A legitimate government data breach notice names a specific official sender, directs you to a .gov domain you can verify independently, and never asks for payment or sensitive account numbers to "confirm" your identity. If a notice arrives by unsolicited phone call or text, pressures you to click an embedded link, or asks for your Social Security number upfront, treat it as fraudulent. The distinction matters because real breaches generate real notification duties, and scammers exploit that process to harvest the exact data a breach already exposed. Knowing the specific markers genuine notices carry — and the channels they never use — lets you act on a real notice and discard a fake one with confidence.
Table of Contents
- What a genuine notice actually contains
- Why fake notices follow real breaches
- Why a listing on a state breach database isn't automatic proof
- How to verify a notice before you act on it
- Frequently Asked Questions
What a genuine notice actually contains
The clearest known example comes from the 2015 Office of Personnel Management breach. Genuine OPM letters carried a signature from then-acting director Beth Cobert, a 25-digit PIN for registering with credit and identity monitoring, and instructions pointing only to an official OPM cybersecurity website, according to the BBB's review of those letters. Those three elements together — a named official, a unique enrollment credential, and a single official destination — are what separates a real notice from an imitation.
Format matters as much as content. Consumer reporters at Scripps-affiliated stations advised that a real government breach letter will never arrive by email, phone call, or text, and that any enrollment link should match an official .gov domain rather than whatever address appears printed in the letter itself, per Scripps News' consumer guidance. If the notice arrived by text message or an unexpected phone call, that channel alone is enough to disqualify it, regardless of what it says.
Why fake notices follow real breaches
Scammers don't invent breaches from nothing — they ride on real ones. After the 2015 OPM hack became public, the BBB found scammers mailing and emailing lookalike notices that directed recipients to fake "credit monitoring" sign-up pages built to harvest the personal data the breach had already exposed, rather than routing them to official enrollment portals, according to the BBB's findings. The same pattern repeats with phone calls: the FTC has warned that after breaches like the Equifax incident, callers impersonating the breached company or government recovery staff tried to extract Social Security numbers and account details, and that neither party will call unprompted to request this information, per FTC alerts reported by NBC.
The FTC has also flagged counterfeit websites mimicking its own refund and recovery pages. A legitimate FTC process never asks for a bank account number, credit card number, or Social Security number to issue a refund, according to Meritalk's reporting on the imposter sites. Any page tied to a breach notice that asks for that information before offering help is not run by the agency it claims to represent.
Why a listing on a state breach database isn't automatic proof
State attorneys general maintain public databases of breach notifications, but a listing there is not independently verified before it posts. In June 2026, Maine's Attorney General took its public data-breach-notification portal offline entirely after fake filings impersonating Discord and VRChat were submitted and published without any review, confirming that anything submitted to the portal appears publicly unchecked, according to BleepingComputer's report. Maine's office acknowledged it has no independent knowledge of the breaches reported to it — a filer completes an online form and the content posts directly to the public site, as Cryptika's coverage of the portal shutdown detailed.
That gap doesn't mean breach-notification law is toothless — it means the public database is a filing record, not a fact-check. Actual state statutes set specific, mandatory content for the notices companies must file with an attorney general: Washington requires the number of affected residents, the data types exposed, the exposure timeframe, and remediation steps within 30 days of discovery, while Texas requires a filing within 60 days detailing the breach and how many residents were notified, according to a summary of state breach-notification statutes. A genuine notice you receive personally should echo that level of specificity — what was exposed, when, and what the company is doing about it — not vague language about "irregular activity.".
How to verify a notice before you act on it
Never use the phone number or link printed in the letter, email, or text itself — go directly to the issuing agency's own site by typing the address yourself, or call a number you looked up independently. That's the standard consumer guidance that emerged from the Maine portal incident, per reporting on the fake disclosures.
This single step defeats most fake notices, because scammers depend on you clicking their link or dialing their number rather than finding the real one yourself. A short verification checklist: If the notice checks out and your information was genuinely exposed, enroll through the verified official channel only. If you encounter a suspicious notice, report it at ReportFraud.ftc.gov, and if your data was actually exposed in a confirmed breach, use IdentityTheft.gov to build a personal recovery plan, per the FTC's consumer guidance.
- Confirm the sender is a named official or agency, not a generic "security team."
- Type the agency's known domain into your browser instead of clicking any link in the notice.
- Reject any notice that arrived by unsolicited call, text, or email as the first contact.
- Treat any request for a Social Security number, bank details, or payment as disqualifying.
- Cross-check the notice's specifics — what data, what dates, what remediation — against what the issuing company or agency has published elsewhere.
Frequently Asked Questions
Can a breach notice legitimately ask me to click a link to enroll in credit monitoring?
Only if that link matches the agency's or company's official domain exactly; type the address yourself instead of clicking the one in the message, per Scripps News' guidance.
Does a breach appearing on a state attorney general's public notification database prove it happened as described?
No. Maine's office confirmed it has no independent knowledge of breaches filed to its portal before fake filings forced it offline, according to Cryptika's reporting.
What should I do if I already gave out information to a suspicious notice?
Report the contact at ReportFraud.ftc.gov and start a recovery plan at IdentityTheft.gov, per the FTC's consumer alerts.
You Might Also Like
- What Is the FBI PeopleSoft Data Breach Contractor Investigation About?
- Pentagon Data Breach: What Government Employees Should Do Next
- MAG Data Breach Email: How to Distinguish an Airport Notice From a Claims Advertisement