely previews the address. Watch for misspellings, extra words, unusual subdomains, URL shorteners, or a domain that differs from the company’s normal website.
- Look for a specific explanation. A credible notice generally identifies the organization, provides a general incident timeline or discovery date when available, explains the categories of information involved, and states what the organization is doing. It may not contain every detail, but a vague demand to “verify your account” is not enough.
- Use a separate route to verify it. Type the organization’s known website into your browser, use a previously saved bookmark, or contact support using a phone number from a statement, card, contract, or official website. Do not use contact details supplied only in the suspicious message.
If the notification arrives by text message
A text can be a legitimate alert, but it is also an efficient delivery method for a phishing scam. Do not reply, open an attachment, or follow a payment or login link. Instead, check the organization’s official app or website by opening it directly. A message claiming to be from a bank, delivery company, employer, or health provider should be verified through a known contact method. For examples of delivery and toll-payment impersonation patterns, see the package delivery scam alert guide.
If the message comes from an employer or business partner
Employees should forward the message to the organization’s security or help-desk process using an established internal channel. Do not forward suspicious attachments to colleagues or paste credentials into a linked page. Administrators can preserve the original message and headers, review whether the incident appears in the organization’s internal communications, and confirm the next step with the incident-response owner. A business should also compare the notice with its approved communication plan rather than allowing an unexpected sender to define the response.
If you find the notice on a website or social platform
Do not assume that a post, screenshot, or forum comment is an official breach notification. Verify the claim through the affected organization’s main website, customer portal, investor or newsroom page where appropriate, or a direct support channel. Save the original message and the date you saw it, but avoid reposting personal details or unverified claims.
What to double-check
Sender, domain, and links
Compare the sending domain with the organization’s established domain. Be careful with lookalike characters, added words such as “support” or “secure,” and domains that merely contain the company name. A padlock icon or encrypted connection does not prove that a website is operated by the real organization; it only describes the connection to that site.
The information the notice provides
Read the notice for four basic elements:
- What happened: a plain-language description of the security incident, without unexplained technical claims.
- When it happened or was discovered: dates may be approximate while an investigation continues.
- What information may be involved: for example, contact details, account information, credentials, or financial-related data. Do not assume every listed category applies to you.
- What you should do: clear steps such as changing a reused password, monitoring an account, contacting a provider, or using an offered protection service.
Some notifications are required to include particular information, and expectations vary by location and circumstance. For a broader reference, consult the privacy law and breach notification tracker. The notice itself should still be evaluated for authenticity before you act on its instructions.
Requests for sensitive information
Be cautious if the message requests your existing password, one-time authentication code, full payment-card details, bank transfer, Social Security or national identification number, or a scan of an identity document. Even when an incident is real, verification should not require you to disclose secrets through an untrusted message. If an organization genuinely needs additional information, begin from a trusted channel and ask why it is needed and how it will be protected.
Independent confirmation
Search for confirmation using a route you choose, not a route selected by the sender. Sign in by entering the known website address yourself, review messages in the official account portal, or call a published number. If you are responsible for a business, compare the message against your incident log, vendor contacts, and approved breach communications. Record the verification time, source, and person who confirmed it.
Common mistakes
- Clicking first and investigating later. A link can lead to credential theft even if the underlying breach claim is real.
- Trusting branding. Logos, colors, signatures, and polished formatting are easy to copy.
- Changing a password through the message. Open the account through a known route instead. Change passwords that were reused elsewhere, and use unique credentials with multi-factor authentication where available.
- Assuming no action is needed because the notice is old. Threat actors may target exposed information long after an incident is announced.
- Providing more information than necessary. A breach response should reduce exposure, not create a new collection of sensitive data.
- Deleting evidence immediately. Preserve the email, text, headers, screenshots, and relevant account activity if you may need to report fraud or help an employer investigate.
If you confirm that your information was involved, follow the organization’s verified instructions and review the account most closely connected to the incident. Consider changing reused passwords, enabling multi-factor authentication, watching statements and login alerts, and placing a credit freeze or fraud alert where appropriate for your situation. The personal recovery and credit-freeze guide covers those next steps in more detail. If identity misuse has already occurred, document it and use the relevant reporting and recovery process described in the identity theft recovery guide.
When to revisit
Revisit this checklist whenever you receive a new breach notification, follow-up message, or account warning connected to an incident. Organizations may issue updates as investigations clarify the affected systems or information, and scammers may change their wording, domains, phone numbers, and payment requests over time.
Businesses should review the process before seasonal planning cycles, employee onboarding periods, major vendor changes, and exercises involving incident response. Confirm that staff know where to report suspicious messages, which support numbers and domains are trusted, and who can approve an external notification. Update bookmarks, password-manager entries, contact lists, and escalation paths when workflows or tools change.
Before acting, use this short decision checklist:
- Stop and avoid links, attachments, replies, and payments.
- Record the sender, date, subject, phone number, and claimed organization.
- Check the full address and destination domain.
- Verify the incident through an independently chosen official channel.
- Confirm what information may be involved and what action is actually required.
- Take protective steps through the official website or app, then monitor for follow-up activity.
- Report suspected phishing through your organization’s process or the appropriate platform, and retain evidence.
When in doubt, delay the click—not the verification. A short pause and an independent check can prevent a legitimate data breach alert from becoming the starting point for a second security incident.
