How to Spot Scam Messages After a Data Breach

When an organisation loses your details, the messages that follow are designed to look like they come from that same organisation. The National Cyber Security Centre (NCSC) warns that you should be alert for suspicious messages after a breach has occurred, because cyber criminals may try to take advantage of it¹. They use the stolen information inside scam emails and texts so that the messages appear legitimate, and may pretend to be from the organisation that has just suffered the breach².

The tell is rarely the spelling. It is the story: an official-sounding message about resetting a password, receiving compensation, scanning your device or a missed delivery, often urging you to act immediately or within a limited timeframe³. The link in it usually leads to a website that looks genuine but stores your real details once you type them in, installs viruses, or steals the passwords you enter³.

You do not need to become a security expert. Check any unexpected message through a route you already trust, never through the contact details it gives you, and report it. If you have already clicked, there are clear steps to take, and they are set out below.

Why scam messages follow a data breach

A breach gives criminals a list of real names, addresses, email addresses and sometimes passwords, tied to an organisation you actually deal with. That is what makes the next message convincing. The NCSC explains that criminals can then use this information when creating phishing messages, such as emails and texts, so that they appear legitimate⁸. The approach may be more direct than a fake link, asking you for sensitive information such as banking details or passwords, or for access to your computer⁸.

It is not only people whose details were stolen who are targeted. The NCSC notes that even if your details are not stolen in the data breach, criminals will exploit high profile breaches while they are still fresh in people's minds³. A story about a hospital trust, a water company or a retailer is in the news, and within days messages arrive referring to it. You do not have to have been affected for the message to name the breach.

This is why the weeks after a breach are the risky period, and why the message arriving at all proves nothing. The organisation should be able to confirm if a breach has actually occurred, how you are affected and what else you need to do, and that is the conversation to have with them directly¹. If you want the wider picture of what a breach means for your details, see your details in a data breach.

Warning signs: password resets, compensation, device scans and missed deliveries

The NCSC lists the themes that recur in breach-related scams: official-sounding messages about "resetting passwords", "receiving compensation", "scanning devices" or "missed deliveries", emails full of "tech speak", and being urged to act immediately or within a limited timeframe³. Each works because it borrows the authority of something real.

The missed delivery text deserves its own warning. If the malware is installed, it can steal your banking details, passwords and other sensitive information, and it attempts to access your contact list to send scam text messages to those numbers⁷. The NCSC's advice is blunt: do not click the link in the message, and do not install any apps if prompted⁷. There is more on this pattern in FluBot and fake parcel texts on Android phones.

Where a link in a scam message can take you

The purpose of a scam text message is often to get you to click a link, which takes you to a website criminals use to download viruses or steal passwords or personal information, sometimes known as phishing¹¹. A scam email works the same way: the link may download a virus or steal passwords or personal information¹². The NCSC describes these sites as looking genuine but storing your real details once you have typed them in².

Once malware is on a phone, the damage spreads. The NCSC says it can steal banking details, passwords and other sensitive information, and it tries to reach your contact list so it can send scam texts to those numbers from your phone⁷. That is how a single click can turn into messages arriving from someone you know.

Criminals also build their messages from what they can find about you. They use information about you that is available online, including on social media sites, to make their phishing messages more convincing¹³. A message that knows your name, your street or your recent purchase is not proof of anything beyond that.

What to do if you think a message is a scam

Do not give out private information such as bank details or passwords, do not reply to text messages, and do not download attachments or click on any links in emails if you are not sure they are genuine⁵. If you have received a suspicious call or message pretending to be your bank, do not use the contact details provided, or click on any links you are sent⁹.

Then report it, which takes a minute and helps everyone else:

1. Texts: forward the message to 7726, a free service for reporting spam².
2. Emails: forward them to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service¹⁴. The NCSC will investigate it⁵.
3. Websites: report scam websites through the same government reporting service¹⁵.
4. Delete the message once you have reported it¹⁶.

If the message arrived on a work laptop or phone, contact your IT department and let them know¹⁷. If a forwarded email containing only one link is rejected, it has been recognised as spam already and need not be forwarded again¹². For the step-by-step versions, see how to report a scam text message and how to report a phishing email.

If a message or call about a security breach does not feel right, report it using the routes given². And if a suspicious message includes a password you still use, change it as soon as you can, change any other accounts using the same password, and consider using a passkey instead³.

If you have already clicked a link or typed in your details

Act in order. A click is not the same as a compromise, but the next few steps decide how much damage is done. Do not give out private information such as bank details or passwords, reply to messages, download attachments or click links if you are not sure they are genuine¹. If you have received a suspicious call or message pretending to be your bank, do not use the contact details provided or click on any links you are sent². Criminals trick people into revealing passwords with fake phishing emails or SMS messages that link to scam websites³, and where malware is installed it can steal your banking details, passwords and other sensitive information⁴. Check whether your details have appeared in other public data breaches using online tools such as haveibeenpwned.com, which can also send future notifications⁵.

1. Disconnect and scan. Open your antivirus software if you have it and run a full scan, then allow it to clean up any problems it finds¹⁵.
2. Change the passwords. Change the password for any account or app you logged into since installing anything, and update the same password on any other accounts, making sure they are unique⁷.
3. Check for forwarding rules. Cyber criminals are known to set up a forwarding rule to automatically receive a copy of all emails sent to your account, which could allow them to reset your passwords¹⁸. Check your email filters and forwarding rules¹⁸.
4. Turn on 2-step verification. The NCSC calls this the first and most important step, because it helps protect you if your password gets phished or otherwise compromised¹⁹.
5. If you installed an app, reset the phone. Do not back up your data before performing a factory reset, as the backup will also contain the malware⁷.

If you think your account has already been hacked, the NCSC points to its guidance on recovering a hacked account¹⁷. Signs of unauthorised activity include changes to security settings, messages or notifications sent from your account that you do not recognise, logins or attempted logins from strange locations or at unusual times, and unauthorised money transfers or purchases²⁰. You may also be locked out entirely, or see password reset messages you did not request²¹. The full sequence is in what to do if an online account is hacked, and if money has gone, lost money to a scam sets out who to contact.

Sextortion emails that quote your password

A sextortion scam is when a criminal attempts to blackmail someone, usually by email, claiming they have login details or a video of the victim visiting an adult website and threatening to disclose this unless the victim pays a ransom¹⁴. It is an example of a phishing attack, where victims receive emails that try to trick them into doing the wrong thing¹⁴. The criminals send millions of emails in the hope that someone will pay¹⁴.

The detail that frightens people is a password quoted in the message. Do not worry if the message includes your password, as it is probably from an old breach of personal data, but change your account password immediately and anywhere else you use the same password⁶. The criminals behind these attacks do not know if you have a webcam, or know if you have visited adult websites¹⁴. You can check whether an address has appeared in a breach at haveibeenpwned.com¹⁴.

Forward the email to the Suspicious Email Reporting Service at report@phishing.gov.uk, and then delete it⁶. There is more in sextortion emails that quote your password.

Protecting yourself before the next message arrives

Two changes do most of the work. The first is 2-step verification, also known as two-factor authentication or 2FA, which usually works by sending a PIN or code, often via SMS or email, to prove it is really you²⁰. Using it helps stop cyber criminals accessing your account, even if they know your password²². Set it up on your email account in particular, which will prevent a criminal from accessing your email account even if they know your password²³. Our guide to turning on 2-step verification walks through it, and which accounts to protect helps you choose.

The second is antivirus, set up properly. Make sure your antivirus software is set to automatically scan all new files, anything you download online, or transfer from a USB stick, external hard drive or SD card²⁴. On Android devices, make sure Google's Play Protect service is enabled, and note that some Huawei devices provide a similar tool to scan devices for viruses⁷. Antivirus is one layer; it does not replace care with links. See antivirus software: what it does for whether you need it.

You can also check whether your details have appeared in other public data breaches using online tools such as haveibeenpwned.com, and similar services are often included in antivirus or password manager tools³. If you use a password manager, turning on 2-step verification is the first and most important step to protect it¹⁹. For a wider routine, work through the home online security checklist.