If you received a notice that your electric utility account information may have been exposed, verify the notice through the utility’s official website or the phone number on a bill, then follow the notice’s account-specific instructions. Change any exposed or reused password, turn on multifactor authentication if the portal offers it, and use the exposed-data details to decide whether you need identity-theft protections. Do not use links or phone numbers in an unexpected message until you have independently verified them.
1. Verify the notice without using its links
A breach notice may be legitimate, but scammers can also impersonate a utility after an incident. Type the utility’s known website address yourself or call the number printed on a bill. The FTC advises customers to use those trusted routes for questions about balances, pending payments, and billing issues, and warns that utility scams can arrive by phone, text, email, or in person. Do not sign in through an unexpected message link or rely on a phone number in that message.
2. Find out what was exposed
Read the notice using the verified route, and contact the utility if it does not explain the exposure or what to do. Ask whether the incident involved your online credentials and which personal or payment details were affected. The notice for the specific incident—not the fact that it was a utility breach—determines whether you should take additional identity-protection steps.
Follow any instructions the utility gives for your account. The breach notice or the utility’s official customer-service channel is also the right place to confirm available recovery steps and security settings; portals do not all offer the same controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTED – The PIN used to unlock OnlyKey is entered directly on it. This means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN –No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
3. Change your password and protect other accounts
Set a new, strong password that you do not use anywhere else. If you reused the exposed password on another account, change it there too. Criminals may try credentials stolen in one breach on other services, so a unique password limits the damage if a password is exposed again.
4. Turn on multifactor authentication if available
In the utility portal, look under account or security settings for multifactor authentication (MFA), two-factor authentication, or two-step verification. MFA requires a second factor in addition to your password. The utility determines which methods it supports, so check its settings or ask customer service rather than assuming a particular method is available.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If the portal offers a choice, FTC guidance favors security keys and says authenticator apps are safer than verification codes sent by text or email. A physical security key is only an option if the portal supports it; choose a method you can use reliably and recover access to if you lose your device.
5. Check for signs of account takeover
If you see changes you did not make, unfamiliar activity, or cannot access the account, use the utility’s official recovery process. Where the portal provides the controls, sign out of other devices and verify that the recovery email address and phone number belong to you. Contact the utility through its verified website or the number on your bill if you need help restoring access.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #3
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
6. Treat follow-up requests as unverified
- Never give a one-time verification code to someone who contacted you unexpectedly. A caller or texter asking for a code is not verified just because they know your account details.
- Check payment demands, billing problems, or requests for personal information by signing in through the utility’s known website or calling the number on your bill.
- Do not let threats of immediate disconnection rush you into paying through a link, gift card, or other unusual method. Verify the claim directly with the utility first.
7. Match identity-protection steps to the exposed information
Check the notice for the specific data involved. A name or address, a password, payment details, and a Social Security number can call for different responses. Do not assume every utility breach means you need a credit freeze or identity-monitoring service. For guidance based on the information exposed, use the FTC’s IdentityTheft.gov resources and follow the instructions in your incident notice.
Quick Recap
Best Value
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Sources and further guidance
- FTC: Utility scams — how to verify utility account and billing issues using trusted contact details.
- FTC: What to do after a data breach — general steps for responding to a breach notice.
- FTC: How to recover a hacked email or social media account — related account-recovery guidance, including checking recovery details and signing out of other devices.
- FTC: How to protect your online accounts — password and MFA guidance.
- CISA: Use strong passwords — security guidance that includes multifactor authentication.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
