I Got a Dark Web Alert — What Now? Free Step-by-Step Checklist

Right now

• Lock down your email account first — Your inbox can reset every other password. Give it a long, unique password and turn on a passkey or an authenticator app.

Today

• See which breaches include your email — Knowing which services leaked tells you which passwords and accounts to fix first. Free dark web scan
• Check recovery options, forwarding and filters — Attackers quietly add their own recovery phone, forwarding rules or filters that hide security emails. Remove anything you didn't set up.
• Move to a password manager — Let it create long, unique passwords (current NIST guidance: at least 15 characters) and warn you when one shows up in a breach.
• Switch on passkeys or two-factor authentication — Passkeys can't be phished. Where they aren't offered, use an authenticator app or security key rather than SMS codes. Why MFA didn't save you (session hijacking)

Keep doing

• Expect convincing scam messages — Leaked details make phishing feel genuine. Don't act on links or calls you weren't expecting — go to the company's app or website yourself. Spotting scam texts
• Use email aliases for new sign-ups — A separate alias per service means the next breach can't lead straight to your main inbox.

Right now

• Lock down your email account first — Your inbox can reset every other password. Give it a long, unique password and turn on a passkey or an authenticator app.
• Change the leaked password everywhere you used it — Start with email, banking and shopping. Every account needs its own password — reuse is how one leak becomes ten break-ins. What leaked logins actually contain
• Sign out of every other session — A new password does not always end logins an attacker already has. Use "sign out of all devices" on important accounts. Why MFA didn't save you (session hijacking)

Today

• Move to a password manager — Let it create long, unique passwords (current NIST guidance: at least 15 characters) and warn you when one shows up in a breach.
• Switch on passkeys or two-factor authentication — Passkeys can't be phished. Where they aren't offered, use an authenticator app or security key rather than SMS codes. Why MFA didn't save you (session hijacking)
• Check your device for password-stealing malware — If passwords were pulled from your browser, malware may still be running. Scan and update the device, then change passwords from a clean one. Infostealer logs explained

Today

• Switch on passkeys or two-factor authentication — Passkeys can't be phished. Where they aren't offered, use an authenticator app or security key rather than SMS codes. Why MFA didn't save you (session hijacking)
• Lock your number against SIM swaps — Ask your mobile provider for a port-out PIN or number lock, so nobody can move your number to their own SIM and receive your codes.

This week

• Remove yourself from people-search sites — Data brokers sell the same details that leaked. Opting out makes you harder to find and target. Can your data be removed from the dark web?

Keep doing

• Expect convincing scam messages — Leaked details make phishing feel genuine. Don't act on links or calls you weren't expecting — go to the company's app or website yourself. Spotting scam texts

Right now

• Freeze the card in your banking app — Most banks let you freeze a card instantly, which blocks new payments while you check what happened.
• Call your bank on the number printed on the card — Report the leak and ask for a replacement with a new number. Never use a phone number from a text or email about the "problem".

Today

• Go through recent transactions — Look for small "test" payments — criminals often try a tiny charge first. Dispute anything you don't recognise straight away.
• Check your credit file with all three agencies UK — Look for searches or accounts you don't recognise at Experian, Equifax and TransUnion. Each offers a free way to see your report. Experian Equifax TransUnion

This week

• Check your credit report for loans you didn't take IN — Fraudsters use leaked Aadhaar and PAN details for instant loans. Check your CIBIL report and raise a dispute for anything unfamiliar. CIBIL
• Turn on instant transaction alerts — A notification for every payment means you spot fraud in minutes, not at the end of the month.

Keep doing

• Expect convincing scam messages — Leaked details make phishing feel genuine. Don't act on links or calls you weren't expecting — go to the company's app or website yourself. Spotting scam texts
• Shop with virtual or one-time card numbers — If a shop is breached, only a disposable number leaks — not your real card.

If it's already been misused

• Dispute every unauthorised payment — Ask your bank to refund unauthorised transactions and confirm the account is closed or reissued.

Right now

• Tell your bank the account details leaked — Ask them to flag the account, reset your online-banking login and watch for new payees, direct debits or transfers.

Today

• Go through recent transactions — Look for small "test" payments — criminals often try a tiny charge first. Dispute anything you don't recognise straight away.
• Check your credit file with all three agencies UK — Look for searches or accounts you don't recognise at Experian, Equifax and TransUnion. Each offers a free way to see your report. Experian Equifax TransUnion

This week

• Freeze your ChexSystems report US — Blocks criminals opening new bank accounts in your name — a gap a credit freeze doesn't cover. ChexSystems
• Check your credit report for loans you didn't take IN — Fraudsters use leaked Aadhaar and PAN details for instant loans. Check your CIBIL report and raise a dispute for anything unfamiliar. CIBIL
• Turn on instant transaction alerts — A notification for every payment means you spot fraud in minutes, not at the end of the month.

Keep doing

• Expect convincing scam messages — Leaked details make phishing feel genuine. Don't act on links or calls you weren't expecting — go to the company's app or website yourself. Spotting scam texts

If it's already been misused

• Dispute every unauthorised payment — Ask your bank to refund unauthorised transactions and confirm the account is closed or reissued.

Right now

• Freeze your credit at all three bureaus US — It is free, takes minutes, and is the strongest block on new accounts in your name. You can lift it whenever you need credit. Equifax Experian TransUnion
• Lock your Aadhaar biometrics IN — Lock them in the myAadhaar portal or mAadhaar app, and check your authentication history for uses you don't recognise. myAadhaar

Today

• Get an IRS Identity Protection PIN US — A six-digit PIN that stops anyone else filing a tax return with your SSN. Anyone who can verify their identity can get one; it renews each January. IRS IP PIN
• Check your credit file with all three agencies UK — Look for searches or accounts you don't recognise at Experian, Equifax and TransUnion. Each offers a free way to see your report. Experian Equifax TransUnion
• Ask your national credit bureau about a freeze or fraud alert OTHER — Most countries have a way to block or flag new credit in your name. Your bank can tell you which bureau to contact.

This week

• Create your my Social Security account US — Claim it before a criminal does, then check that your earnings record looks right. my Social Security Is your SSN on the dark web?
• Lock your SSN in E-Verify US — Self Lock stops your SSN being used to pass employment checks. E-Verify Self Lock
• Freeze your ChexSystems report US — Blocks criminals opening new bank accounts in your name — a gap a credit freeze doesn't cover. ChexSystems
• Consider Cifas Protective Registration UK — Adds a warning to your file so lenders double-check any application in your name. There is a small fee. Cifas
• Check your credit report for loans you didn't take IN — Fraudsters use leaked Aadhaar and PAN details for instant loans. Check your CIBIL report and raise a dispute for anything unfamiliar. CIBIL

Keep doing

• Check your credit reports regularly US — Reports from all three bureaus are free every week. AnnualCreditReport.com

Today

• Check your credit file with all three agencies UK — Look for searches or accounts you don't recognise at Experian, Equifax and TransUnion. Each offers a free way to see your report. Experian Equifax TransUnion

This week

• Consider Cifas Protective Registration UK — Adds a warning to your file so lenders double-check any application in your name. There is a small fee. Cifas
• Check your credit report for loans you didn't take IN — Fraudsters use leaked Aadhaar and PAN details for instant loans. Check your CIBIL report and raise a dispute for anything unfamiliar. CIBIL
• Remove yourself from people-search sites — Data brokers sell the same details that leaked. Opting out makes you harder to find and target. Can your data be removed from the dark web?

Keep doing

• Expect convincing scam messages — Leaked details make phishing feel genuine. Don't act on links or calls you weren't expecting — go to the company's app or website yourself. Spotting scam texts
• Check your credit reports regularly US — Reports from all three bureaus are free every week. AnnualCreditReport.com
• Understand what usually happens next — How leaked data is bought, sold and used — and what is worth worrying about. What to do if your data is on the dark web

Right now

• Freeze your credit at all three bureaus US — It is free, takes minutes, and is the strongest block on new accounts in your name. You can lift it whenever you need credit. Equifax Experian TransUnion
• Lock your Aadhaar biometrics IN — Lock them in the myAadhaar portal or mAadhaar app, and check your authentication history for uses you don't recognise. myAadhaar

Today

• Check your credit file with all three agencies UK — Look for searches or accounts you don't recognise at Experian, Equifax and TransUnion. Each offers a free way to see your report. Experian Equifax TransUnion
• Ask your national credit bureau about a freeze or fraud alert OTHER — Most countries have a way to block or flag new credit in your name. Your bank can tell you which bureau to contact.
• Tell the authority that issued the document — The passport office or driving-licence agency can record it as compromised and advise whether to replace it.

This week

• Consider Cifas Protective Registration UK — Adds a warning to your file so lenders double-check any application in your name. There is a small fee. Cifas

Keep doing

• Check your credit reports regularly US — Reports from all three bureaus are free every week. AnnualCreditReport.com

This week

• Keep a record — Save the alert, and note dates, reference numbers and who you spoke to. It makes disputes and reports much faster.

Keep doing

• Keep watching for new leaks — Data keeps resurfacing for years. Free monitoring tells you when it happens again. Free ways to keep monitoring Data breach trackers guide

If it's already been misused

• Report it at IdentityTheft.gov US — The FTC builds a personal recovery plan and the report you need for disputes. For online fraud, also file with the FBI's IC3. IdentityTheft.gov IC3 Identity theft and the dark web
• Report it to Report Fraud UK — Report Fraud replaced Action Fraud in England, Wales and Northern Ireland: report online or call 0300 123 2040. In Scotland, call Police Scotland on 101. Report Fraud
• Call 1930 or report at cybercrime.gov.in IN — Report financial fraud as fast as possible — quick reports give the best chance of freezing the money. cybercrime.gov.in
• Report it to the police OTHER — Use your national police or cybercrime reporting service. A report reference helps with banks and lenders.