Data breaches happen constantly, and there is a good chance at least one of your passwords is already in a leaked list somewhere. At the same time, scammers are using AI to write convincing messages and even fake voices and videos. You cannot stop companies from getting hacked, but you can make sure a leak does not turn into a stolen account, and learn to spot the new generation of scams.
How do I know if my passwords were leaked in a data breach?
You usually will not get a warning when your password is exposed, so it is worth checking yourself.
How to check
– Have I Been Pwned (haveibeenpwned.com) is a free, well-known service that tells you which known breaches included your email address. – Your password manager or browser can scan for leaks automatically. Google Password Manager (Password Checkup), Apple’s Passwords app on iPhone and Mac, and managers like Bitwarden or 1Password flag passwords that have appeared in breaches or that you have reused. – Watch for signs: password-reset emails you did not request, login alerts from new locations, or friends receiving strange messages from your accounts.
What to do if you find a leak
– Change the password immediately on the affected site, and on every other site where you used the same or a similar password. Reused passwords are how one breach becomes many. – Use a password manager to create long, unique passwords for every account. You only need to remember one strong master password. – Turn on two-step verification, ideally with an authenticator app or passkeys rather than text messages. – Check your email account first. Whoever controls your email can reset almost everything else. – Review your bank and card statements, and consider freezing your credit with the three credit bureaus if personal details like your Social Security number were exposed. A freeze is free and stops new accounts being opened in your name.
How do I spot AI phishing scams and deepfakes?
Old scams were easy to spot because of bad spelling and strange grammar. AI tools now write perfect, personalized messages, and voice cloning can imitate a relative or boss from just a few seconds of audio. The good news is that the warning signs are about behavior, not spelling.
Red flags in any message
– Urgency and pressure: “Your account will be closed today,” “Pay now or face arrest,” “I need this in the next hour.” – Unusual payment methods: gift cards, wire transfers, cryptocurrency or payment apps to a stranger. – Requests for codes or passwords: no real bank, carrier or tech company will ask you to read back a verification code. – Links that do not match: hover over or long-press a link to see the real address before tapping. Go to the website yourself instead of clicking. – Requests for secrecy: “Do not tell anyone” is a classic scam line.
Spotting deepfake calls and videos
– Voice clones may sound right but struggle with unexpected questions. Hang up and call the person back on a number you already have. – Agree on a family code word that only your close family knows, to use in any emergency call asking for money. – Video fakes can show odd blinking, lips slightly out of sync, blurry edges around the face or strange lighting. Ask the person to turn their head or wave a hand in front of their face; many fakes glitch. – Verify through a second channel before sending money or information, even if the message seems to come from someone you trust.
If you think you have been scammed, contact your bank immediately, change your passwords and report it to the FTC at ReportFraud.ftc.gov.
The bottom line
Assume some of your old passwords are already out there: check them, replace reused ones with unique passwords from a manager, and turn on stronger two-step verification. For AI scams, slow down, never pay under pressure and always verify through a channel you trust.