Phishing

Phishing is a type of fraud where a scammer impersonates a bank, shipping company, government agency, employer, or other trusted source to get you to click a link, open an attachment, or hand over information. Variants include smishing (by text message), vishing (by phone call), and fake QR codes. The FTC warns that phishing messages often tell a story to get you to act fast, such as a problem with your account, a suspicious login, a package that cannot be delivered, or a refund you are owed.

Phishing matters in class action law in two ways. First, many data breaches begin with a phishing email that tricks an employee into giving up login credentials, which lets attackers into company systems. Breach lawsuits then argue the company failed to train staff or use reasonable safeguards such as multi-factor authentication. Second, after a breach becomes public, scammers often send phishing messages that mention the breach or a settlement to trick victims a second time.

A real class action settlement notice will direct you to a court-approved settlement website and will never ask you to pay a fee to receive your money. Be suspicious of any message that asks for your bank login, Social Security number, or a payment to "release" funds. Go directly to the official website rather than clicking links in an unexpected message, and report phishing to the FTC at ReportFraud.ftc.gov.

See our guides on class action settlement scams and what to do after a data breach notice, and our page on data breach lawsuits.