The envelope is thick. The letterhead belongs to a company you have never done business with. Inside, a breach notice says a firm you do recognize lost your records four months ago. It offers two years of credit monitoring, and the enrollment deadline is three weeks out. There is a toll-free number at the bottom. A man in his sixties reads it twice and decides it smells wrong. So he searches the number on his phone, calls the first result, and spends nine minutes confirming his Social Security number to someone who was waiting for that exact call.
He did the sensible thing and still lost. That is the trap in this piece of mail, because the real ones look like the fakes. So the question is not whether the letter feels off. The question is simpler. Which facts on it can you confirm somewhere else, in a few minutes, without using anything the letter handed you?
A real breach notice usually comes from a company you have never heard of
This detail makes people hang up on the truth. California’s Attorney General collects these filings. It states plainly that the organization sending a notice is not always the one that was breached. Real letters routinely arrive from CyberScout, Kroll or TransUnion. Companies hire those firms to handle the mailing and the monitoring sign-up. So an unfamiliar sender is not evidence of a scam. It is normal, and scammers know it is normal.
Two other normal things also read as suspicious. First, the gap. A company can find an intrusion in June and reach your mailbox in October, because the investigation and the state filings come first. Second, the enrollment code. It is a short string of letters and numbers unique to you, and it exists so the vendor can match you without asking for your Social Security number.
Start with the company’s own website, not the breach notice in your hand
Open a browser and type the breached company’s name yourself. Do not scan the QR code. Do not click the link, and do not call yet. Most companies post an incident page, often titled something like “Notice of Data Event.” The real ones name the same dates and the same vendor as your letter. iRhythm, for example, published its notice of data event alongside a support line. That is why so many people now arrive at a search engine holding a phone number and a question.
One quiet check matters here. The incident page should sit on the company’s real domain. Compare it with an old receipt or an account statement. A lookalike domain with an extra word in it is the tell.
Call the number printed on the company’s site, not the one on the letter
If the two numbers match, you are almost certainly holding a real breach notice. If they differ, call the website’s number anyway and ask about the letter. A fake depends on you dialing its number, because the number is the whole scam. Everything printed next to it is set dressing.
Then ask three questions. Is the incident theirs? Did they hire the mailing vendor your letter names? And is your enrollment deadline the one the letter prints? A real call center answers all three in a minute. Write down what they tell you, because you may need it later.
Confirm the incident exists in a public filing
Breach notices are legal documents, so they leave a paper trail you can read. The California Attorney General runs a searchable list of breach notices. It covers notices that went to more than 500 state residents, and each entry shows the organization, the breach dates and the reported date. For a medical incident, check the HIPAA breach reports at the Department of Health and Human Services. Its Office for Civil Rights investigates every breach affecting 500 or more individuals.
Search the breached company by name. Then compare the incident date in the filing against the date on your letter. Few fakes survive that comparison, because faking a state filing is much harder than faking a letterhead.
What a fake breach notice asks for that a real one does not
A real notice tells you things. A fake asks you for things. That is the cleanest line between them, and it holds even when the design is perfect.
So treat these as stop signs. No legitimate notice needs you to read out your full Social Security number, because the enrollment code already identifies you. None wants your bank account or routing number. A letter that charges you for the monitoring it just offered is a fake. So is one that tells you to install software, or to sign in through a link in the envelope, or to move money “for safekeeping” during a review. And none of this is urgent in hours. Enrollment deadlines run for weeks, so pressure in the first sentence is a tell.
Act on the real one, and report the fake
Once the letter checks out, use the Federal Trade Commission’s IdentityTheft.gov breach tool. It gives you steps matched to the data involved, and those steps differ for a Social Security number and an email address. The FTC also advises changing the password right away on that account and anywhere you reused something similar. Turn on multi-factor authentication too, so a stolen password no longer opens the door on its own. Then enroll in the monitoring. You already paid for it, in a way nobody asked you about.
For a fake, report it at ReportFraud.ftc.gov with the return address and the phone number. Then call the real company and tell them someone is targeting their customers. We wrote separately about what actually happens after your email address appears in a breach, and each incident gets its own write-up in our Breach Breakdown series — including the iRhythm notifications now landing in mailboxes.
Fewer strangers with a reason to email you
Here is the part worth sitting with. You can check a breach notice in ten minutes. You cannot check the forty follow-up emails the breach produces. Your address now sits on lists, and the people buying those lists count on volume rather than craft.
That is the problem OptMsg was built around, one step earlier than sorting. Only people you approve can reach your inbox. Everyone else goes to Trash, so you can look if you want to and ignore if you do not. Your OptMsg account has no password either. So a password leaked by another company’s breach cannot open the inbox that resets everything else you own. None of that tells you whether a letter is genuine. It does change how many strangers get a free run at your attention while you work that out.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
I got a breach notice from a company I have never heard of. Is it a scam? Not necessarily. The California Attorney General notes that the organization sending a notice is not always the one that was breached, and firms like CyberScout, Kroll and TransUnion are routinely hired to send the letters and run the monitoring enrollment.
Should I call the phone number printed on the breach notice? Look the company up yourself first and compare numbers. If the number on the company’s own website matches the letter, it is almost certainly genuine. If it does not, call the website’s number and ask about the letter.
How can I check whether the breach itself really happened? Search the company by name in the California Attorney General’s public list of breach notices, and for medical incidents, the HHS Office for Civil Rights breach portal. Then check that the incident date in the filing matches your letter.
Why did a breach from months ago only reach me now? Investigation and state filings come before individual mailings, so a gap of weeks or months is common. The gap alone is not a sign the letter is fake.
What should I do once I know the breach notice is real? Use the FTC’s IdentityTheft.gov breach tool for steps matched to the data that was taken, change the password on the affected account and anywhere you reused it, turn on multi-factor authentication, and enroll in the monitoring offered.
Where do I report a fake breach notice? Report it at ReportFraud.ftc.gov with the return address and phone number from the letter, then tell the real company its customers are being targeted.
Sources
- California Office of the Attorney General — “Search Data Security Breaches”: https://oag.ca.gov/privacy/databreach/list
- U.S. Department of Health and Human Services, Office for Civil Rights — “Breach Portal”: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- Federal Trade Commission — IdentityTheft.gov data breach tool: https://www.identitytheft.gov/databreach
- Federal Trade Commission — “Have you been affected by a data breach? Read on,” October 2022: https://consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- Federal Trade Commission — ReportFraud.ftc.gov: https://reportfraud.ftc.gov
- iRhythm Technologies — “Notice of Data Event,” updated October 2, 2026: https://www.irhythmtech.com/us/en/who-we-are/news-events/notice-of-data-event
Previous in Privacy Guides: Gmail Built a Screen That Lists Everything You Forgot You Let In
