# Dark web alerts about your email, explained

> What dark web monitoring from Experian, Norton, or Microsoft checks, why Google ended its dark web report, how to spot a fake alert, and what to do after one.

A **dark web alert** means a monitoring service found your email address, or other personal data, in leaked information circulating online. It does not mean someone is inside your account. Check first that the alert really comes from a service you signed up for, then change the password it concerns, and any account sharing it, and turn on a second factor.

**Key takeaways**

1. Google stopped scanning for its dark web report on January 15, 2026, and removed the report on February 16, 2026, saying it did not provide helpful next steps.
2. The FTC notes that most identity monitoring services will not alert you if someone uses your information to file a tax return or claim unemployment benefits.
3. The FTC warns that an email claiming your personal information is for sale on the dark web may itself be a phishing attempt.


## What to do when your email is on the dark web

Treat a dark web alert like a breach notice: find out which password or data it concerns, change that password wherever you used it, and turn on a second factor. Before any of that, make sure the alert is real, because the FTC has warned that an email about [your data being for sale on the dark web](https://consumer.ftc.gov/consumer-alerts/2022/09/did-you-get-email-saying-your-personal-info-sale-dark-web) could be phishing. These alerts are one of the situations covered in [our steps after a breach or a hack](/guides/account-security/hacked-accounts/).

Monitoring services compare your email address, phone number, or ID numbers against collections of leaked data and the pages where they circulate, then alert you when they find a match. No service sees everything. Norton, which sells one, says nobody can guarantee monitoring all of the dark web and its private forums.

### Who sends these alerts

Here is what each service checks, as its provider described it on November 10, 2026.

| Service | What it checks | Where and how |
|---|---|---|
| Experian free scan | Social Security number, email, and phone, once, looking back to 2006 | US; free with an Experian sign-up, daily monitoring is paid |
| Norton 360 with LifeLock | Your email address by default, then data you add; a one-time scan back to 2008 at sign-up | Subscription; not available in every country |
| Microsoft Defender identity theft monitoring | Email, full name, and date of birth at first, then data you add; run with Experian | Microsoft says credit monitoring covers only the US and its territories |
| Mozilla Monitor | Breaches involving your email | Free |
| Have I Been Pwned | Breaches involving your email | Free; alerts go only to the address monitored |
| Google dark web report | Discontinued | Scans stopped January 15, 2026; report removed February 16, 2026 |

### Google's report is gone

Google [discontinued its dark web report](https://support.google.com/websearch/answer/16767242?hl=en) in early 2026 because, according to Google, feedback showed it did not provide helpful next steps. All data from the report was deleted on February 16, 2026. Google now points users to its Security Checkup, passkeys, Google Password Manager, and Password Checkup instead. An offer to “see your Google dark web report” after that date deserves suspicion.

### Is the alert real?

A fake alert is an easy lure: it creates urgency and asks you to act. Before doing anything:

- **Do not click the links.** Open the service by typing its address or using its app, and look for the alert there.
- **Check that you signed up.** Experian's scan requires an account, Norton's monitoring comes with a subscription, and Have I Been Pwned writes only to addresses that were verified. An alert from a service you never used is a warning sign.
- **Check the sender.** Every Have I Been Pwned email comes from noreply@haveibeenpwned.com.
- **Refuse to type secrets to “see the results.”** A password, a card number, or an ID number entered on a page reached from an alert can go straight to a scammer.

In the US, the FTC asks people to report fake alerts at ReportFraud.ftc.gov.

### What to do after a real alert

1. **Find out what was found.** A useful alert names the data type and, often, the site it came from.
2. **Change the password,** on that site and everywhere you reused it, starting with your email. Norton recommends changing it even if you do not recognize the site or the password.
3. **Do not panic over an old password.** The UK's NCSC advises changing it if you still use it anywhere, and otherwise moving on.
4. **Turn on a second factor** on your email and on any account that held the leaked password.
5. **If an ID number was found,** check your credit reports and consider a freeze, as the FTC suggests.

### What monitoring cannot see

The FTC's page on [identity theft protection services](https://www.consumer.ftc.gov/articles/0235-identity-theft-protection-services) lists the blind spots. Most identity monitoring will not tell you if someone uses your information to file a tax return or to claim benefits such as Social Security or unemployment, and credit monitoring does not see withdrawals from your bank account. The FTC adds that you can do part of what these services offer yourself, for little or no cost: in the US, a credit freeze and a fraud alert are free, and so are your credit reports.

Before paying for monitoring, check what you already have. The NCSC notes that similar breach checks are often included in antivirus software and password managers.

### Breach first, alert second

A dark web alert may concern data from a breach you were already told about. Our page on [what to change after a breach notice](/guides/account-security/hacked-accounts/email-in-a-data-breach/) sorts the next steps by the data that leaked.

### When the alert lists an ID number

A Social Security, Social Insurance, or other national ID number is the alert to take most seriously. See [the first steps after identity theft](/guides/account-security/hacked-accounts/identity-theft/) in the US, the UK, Canada, and Australia.