How to Spot Phishing After a Data Breach

In short: Criminals turn leaked names, emails, phone numbers and addresses into convincing fake breach notices, refund offers, bank calls and texts, and the UK National Cyber Security Centre (NCSC) warns these messages "may be sent some time after the breach is made public." No real bank or company will ever ask you to supply personal information, as the NCSC stresses — if a message does, it's a scam, and you can report it to the FTC at ReportFraud.ftc.gov or by forwarding it in the UK to 7726.

Phishing after a data breach is harder to spot than ordinary spam because the scammer already has real details about you — your name, your email, maybe your phone number or address. That context makes a fake message feel personal, even though it's usually sent to millions of people at once rather than aimed specifically at you. Below is what the scam formats look like, what the companies and banks involved will never actually ask you to do, and exactly where to send the message once you've spotted it. If you've just learned your data was exposed, pair this with our checklist of immediate steps after a data breach.

What types of scams target people after a data breach?

The common thread is a message built around whatever details the criminals got hold of, dressed up to look like it comes from the breached company or your bank. The NCSC notes that criminals use stolen information to craft phishing emails and texts that appear legitimate, and write them so each target feels individually singled out — even though the same message is going out at scale.

Several formats show up repeatedly:

• Fraudulent account alerts. A message claiming suspicious log-in attempts or account problems that don't actually exist, pushing you to click a link and "verify" your details. The FTC's guide to phishing lists this as one of the standard lies scammers tell: they "say they've noticed some suspicious activity or log-in attempts — they haven't."
• Fake refunds or compensation. The NCSC lists "receiving compensation" as one of the standard hooks scammers use after a breach, alongside fake official-sounding messages about "resetting passwords."
• Vishing — phone calls. If your phone number was part of the leak, the NCSC warns "you might receive a suspicious call," with an approach that "may be more direct, asking you for sensitive information (such as banking details or passwords), or access to your computer." Treat any caller pushing you to approve a login or payment you didn't start the same way: hang up.
• Smishing and parcel scams. Text messages claiming a "missed delivery" lead to a fake tracking app that is actually malware. The NCSC's guidance on scam parcel texts says this malware "can steal your banking details, passwords, and other sensitive information" once installed.
• Fake versions of the breached company itself. Criminals may impersonate the organization that was actually hacked, or a different company entirely, since high-profile breach stories are fresh in people's minds and easy to borrow for a few days.

The NCSC stresses that even people whose data wasn't stolen get targeted this way, because scammers exploit the news coverage of a breach rather than needing your specific details to make a message look plausible.

How can I spot a fake breach notification or fake refund offer?

Look for artificial urgency, a generic greeting, and a mismatch between what the message asks and what the real company would ask. The FTC walks through a real-world phishing example where "the email has a generic greeting," claims your "account is on hold because of a billing problem," and then "invites you to click on a link to update your payment details" — a combination the FTC flags as a clear sign of fraud.

The same red flags apply across formats:

Scam theme	What the scammer wants	Safer verification
Fraudulent activity alert	You click a link and "confirm" login or card details	Log in through the app or website you normally use, not the link
Fake refund / compensation	You hand over bank details to "receive" money	Check for refund news only on the company's official site
Missed parcel / delivery text	You install a "tracking app"	Use the courier's official website or app, following the NCSC's parcel-scam guidance
Vishing call from "the bank"	You read out banking details or passwords, or grant access to your computer	Hang up and contact the bank through its official website or app, not a number given in the call

Scammers lean on a short list of standard lies, and the FTC's rundown is worth memorizing: they'll claim there's a problem with your account or payment information when there isn't, or tell you you're eligible to register for a government refund, which the FTC says is always a scam.

What should legitimate companies never ask me to do?

Real banks, government agencies, and breached companies will not ask you to supply personal information by email, text, or phone. The NCSC is blunt about this: "Remember, your bank (or any other official organisation) will never ask you to supply personal information."

The same goes for payment links. The FTC notes that "legitimate companies won't email or text with a link to update your payment information" — if a message sends you to a link to fix a billing problem, that's the scam itself, not a fix for one.

That rule extends to digital ID approvals too. MitID's security guidance tells users: "Always read what you are about to approve with MitID. If the text does not match what you intend to do or if you did not initiate the action yourself, do not approve it." No legitimate service — bank, government agency, or digital ID provider — will ever ask for a password, a one-time verification code, or push an approval request for something you didn't start.

How do I verify a message is actually from the company?

Close the suspicious email, text, or call, and go find the organization yourself through a channel you already trust. The NCSC's instruction is direct: "Find out if you've been affected by contacting the organisation using their official website or social media channels. Don't use the links or contact details in any messages you have been sent."

The FTC frames the same rule as a simple test: if you have an account with the company, contact it using a phone number or website you already know is real, not the information in the email, since attachments and links in the message itself might install harmful malware.

For a parcel text specifically, the NCSC suggests using the delivery company's official website, or its official app downloaded only from an official app store, rather than tapping the link in the text.

Where do I report a phishing message or scam?

Reporting takes a couple of minutes and the channel depends on where you are and what kind of message you got:

1. Phishing email (US): Forward it to the Anti-Phishing Working Group at [email protected], per the FTC's guide.
2. Phishing text (US): Forward it to SPAM, or 7726, the same short code the UK uses.
3. Phishing text (UK): Forward it to 7726, a free reporting service run by phone operators, as described in the NCSC's parcel-scam guidance.
4. Any scam or fraud attempt (US): Report it to the FTC at ReportFraud.ftc.gov.
5. If a scammer already got your Social Security, credit card, or bank account number (US): Go to IdentityTheft.gov, where, as the FTC notes, "you'll see the specific steps to take based on the information that you lost."
6. Confirm whether a breach actually involves you by contacting the organization directly through its official website or social media, not through any link in a suspicious message, following the NCSC's advice.
7. After reporting a parcel scam text: Do not click the link, do not install any prompted app, forward the message to 7726, then delete it — the exact sequence the NCSC recommends.

Keep that list somewhere you'll actually find it, because a breach-related scam rarely announces itself as one — it shows up looking like a refund, a parcel, or a routine security alert, weeks or months after the breach that made it possible was already old news.