Spot a scam that uses leaked information
A familiar name, address or purchase does not authenticate a message.
Separate familiarity from identity
A message that names your hotel, old address or an order can feel legitimate. Those details may be available from a public profile or a breach. Judge the requested action and verify the sender through a channel you already trust.
Open the service yourself
Leave the message and use the known app or website. Check whether the request appears in your account. For a call about a financial account, use a trusted contact number instead of one supplied by the caller.
Keep secrets out of the conversation
Do not provide a password, one-time sign-in code or wallet recovery phrase to someone offering help. A request to fill in missing card digits or move money to a safe account deserves independent verification.
If you already responded
Follow the FTC’s recovery guidance for the information you shared. Change an exposed reused password and contact the financial provider if payment details or funds are involved. Preserve relevant evidence privately and use the official reporting process.