A letter, email or text says your data was exposed in a breach and offers free credit monitoring. It might be real. It might also be a scam built to collect the exact data the letter claims was stolen. Criminals know people act fast on breach news, and many real breaches are public, so fake notices can name a real company and a real incident. This guide shows you how to confirm a breach notification in 6 steps before you call a number, scan a code or enter any personal information.
What a real notice usually contains
State laws set what a breach notice must say, and California’s rules are among the most detailed. Under California Civil Code 1798.82, a notice must be titled “Notice of Data Breach,” be written in plain language and use these headings:
- What Happened
- What Information Was Involved
- What We Are Doing
- What You Can Do
- For More Information
Other states use different formats, so a missing heading alone does not prove a letter is fake. A real notice still names the company, describes the data involved and gives a date or date range for the breach. Vague notices that never say which company was breached deserve extra suspicion.
Step 1: Do not use any contact details in the message yet
Put the letter aside before you call, click, reply or scan a QR code. The FTC’s phishing guidance says to contact the company using a phone number or website you know is real, not the information in the message. Links and attachments in fake notices can install malware.
What success looks like: you have not called, clicked or entered anything from the notice.
Step 2: Contact the company through a channel you already trust
Find the company’s contact details on your own: a past bill, the back of a card, an account statement or its official website typed into your browser by hand. Ask whether it sent a breach notice to you and whether the phone number and enrollment website in your letter belong to it.
Many companies hire an outside firm to mail notices and run call centers, so the return address or phone number may not match the company’s own. The company can confirm whether the vendor is legitimate.
What success looks like: the company confirms the notice, the call center number and the enrollment website.
Step 3: Check official breach lists
Many states publish the breach notices companies file with them, often with a copy of the letter. Search the company name on these lists:
- California: oag.ca.gov/privacy/databreach/list
- Maine: maine.gov/ag/consumer-protection/data-security-breaches
- Washington: atg.wa.gov/data-breach-notifications
- Health breaches affecting 500 or more people: the HHS Office for Civil Rights breach portal and our HIPAA Breach Tracker
If a state posts a copy of the letter, compare it to yours line by line, including the phone number and website.
What success looks like: you find a filing for the same company and the details match your letter.
Step 4: Check the news and breach trackers
Search the company name on BreachNews and on the company’s own newsroom. We cover confirmed breaches and also claims made by ransomware groups. Our Ransomwatch tracker lists leak site claims, which can tell you whether an attack was public before your letter arrived.
A claim on a leak site does not prove a letter is real, and a new breach may not be public yet. Use this step as supporting evidence, not as your only check.
What success looks like: the breach in your letter matches a public report or company statement.
Step 5: Look for red flags
Any of these signs means you should stop and verify again:
- Requests for your full SSN, passwords or card numbers by phone, text or email before you can get help.
- Payment requests. Breach monitoring offered in a notice is normally free. The FTC warns that real companies will not email or text a link to update payment information.
- Pressure and short deadlines, such as a claim that your account will close today.
- Mismatched details, such as a breach date or company name that does not match public filings.
- Links that do not match the company or its confirmed vendor, including shortened links and QR codes.
- Attachments in an email notice, especially files you must open to read the details.
Real notices often ask you to enter an activation code and some personal details to enroll in monitoring. That is normal only after you confirm the enrollment website in Step 2.
What success looks like: the notice passes every check above, or you have set it aside as suspicious.
Step 6: Report a fake notice
If the notice is fake, report it so others are warned:
- Email: forward it to the Anti-Phishing Working Group at reportphishing@apwg.org.
- Text message: forward it to SPAM (7726).
- FTC: report it at ReportFraud.ftc.gov.
- Losses or stolen money: file a complaint with the FBI’s IC3.
- The company: tell it someone is impersonating it, using the contact details you confirmed.
If you already shared data with a fake notice, follow the recovery plan at IdentityTheft.gov, and change any password you entered.
What success looks like: you have a confirmation from the FTC report, and you blocked the sender.
If the notice is real
Once you confirm it, follow our guide on how to respond when you receive a data breach notification. If your SSN was involved, start with a credit freeze at all 3 bureaus.
Common mistakes
- Calling the number in the letter to ask if it is real. A scammer will say yes.
- Assuming a real company name means a real letter. Scammers reuse public breach news.
- Ignoring a real notice. Verify it instead of throwing it away. Enrollment deadlines for free monitoring expire.
- Trusting caller ID. Attackers can spoof real phone numbers.
- Scanning QR codes without checking where they lead. Treat them like any other link.
Related reading
- ASOS Confirms New Cyber Incident After Attackers Hijack Customer Notifications
- Astrana Health Confirms Data Breach After Attackers Spoof Corporate Phone Number
- Exposed Phishing Infrastructure Reveals Three Active Microsoft 365 Campaigns
Last verified: November 1, 2026
