A scammer calls claiming to be a police officer. They know your full name, where you live, and perhaps even the name of your bank. They say your identity has been linked to a crime and that you need to act immediately.

The details may be real. The story may not be.

That is how dark web data scams work: scammers use personal information to make false claims feel convincing. That information can come from data breaches, stolen passwords, public records, data brokers, social media, or details people share directly with a fraudster.

Understanding how that information circulates, and what you can do about it, can help you respond calmly and protect yourself.

How personal information reaches criminals and the dark web

Personal data doesn’t always come from one dramatic hack. Criminals may collect small pieces from different sources and combine them into a more complete picture.

Common sources include:

• Data breaches: A business or government organisation may lose customer or employee records to a cyberattack. Exposed details can include names, email addresses, phone numbers, passwords, identity numbers, payment information, or health records.
• Phishing and impersonation: A criminal pretends to be a bank, employer, government agency, or service provider to persuade someone to share a password, verification code, or identity document.
• Malware: Malicious software can capture passwords saved in a browser, account session details, or other information on a device.
• Reused passwords: Criminals may try a password stolen from one site on other accounts, hoping the same login details work elsewhere.
• Public records and data brokers: People-search websites compile information from public records, social media, and other sources. Their reports may include past addresses, family connections, work history, or property information. The FTC explains how these sites collect and sell personal details.

Breaches are common. South Africa’s Information Regulator says organisations reported more than 1,220 security compromises between 1 April and the end of August 2026 alone, and more than 8,000 since it began receiving notifications. Some organisations never report at all. Information Regulator figures, reported by Moonstone (September 2026)

Stolen information can be sold, resold, or shared across criminal forums and marketplaces. The dark web is one place this happens, but it is not the only one. Europol describes a broader criminal market for stolen data that supports fraud, identity theft, and extortion. Europol’s assessment of the stolen-data economy

Why scammers want these details

Dark web data scams rely on one trick: personal information helps a scammer make a lie sound like it’s based on inside knowledge.

A name and phone number can make an unexpected call feel personal. A bank name or partial account detail can make a fake fraud alert seem genuine. A family member’s name can make a threat feel more immediate.

Scammers may use exposed information to:

• Pretend to be a bank, police department, court, or government agency.
• Threaten arrest, prosecution, account closure, or public embarrassment to pressure someone into paying.
• Try stolen passwords on other websites.
• Attempt to take over accounts by guessing or manipulating account-recovery questions.
• Contact family members or colleagues using public relationships and photos, as in the “Hi Mum” WhatsApp scam.
• Pose as a “recovery expert” after someone has already lost money (see our guide to recovery scams).

In South Africa, SABRIC reports that digital banking fraud incidents rose from 31,612 in 2023 to 64,000 in 2024, with losses rising from R1 billion to more than R1.4 billion. Most of these cases relied on social engineering, persuading people to act, rather than on hacking banking systems. SABRIC Annual Crime Statistics 2024

In July 2026, the FBI warned that scammers pose as FBI staff and other government officials, use caller ID spoofing to appear legitimate, and target people who have already lost money with offers to recover it. The FBI says it will never ask for payment to recover lost funds. FBI warning, July 2026

A caller’s knowledge of your details does not prove that they are legitimate. The FTC notes that scammers may buy or steal information to make an unexpected call sound credible. FTC advice for suspicious calls

How to check for exposed information

Knowing what is already exposed helps you spot dark web data scams early. There is no complete public search engine for every criminal marketplace or stolen-data archive. Searching illicit forums yourself can also expose you to malware, illegal material, and further scams.

Safer ways to check include:

1. Check whether your email address appears in known breaches. A service such as Have I Been Pwned can check an address against breaches in its database. A result only reflects the information the service knows about; no result does not prove that your information has never been exposed.
2. Verify breach notices directly. If a company says your information may have been involved in a breach, visit its official website or app. Don’t rely on links or phone numbers in an unexpected message.
3. Search for your public information. Search your name, phone number, email address, and home address. Review people-search sites, public social profiles, and old accounts.
4. Use search-result monitoring where available. Google’s “Results about you” tool can find some personal details appearing in Google Search and let you request their removal. Removing a result from Google does not remove the information from the website hosting it. Google Search Help
5. Treat paid monitoring as an alert service, not a cleanup guarantee. Before paying, check what sources the service searches, how findings are verified, and what it will actually do if it finds something. No service can promise to search every criminal source or erase every copy.

Can you remove your information?

Sometimes. Removing what you can makes dark web data scams harder to run against you, but it depends on where the information appears and who controls it.

Data-broker listings: Many people-search sites have opt-out processes. You can submit requests yourself or pay a service to submit them for you. The FTC recommends checking which sites a service covers, how often it searches again, and whether it reports its results. Information may reappear if it is republished or public records change. FTC guidance on opting out

Search results: You can ask Google or another search engine to remove certain personal details from search results. Contacting the website that hosts the information may also be necessary. Search-result removal alone does not delete the source page. Google’s removal guidance

Passwords and account access: Change exposed passwords, replace reused passwords on other sites, sign out of unfamiliar sessions, and remove recovery methods you don’t recognise. Turn on multifactor authentication where it’s available.

Cards and payment details: Contact your bank or card issuer through its official app or a number on your card or statement. Ask whether the card or account should be blocked or replaced, and review recent transactions.

Identity documents and national ID numbers: You may not be able to change an identity number. Contact the issuing authority, bank, or relevant government agency to ask what protections apply in your country.

Data already copied by criminals: There usually isn’t a reliable way for an individual to retrieve every copy. The practical goal is to make the information less useful and watch for attempts to misuse it.

How to protect yourself from dark web data scams: 7 steps

If you’ve received a breach notice or found your details online, start with the accounts that control other accounts.

If money has already left your account, start with what to do immediately after being scammed.

1. Secure your main email account. Change its password, enable multifactor authentication, check recovery details, and sign out other sessions. Criminals who control an email inbox may be able to reset passwords elsewhere.
2. Change exposed passwords. Replace any reused password on every site where you used it. Don’t share one-time verification codes with anyone who contacts you.
3. Contact affected organisations directly. Use their official apps, websites, or published phone numbers, not contact details supplied by an unexpected caller or message.
4. Review financial activity. Check bank and card statements, and respond quickly to unfamiliar transactions or account changes.
5. Remove what you can. Submit opt-out requests to people-search sites and removal requests for qualifying search results. Keep a record and check again later.
6. Report actual misuse. Save messages, emails, screenshots, phone numbers, payment details, and other evidence. Report identity theft or fraud to the relevant authorities in your country. In South Africa, our guide on how to report a scam lists where to go.
7. Watch out for recovery scams. Someone who claims they can retrieve your money or erase stolen data in exchange for an upfront fee may be another scammer.

In South Africa, report a crime to SAPS at a police station or call 10111. Keep the CAS reference number. If money has been transferred or banking details exposed, contact your bank through its official app or the number on your card as soon as possible. SAPS crime-reporting guidance

If your ID number or ID document may have been exposed, apply for the free Protective Registration from the Southern African Fraud Prevention Service (SAFPS). It alerts participating banks and retailers to verify carefully when someone uses your details. Call 011 867 2234 or email protection@safps.org.za. How SAFPS Protective Registration works (Sowetan, June 2026)

If you live in the United States, the FTC’s IdentityTheft.gov provides a recovery plan, and a free credit freeze can make it harder for someone to open new credit accounts in your name. FTC guidance on freezes and fraud alerts

What to do if someone claims to be the police or your bank

Many dark web data scams arrive as a phone call. End the conversation and check the claim independently. Don’t call a number, click a link, or use contact details supplied by the person who contacted you. Find the organisation’s contact information through its official app, website, card, or a document you already trust.

Be especially cautious if the person:

• Threatens arrest or another immediate consequence unless you pay.
• Tells you not to speak with family, friends, your bank, or another authority.
• Asks you to move money to a “safe” account.
• Demands payment by cryptocurrency, gift card, wire transfer, or cash delivery.
• Requests a password, PIN, or one-time verification code.
• Asks you to install software or give them remote access to your phone or computer.

Caller ID can be faked, so a familiar number or agency name is not proof, and a familiar voice can be cloned (see our guide to deepfake scams). Never send money, gift cards or cryptocurrency to someone you know only from a call or a message. FTC warning on impersonation scams, April 2025 FBI warning, July 2026

If a caller threatens immediate harm, don’t meet them or follow instructions to travel or withdraw money. Contact local emergency services using a number you know is genuine, and tell someone you trust what is happening.

Many of these calls claim to come from your bank’s fraud department. Our guides to bank impersonation scams and banking scams in South Africa explain how they work.

The key takeaway

Personal information can circulate through breaches, public records, data brokers, stolen accounts and dark web markets. That is what makes dark web data scams work: the details make impersonation and extortion attempts feel believable.

You can remove some broker listings and search results, and you can lock down accounts, cards, and identity protections. But you usually cannot erase every copy of data that has already been stolen. Focus on securing the accounts that matter, limiting what exposed details can be used for, verifying unexpected claims independently, and reporting fraud quickly.

Dark web data scams often end with an instruction: pay through a link, move money to a “safe account”, or hire a service that promises to recover your losses. Before you pay any business you were directed to, run its link through our free Quick Check. It is a quick, shallow screen, so a clear result is not a green light. For a larger amount, a Comprehensive Report looks at the business behind the website or offer, with every finding linked to its source. We check the business, not the caller, so you can decide.

This article provides general scam-awareness information, not financial or legal advice. Sources are linked beside the claims they support and were checked in October 2026.