Dark Web Scams and Threats to Watch For

By NorwegianSpark Editorial · Published July 13, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

You do not have to visit the dark web to be harmed by it. Nothing about the response to a breach requires you to go anywhere. The data leaves a company you trusted, gets bundled and resold, and comes back at you through completely ordinary channels: an email, a text message, a phone call that sounds like your bank. Knowing the shape of each one is most of the defence, because all four rely on you reacting quickly instead of checking.

Here is what actually happens to a leaked credential, roughly in the order it happens.

Stage one: it gets tried everywhere

The first thing done with a stolen email-and-password pair is the least imaginative and the most effective. It is fed into automated software that tries it across hundreds of unrelated services — this is credential stuffing, and it exists because password reuse is close to universal.

Verizon's research page on the 2025 Data Breach Investigations Report, checked at source on 6 September 2026, puts a number on how routine this has become: a median of "19% of all authentication attempts" observed were credential stuffing attacks. Roughly one attempted login in five, across the internet, is a machine trying a password that belongs to someone else.

The same research measured how much reuse the attackers are exploiting. On systems infected by infostealer malware, the median case had only "49% of a user's passwords across different services" distinct from each other — that is, about half of a typical person's passwords were duplicates of another one they used somewhere else.

That is the entire mechanism, and it is why the advice is always the same: a unique password per account converts one company's breach into one company's problem. A password manager is what makes that survivable in practice, and sharing passwords safely covers the household version of the problem.

Stage two: the extortion email

Then comes the message claiming they have been inside your machine, watched you through the webcam, or hold files they will publish unless you pay in cryptocurrency. These are almost always bluff, and the FTC says so bluntly in its consumer alert, checked at source on 6 September 2026: "Stop. Don't pay anything. Delete the message. It's a scam."

The detail that makes these land is a real password of yours in the body of the email. The FTC explains why it is there and what it proves: the scammers "may really know one of your old — or recent — passwords, and they include it in the message to prove it", typically because "your email was exposed in a recent data breach". It is evidence that a breach happened somewhere, years ago perhaps. It is not evidence anyone has access to your device.

The FTC's advice is to send no money, delete the message, "update your password on that account, and consider updating other passwords, too", and report it at ReportFraud.ftc.gov. In the United States, serious cases also go to the FBI's Internet Crime Complaint Center, which describes itself as "the central hub for reporting cyber-enabled crime". Outside the US, your national fraud or cybercrime reporting body is the equivalent step.

One extra note, because it changes how the email feels: variants now include a photo of your house pulled from street imagery, or a physical address. Both come from data that was already public or already brokered. Neither means anyone has been near you.

Stage three: the one-time-code phone call

This is the most technically interesting of the four and the one that catches careful people.

The criminal already has your password — from stage one — and hits the login page, which triggers a genuine verification code to your phone. Seconds later you get a call or a text that appears to come from your bank, warning about suspicious activity and asking you to confirm your identity by reading back the code you have just received.

The code is real. The alert is real. The caller is not. Whoever reads that code aloud hands over the one thing the stolen password could not supply.

The defence is a single rule with no exceptions: an inbound request for a verification code is always fraudulent. Real institutions do not phone you and ask you to read one back. If a code arrives that you did not trigger, that is itself the alert — someone has your password, and it is time to change it.

Structurally, this is why code-based authentication is the weakest of the strong options. App-generated codes are better than SMS, and passkeys are better than both, because there is no code for anyone to talk you out of. The two-factor authentication guide covers the trade-offs, and SIM swap attacks covers the related route where the phone number itself is taken.

Stage four: the scam about the scam

Finally, the anxiety created by all of the above gets monetised directly. Pop-ups and emails offer a "free dark web scan" that finds alarming results, or promise to remove your data from the dark web for a fee.

Two facts defuse the whole category:

• Legitimate breach checks are free. Have I Been Pwned describes itself in its own FAQ as "a free service for people to assess risk in relation to their account being caught up in a breach". Anything charging for the basic lookup is selling you the free thing.
• Nobody can delete your data from the dark web. Once a record is copied and resold across many parties, there is no central switch and no one to compel. Any pitch built on "pay us to erase it" is a tell, whoever is making it.

The scan itself is also a standard phishing vehicle. CISA's guidance names the indicators — "urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately", "requests to send personal and financial information", "untrusted shortened URLs" — and its instruction for a suspicious message is short: "Delete the message. Don't reply or click on any attachment or link, including any 'unsubscribe' link. Just delete."

A quick triage table

The pattern across all five rows is the same, and it is worth naming: every one of these attacks needs you to act inside the next few minutes. Urgency is the payload. Slowing down is the countermeasure, and it is free.

What to actually do, in order

Unique passwords first, because they break stage one. Then a second factor that is not SMS where the option exists, because it breaks stage three. Then a free breach check so you know where you stand — how to check if your data is on the dark web walks through it. Then, and only then, consider whether continuous dark web monitoring adds anything for you.

Endpoint protection covers the malware end of the chain, since infostealers are what generate much of this material in the first place — Bitdefender and the malicious-site blocking in NordVPN's Threat Protection both target that class, and an all-in-one suite such as Norton 360 bundles it with identity features. But no product on that list stops a person from reading a code down the phone, which is why the habit matters more than the software.

If a check does come back positive, work through what to do if your data is on the dark web and the broader what to do after a data breach checklist. The mechanics of how it got there are in how your personal data ends up on the dark web.

None of these threats require you to enter the dark web. They come to you, dressed as ordinary messages, and they all fail against the same unglamorous set of habits. The tools that back those habits up are in our security tool shortlist. This is general guidance, not security advice for a specific threat model.

Continue in this collection

Best Security Tools

The shortlist across antivirus, VPN and password managers, and the reasoning.

Explore

Live Offers

What is actually discounted right now, rather than what once was.

Explore