Fake IDX breach notices: how to tell a real letter from a scam
Quick answer
IDX is a real company that organisations hire to send breach notices and credit monitoring. Scammers can copy that. Don't click or call anything in an unexpected message. Go to IDX's site yourself, or call the number printed on your letter.
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
- Comes by
- Email, Text, Phone call, Mail
- Pretends to be
- IDX
- Last updated
How it works
When a company has a data breach, it often hires a service such as IDX to send letters and offer free credit and identity monitoring. Those notices are real, and many people search "IDX scam" after getting one.
The risk is that scammers copy the idea. IDX itself says fake data breach letters or emails that ask you to confirm personal information are a known tactic, and that identity thieves sometimes use big breaches in the news to target people who weren't affected.
A fake version tends to work like this:
- A message says your data was in a breach and you must "enroll" or "verify" quickly.
- A link or phone number leads to a lookalike page or a caller.
- They ask for your Social Security number, date of birth or card details, which is what they wanted all along.
A real IDX letter arrives from the organisation that had the breach and contains an enrollment link, and often a code. Some letters have no code and give instructions in the letter. IDX suggests typing the web address from the letter into your browser, or going to its general enrollment site, instead of clicking.
Sources checked: idx.us
Last verified against the official page:
Red flags
- A breach notice from a company you've never dealt with
- A text or call out of the blue rather than a letter
- Pressure to enroll or verify within hours
- A request for your full Social Security number or card details to 'confirm' you
- A link or number you have to use, with no way to check the breach another way
- An alert that appears only in an email or text, with nothing matching in your IDX account
Example message
We've detected your information was exposed in a recent data breach. Activate your free identity protection now at [link] or call [phone number] to verify your identity.
What to do
- 1
Don't use the link or number
IDX's own advice: if a message claims to be from a legitimate business, don't click any links or call any numbers in it. Find the real contact details and reach out that way.
- 2
Check the breach
Look for the breach on the named company's own website, or call the company at a number you find yourself. If you have an IDX account, check the Alerts (bell icon) section in your dashboard.
- 3
If you have a real letter
Type the web address from the letter into your browser, or call the number printed on the letter.
- 4
If you clicked or gave details
Change passwords for any account you mentioned, turn on two-step verification, watch your accounts, and visit identitytheft.gov for a recovery plan.
- 5
Report it
File a report at ReportFraud.ftc.gov so the FTC can see the pattern.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers who pose as breach-notice services often have your name and contact details already, because they come from earlier breaches and data brokers (companies that collect and sell personal info). That makes a fake notice sound right. Serus alerts you when your email, password or other data appears in a breach and finds people-search listings to remove, so fewer scammers have a way to reach you.
Frequently asked
Is IDX legitimate?
IDX is a real company that organisations hire to run breach notification and monitoring, and state breach letters name it. The risk is a fake message that copies it.
I got a letter that offers IDX monitoring. Is that real?
It can be. Check the breach with the company that sent it, and use the web address or phone number printed on the letter, not a link in a text or email.
Should I give my full Social Security number to someone who contacts me about IDX?
No. Don't share it with anyone who contacts you out of the blue. Verify through the contact details on your letter or on the company's own website first.
What should I do if I enrolled on a fake site?
Change passwords, turn on two-step verification, tell your bank if you gave card details, and follow the steps at identitytheft.gov.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
