The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume an unexpected breach-related email or text is untrusted until you verify it through a channel you already know belongs to the utility. Do not click its links, open attachments, reply, scan a QR code, or call a number in the message. Instead, type the utility’s known web address yourself or use the telephone number printed on a bill. A real logo, your name, an account number, or an accurate outage detail does not prove that the message is genuine.
Why a utility-breach message deserves extra suspicion
A data breach gives criminals a convincing story. They can claim that your account was exposed, that a security check is required, or that you must confirm payment details before service is interrupted. The message may use the utility’s colors and logo, address you by name, and include partial information that was stolen elsewhere. Those details are designed to lower your guard, not to authenticate the sender.
The decisive test is independent verification. A message can be genuine and still be unsafe to use as your route into an account. Leave the message, open a browser or the utility’s official app yourself, and look for a matching notice in the account, outage center, or news section. If you cannot find confirmation, call the number printed on a paper bill or on a statement you already had—not a number supplied in the message.
The Federal Trade Commission (FTC) warns that “while real companies might communicate with you by email, legitimate companies won’t email or text with a link to update your payment information.” Treat any unexpected payment-update link as a stop signal, even when the message says the request is related to the breach.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Red flags in emails and texts
No single clue proves a message is fraudulent. Several small inconsistencies together are strong evidence that you should not interact with it.
| Signal | Why it is suspicious | What to do |
|---|---|---|
| You do not have an account with the named utility | An unsolicited message addressed to a non-customer is likely mass phishing. | Do not reply or use its contact details. Report it and delete it. |
| “Pay now,” “same-day shutoff,” or “avoid fees today” | Urgency prevents you from checking the account independently. Real utilities do not demand immediate payment to avoid same-day disconnection. | Pause. Check your account and call the number on a bill. |
| Gift cards, cryptocurrency, wire transfers, payment apps, QR codes, or retail barcodes | These methods are difficult to reverse and are favored by impersonators. | Do not buy, scan, or send anything. Contact the utility through a verified channel. |
| A link to sign in or update billing | The destination may be a look-alike site that captures your password or card number. | Type the web address yourself or use a saved bookmark. |
| Mismatched sender domain or strange spelling | The visible sender name can be forged; the underlying address and link destination may belong to an unrelated domain. | On a computer, hover without clicking to inspect the destination. On a phone, do not tap-and-hold links if doing so could open them; use the independent-login method instead. |
| Unexpected attachment | A document or archive can request macros, credentials, or install malware. | Do not open it. Verify through the utility’s known website. |
| A breach “security check” asking for personal or payment data | Criminals use a real incident as a pretext to collect information that the utility already has or does not need by email. | Look for the utility’s published explanation of how it will contact customers. |
Check the complete sender address
In an email program, expand the sender details rather than relying on the display name. A message that says “City Power Billing” may come from a free-mail account or a domain that differs by one character. Subdomains and extra words can also mislead: a domain ending in a familiar name is not necessarily controlled by that company. If the message claims to be from a utility, the address should make sense for that utility and should agree with the contact method described on its official website.
Do not treat an address that merely contains the utility’s name as proof. Look at the ending of the domain and any spelling, punctuation, or added words. When in doubt, do not investigate by replying; use a known bill or bookmark.
Inspect links without following them
On a desktop, place the pointer over a link and read the destination shown by the browser. Be wary of shortened links, unexpected country-code domains, misspellings, and pages that ask for a password before explaining the alleged breach. A secure-lock icon only indicates that the connection is encrypted; it does not establish who operates the site.
QR codes deserve the same caution as clickable links. They can send a phone to a counterfeit payment page even when the surrounding text looks official. Do not scan a code from an unexpected utility message. Navigate independently instead.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to verify a breach notice safely
- Stop interacting with the message. Leave links, attachments, QR codes, phone numbers, and reply buttons untouched. If you opened the message, that alone does not mean your account is compromised; the dangerous step is usually entering information, downloading content, or sending money.
- Open a known route to the utility. Type the address you have used before, select a saved bookmark, or open the utility’s official app. Do not search for a phone number and then assume the first advertisement or result is official.
- Sign in only on that route. Check the account dashboard for a breach notice, billing alert, outage information, or a request to change credentials. If the utility has announced a contact process, compare the message with that description.
- Call using a trusted number. Use the number printed on a bill, statement, or card you already possessed. Ask whether the utility sent the message, whether your account is actually at risk, and what payment methods it accepts.
- Save evidence before deleting. Keep the email’s original headers if possible, or take a screenshot of the text, sender, destination, and time. Do not forward a suspicious message to family or coworkers without warning them not to click its contents.
A legitimate utility may communicate by email or text, but its normal communication does not override the need to verify an unusual request. The FTC’s guidance specifically says that real utility companies will not demand immediate payment to avoid same-day disconnection.
Payment demands that are almost certainly scams
Impersonators often direct victims away from normal billing channels. Gift cards, cryptocurrency, wire transfers, payment apps, QR-code checkout pages, and barcodes intended for payment at a retailer are major warning signs. A caller or message may claim that a supervisor authorized the unusual method or that the payment must be completed within minutes. Those explanations do not make the demand legitimate.
The FTC states: “No utility company will text you about a shut-off, and no utility company will demand payment in cryptocurrency.” A text that combines a shutoff threat with a crypto address, a QR code, or a retail barcode should be treated as fraud. Do not buy a card, reveal its number and PIN, send cryptocurrency, or provide a payment-app confirmation code.
Normal billing questions can still be urgent for you, but urgency is not a reason to use the sender’s channel. Verify the balance through the account you opened independently and pay only through the methods listed there or on a prior bill.
What to do if you clicked, downloaded something, or entered information
Act according to the information or access that may have been exposed. Speed matters, but use the real utility website or another trusted device—not the suspicious link—to make changes.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you entered a password
- Go directly to the real site and change the exposed password.
- Change that password anywhere else you reused it. Start with email, banking, payment, cloud-storage, and social accounts because access to those accounts can enable further resets.
- Sign out other sessions if the service offers that control, and review recent login activity for unfamiliar devices or locations.
- Enable multifactor authentication (MFA). An authenticator app, security key, or another independent factor makes a stolen username and password less useful to an attacker. Keep the recovery codes somewhere safe and confirm that the recovery email and phone number are yours.
A security key can be a strong phishing-resistant second factor, but compatibility varies by account, operating system, browser, and connector. Confirm those requirements and the account’s recovery process before purchasing or enrolling one.
Free tools Windows power users keep installed
One-click scans. No signup required.
If you entered Social Security, bank, or card information
Use IdentityTheft.gov for a recovery plan tailored to the type of information exposed. Follow its recommendations for contacting financial institutions, replacing compromised credentials or cards, and watching for identity misuse. Contact your bank or card issuer through the number on the card or statement, not through the message.
Ask the institution what protective steps apply to your situation, such as replacing an account number, blocking a card, disputing an unauthorized transaction, or adding additional verification. Keep a dated record of calls, case numbers, and correspondence.
If you opened an attachment or suspect malware
Do not continue using the device for sensitive logins until you have checked it. Update its operating system, browser, and security software, then run a full scan and remove detected threats. If the security tool cannot clean the device or it behaves abnormally, disconnect it from networks and seek qualified technical help. After remediation, change passwords from a device you trust, because malware may have captured keystrokes or session data.
If you sent money
Contact the organization that handled the payment immediately and ask whether it can be canceled or reversed. The appropriate contact may be your bank, card issuer, payment-app company, retailer that sold a gift card, or cryptocurrency service. Explain that the payment resulted from an impersonation scam, provide the transaction details, and request a fraud case number. Recovery is not guaranteed, but delay reduces the chance of stopping a transfer.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Reporting the message and protecting other people
Reporting helps providers identify campaigns and gives you a record that the message was fraudulent.
- Forward suspicious email to
reportphishing@apwg.org. - Forward a suspicious text to
7726, which spells SPAM on most phones. - Report the fraud to
ReportFraud.ftc.gov. - Notify the utility through its verified website, app, or the number on a bill. Tell it whether you clicked, disclosed information, or paid.
After preserving evidence and reporting, delete the message and empty the deleted-items folder. If the account is shared, tell household members, a property manager, or coworkers who handle the same utility account. Explain which details were exposed and which contact method is safe so that another person does not act on the same campaign.
A practical decision process for common scenarios
| What you received or did | Immediate response | Next check |
|---|---|---|
| Email says a breach requires payment-information confirmation | Do not click or reply. | Open the utility’s known site and look for a notice; call the bill number if nothing appears. |
| Text threatens shutoff today | Do not call the text’s number or scan its code. | Check the balance independently and ask the utility whether a shutoff notice exists. |
| You clicked but entered nothing | Close the page and do not download anything. | Update security software and scan if a file opened or the device behaved unexpectedly. |
| You entered a reused password | Change it at the real site immediately. | Change every account sharing it, enable MFA, and review login sessions. |
| You supplied identity or financial data | Contact the relevant institution using a trusted number. | Use IdentityTheft.gov and document each case and response. |
| You paid by card, bank transfer, app, gift card, or cryptocurrency | Contact the payment provider immediately. | Request reversal, preserve receipts and wallet or transaction details, and report the fraud. |
How criminals make a fake message look real
Branding and customer details
Logos, colors, legal disclaimers, and partial account information can be copied from public pages or previous breaches. Personalization raises credibility but does not prove that the sender controls your utility account. Authentication comes from the independent channel, not from the appearance of the message.
Real events used as pretexts
A utility may genuinely have disclosed a breach or posted an outage update. Attackers monitor news and send messages while public attention is high. They may promise credit monitoring, a refund, or a mandatory “security check.” Check the utility’s public notice for what information was affected, how customers will be contacted, and where future updates will appear. If those instructions differ from the message, follow the published instructions.
Pressure that blocks careful thinking
Threats of immediate disconnection, late fees, legal action, or loss of service are intended to make you act before verifying. A genuine billing issue can be handled through the normal account and customer-service process. Take a pause, involve another household member if appropriate, and use a known number.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Choosing protections after the incident
There is no product that makes phishing impossible, and FTC guidance does not endorse a particular commercial provider. Evaluate protections by the risk they address:
- Account protection: Check whether MFA supports an authenticator app or security key, which devices and browsers work with it, how account recovery operates, and whether recovery codes can be stored securely.
- Device protection: Look for automatic updates, regular malware scanning, and the ability to isolate or remove detected threats. Keep the operating system and browser included in the protection’s supported versions.
- Recovery support: If you consider an identity-assistance service, examine what monitoring or guidance it actually provides, geographic availability, privacy practices, alert scope, cancellation terms, and fees. Such a service does not prevent a phishing click or replace changing exposed passwords.
Free steps—unique passwords, MFA, updates, independent verification, and prompt reporting—are the foundation. Add paid assistance only when its documented coverage matches your situation and you understand what it cannot do.
Preventing the next successful impersonation
- Save the utility’s official website and customer-service number before an emergency occurs.
- Use a password manager to create a unique password for the utility account and for email.
- Turn on MFA and store recovery codes offline or in another protected location.
- Enable automatic updates for phones, computers, browsers, and security software.
- Review account alerts through the utility’s real app or website rather than trusting a link in an alert.
- Teach everyone who can authorize payment that gift cards, cryptocurrency, wire transfers, payment apps, QR codes, and retail barcodes are not normal responses to a shutoff notice.
- Keep paper bills or previously verified statements so a trusted phone number is available during a stressful incident.
Questions to ask the utility when you call
Have the account holder’s information ready, but do not read out a password or one-time code that arrived in the suspicious message. Ask:
- Did you send an email or text about a breach, payment update, or shutoff?
- What contact methods and domains are you using for this incident?
- Is there any balance, hold, outage, or account change visible on my account?
- What should I do if I entered a password, personal information, or payment details?
- Can you place a note on the account or provide a case number?
Use the answers to guide your next action, but continue to protect credentials and payment information through the verified channel. A utility representative should not need the password you typed into a suspicious page.
The short rule to remember
When a utility-breach message demands an immediate click or payment, stop and verify independently. The sender’s logo, caller ID, customer details, and confident tone are not authentication. The bill, a saved official address, and a known customer-service number are the sources you can trust.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
