NewAI Content Creation is now live in Early Access
Turning Point Training Instituteby Training Center
Catalog
Skip to content
0%
Unit VI — Evidence and InvestigationLesson 2 of 6
9 min readBeginner

Where you are: Unit VI — Evidence and Investigation · Lesson 6.2 · This topic is new in the 2026 edition of the course. It extends the evidence-keeping habit from Lesson 6.1 to two situations Dr. Al-Doori's Cyber Security Essentials does not cover directly: a company losing your data, and you reporting a scam.

What you'll be able to do

You will be able to respond to a data-breach notice and know what information to collect when reporting a scam.

  • Decide which of your accounts need action after a breach, and in what order.
  • Spot the follow-up scams that often arrive after a breach.
  • Gather the right facts before you report a scam, without handing over anything secret.

What a data breach is — and what it exposes

A data breach happens when an organisation loses control of information it holds about people, for example because attackers broke into its systems or a database was left exposed. You did nothing wrong, but your data is now in someone else's hands.

What leaks varies from breach to breach. It can include:

  • email addresses and usernames;
  • passwords — ideally stored as salted, slow hashes (Lesson 4.1), but sometimes poorly protected;
  • phone numbers, home addresses and dates of birth;
  • order histories and payment details.

Leaked data rarely stays in one place. Criminals collect it into huge lists and use it for credential stuffing — trying leaked email-and-password pairs on other sites (Lesson 4.2) — and for convincing scams.

Responding to a breach notice

  1. Check that the notice is genuine. Breach news is a favourite phishing lure. Don't use links in the message. Go to the company's website or app yourself and look for its announcement.
  2. Find out what was exposed. The company's notice, or its website, should say which kinds of data were involved. That tells you what to do next.
  3. If a password was involved, change it — on that site and anywhere you used the same password. Start with email and financial accounts. Turn on MFA or a passkey where you can (Unit IV).
  4. Expect follow-up phishing. Scammers may use the leaked details — your name, your real order, your phone number — to make their messages believable. Treat any unexpected contact that "knows" about you with extra care.
  5. If payment or identity details leaked, watch your money. Check statements and contact your bank if anything looks unfamiliar. In the US, the FTC's IdentityTheft.gov breach steps include considering a credit freeze.
  6. Check other exposure. Have I Been Pwned lets you check whether your email address appears in known breaches. Its Pwned Passwords service checks a password using a method called k-anonymity, so your full password is never sent. Many password managers now give similar alerts.

Why reporting matters

Reporting a scam can feel pointless when the money may be gone. It still matters. Reports help agencies see patterns, warn other people, and take down scam websites and phone numbers. Your bank or a platform may also need a report before it can investigate. A report does not guarantee you will get money back, but without reports, nobody can see the full picture.

What to collect before you report

Use the same "capture first" habit from Lesson 6.1. Before you report, gather:

  • Dates and times — when the contact happened, when you paid, when you noticed.
  • The messages themselves — keep the original emails and texts, plus dated screenshots of chats and web pages.
  • What the scammer used — the sender address, phone number, profile name or web address exactly as shown.
  • Amounts and payment details — how much, how you paid, and any transaction reference.
  • Accounts involved — which of your accounts were affected, and any account details the scammer asked you to pay into.
  • What you have done since — for example, "called the bank at 14:20, card cancelled".

Share this only with your bank, the platform or an official reporting service. No genuine reporting service will ever ask for your passwords, PINs or one-time codes, so never include them.

Where to report: principles, with US and UK examples

Three principles apply in most countries:

  • If money is involved, contact your bank first, using the number on your card or its official app. Speed matters.
  • Report to the platform where the scam appeared, using its "report" feature, so it can remove the account or message.
  • Report to the official national service for fraud or cybercrime in your country.

Examples from the UK and US: in the UK, the NCSC asks people to forward suspicious emails to its reporting service at report@phishing.gov.uk. In the UK and with many US carriers, you can forward scam texts to 7726. In the US, the FTC collects fraud reports and the FBI's Internet Crime Complaint Center (IC3) collects cybercrime complaints. Wherever you live, check your national cybersecurity agency or police website for the official channel.

Real-World Example

In November 2025, security researcher Troy Hunt described loading one enormous credential-stuffing collection into Have I Been Pwned. It contained about 2 billion email addresses and about 1.3 billion unique passwords, roughly 625 million of which had never been seen by the service before. Lists like this are exactly what attackers feed into credential stuffing. Hunt's advice to people found in it matches this lesson: use a password manager, make every password strong and unique, use passkeys where available, and turn on multi-factor authentication.

Why This Matters in 2026

For individuals, scams cause most of the harm. The FBI's IC3 2025 annual report (published April 2026) recorded about $20.9 billion in reported losses, and about 85% of the losses individuals reported came from cyber-enabled fraud. Phishing and spoofing was the most-reported complaint type, with 191,561 complaints. People aged 60 and over reported about $7.7 billion in losses. These figures only count what people reported, which is one more reason reporting matters.

Breach guidance has also moved from "nothing you can do" to clear steps. The NCSC and the FTC both now publish plain-language steps for individuals and families, built around changing exposed passwords, expecting follow-up scams and protecting your money.

What Would You Do?

You receive an email that appears to come from an online shop you really use: "We have suffered a data breach. Click here within 24 hours to reset your password and re-verify your card, or your account will be closed." Earlier that week you had seen the breach in the news.

What do you do with this message, and what do you do about your account? The answer note below resolves it.

Knowledge Check

A news report says a shop you use was breached and passwords were exposed. You used that password on two other sites. What should you do first?

You were tricked into paying a fake delivery fee. Which set of information is most useful to collect before you report it?

Answers explained

  • Question 1 — c is right. A breached password is tried on other sites through credential stuffing, so every place it was reused is at risk. Changing it only on the shop's site (b) leaves the reused copies open. Waiting for a reset email (a) invites phishing, and deleting the account (d) does not protect the other sites.
  • Question 2 — a is right. These facts let the bank and investigators trace the payment and the scammer. Never share passwords or one-time codes with anyone, including your bank. Deleting messages destroys the evidence, and screenshots of your contacts expose other people's data.

What Would You Do? — model answer: Treat the email as a likely follow-up phishing attempt, even though the breach is real. The urgency, the threat to close your account and the request to "re-verify" your card are classic warning signs. Don't click. Open the shop's app or type its address yourself and read its official breach announcement. If passwords were involved, change yours there — and anywhere you reused it — with your password manager, and turn on MFA if the shop offers it. Watch your card statements. Report the phishing email (in the UK, forward it to report@phishing.gov.uk), then delete it.

Key Takeaways

  • A breach notice is a reason to act — and a favourite disguise for phishing. Always check it by going to the company yourself.
  • Change exposed passwords everywhere they were reused, starting with email and money, and turn on MFA.
  • Expect follow-up scams that use your real details to sound convincing.
  • Before reporting, collect dates, original messages, sender details, amounts and references — never passwords or codes.
  • Report to your bank first if money is involved, then the platform and your national reporting service.

Sources

Next
PreviousWhen Things Go Wrong: Recovering a Hacked Account or DeviceNextCyber Forensics: Where Digital Evidence Hides