Spot Phishing Emails After a Data Breach

After a data breach, cybercriminals use your leaked email, name, or password to craft convincing phishing emails. This guide teaches you how to spot those emails before you click, download, or reply. You’ll learn the red flags, the verification steps, and what to do if you’ve already fallen for one.

What You’ll Need

Your email client (web, desktop, or mobile)
A secure password manager (optional but helpful)
Ability to hover over links without clicking (works on desktop and most mobile browsers)
Access to the official website of the company the email claims to be from

Step-by-Step

Check the sender’s full email address. Click the sender name to reveal the full address. Legitimate companies use domains like @company.com. Phishers often use lookalikes: @company-support.com, @company.co, or @company.secure-login.net. If the domain doesn’t exactly match the official site, treat it as suspicious.
Examine the greeting and tone. Phishing emails often use generic greetings like “Dear Customer” or “Dear User” instead of your name. They may also create urgency: “Your account will be suspended in 24 hours” or “Immediate action required.” Legitimate companies rarely threaten you out of nowhere, especially after a breach—they usually explain what happened and what you should do next.
Hover over every link before clicking. On desktop, hover your mouse over the link (don’t click) and look at the bottom-left corner of your browser. The displayed URL should match the company’s official domain. On mobile, press and hold the link to see the destination. If the URL looks like a random string of numbers or contains misspellings (e.g., amaz0n.com), it’s a phishing link.
Inspect attachments with suspicion. After a breach, phishers may send attachments claiming to be “breach details” or “security report.” Legitimate companies rarely send unsolicited attachments. If you receive one, do not open it. Instead, go directly to the company’s website and check for official communications.
Look for poor grammar and odd formatting. While some phishing emails are well-written, many still contain typos, awkward phrasing, or inconsistent formatting (e.g., different fonts, misaligned text). These are red flags, but remember that even a perfectly written email can be phishing—so don’t rely on this alone.
Verify through official channels. If the email claims to be from your bank, social media, or any service, do not use any links or phone numbers in the email. Open a new browser tab, type the official website URL manually, and log in there. Check for any security alerts or messages within your account. If the email is real, you’ll see the same information there.
Check for a legitimate unsubscribe or contact link. Real marketing emails include a working unsubscribe link. Phishing emails often have a fake or missing one. However, some phishing emails include a real link to make the email look legit—so this is not a foolproof test.
Use a password manager to check for reused passwords. If you’ve used the same password on multiple sites, a breach on one site means attackers can access all of them. A password manager can help you generate unique passwords and flag reused ones. If you’ve reused the breached password, change it immediately on all accounts that use it.

Common Mistakes

Clicking a link “just to see.” Even clicking a phishing link can trigger a download or track your device. Always hover first, and if you’re unsure, don’t click at all.
Trusting the display name. An email can show “Your Bank” as the sender name, but the actual address is a random string. Always check the full address.
Ignoring the domain in the link. A link may say https://www.bank.com/security, but the actual destination could be http://evil.com. Hovering reveals the true destination.
Assuming a breach email is always fake. Sometimes the email is real, but it’s still safer to verify through official channels. Don’t ignore a legitimate breach notification, but don’t act on the email itself.
Entering credentials on a page that “looks right.” Phishers can copy a company’s login page perfectly. Always navigate to the site yourself, not through the email link.

Tips

Enable two-factor authentication (2FA) on all important accounts. Even if a phisher gets your password, they won’t have your phone or authenticator app.
Use a separate email address for financial accounts and important services. That way, a breach on a forum won’t expose the email you use for banking.
Keep your software updated—this includes your email client, browser, and operating system. Updates often fix security holes that phishers exploit.
Report phishing emails to your email provider (e.g., Gmail’s “Report phishing” button) and to the company being impersonated. This helps them take down fraudulent domains.
If you think you’ve clicked a phishing link, change your passwords immediately from a different device, and run a virus scan.

Troubleshooting

What if the email looks legitimate and passes all checks? Even then, it’s safest to log in manually. If you do log in through the email link and it works, still change your password later to be safe.

What if you already clicked a link and entered your password? Act fast: change the password for that account immediately, and for any other account using the same password. Enable 2FA if you haven’t. If you entered financial details, contact your bank or card issuer. Consider using a credit monitoring service if the breach involved sensitive data.

What if you can’t tell if the email is real or fake? Call the company using the phone number on their official website (not the one in the email). Ask them to verify if they sent the email. Most companies have a security team that can confirm.

What if the phishing email is targeting your work email? Report it to your IT department immediately. They may need to block the sender and check for other compromised accounts. Do not forward the email to colleagues—they might click it.

What if you suspect a data breach but haven’t received an email? Check haveibeenpwned.com to see if your email appears in known breaches. If it does, change your passwords proactively, especially on accounts where you used the same password.

Frequently Asked Questions

How soon after a data breach should I expect phishing emails?

Phishing emails can arrive within hours or even days after a breach is announced. Attackers act quickly to exploit the window before people change their passwords.

Can phishing emails contain malware even if I don’t click anything?

In most cases, simply opening an email is safe. However, some emails contain tracking pixels that can tell the sender you opened it. Malware usually requires you to click a link or download an attachment.

What should I do if I already clicked a link but didn’t enter any information?

Change your passwords anyway, and run a security scan on your device. Some links can install malware without any further action. If you’re concerned, disconnect the device from the internet and scan it.

Is it safe to use the “unsubscribe” link in a suspicious email?

No. That link can lead to a phishing site or download malware. Instead, mark the email as spam and delete it.

Why do phishers use data breach information?

They use leaked data to make their emails more convincing—for example, using your real name, a recent purchase, or a password you’ve used before. This increases the chance you’ll trust the email.

Can a phishing email come from a legitimate company’s domain?

Yes, if the company’s email system is compromised or if attackers spoof the domain. However, spoofing is often blocked by email security protocols like SPF and DKIM. If you see an email from a legitimate domain but it still looks suspicious, contact the company directly.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →