Dark web scan and monitoring: what it can and can't tell you

You typed "is my email on the dark web" into a search bar, and now you are wondering what a dark web scan can actually do. That is a fair question. The term gets used loosely, and some of the claims around it are bigger than what any tool can back up.

This guide explains what the dark web is, how personal data ends up there, what a scan really checks, where its limits are, and what to do in what order if your information shows up. It sticks to what official sources say. Where a source does not support a claim, we leave it out.

What the dark web is, according to the FTC

The Federal Trade Commission describes the dark web as places on the internet not indexed by traditional search engines. That is a plain definition, and it is worth keeping in mind. It is about not being listed by regular search, not about being a single place with a single front door.

The FTC adds an important point. Not every site there is criminal. But, in the FTC's words, sites illegally selling consumer data and other black market goods tend to congregate there.

That is why the dark web comes up so often when people talk about stolen data. Some of the people who steal information want to sell it, and these marketplaces are one place they can do that.

What the FTC's business guidance says is sold there is broad. It mentions stolen credit cards, compromised bank accounts, health records, credentials, forged documents and entire wallets that include credit cards and driver's licenses. In a 2017 post, the FTC cited a cost of $15 to $50 per stolen card, with premium cards fetching more. Treat that figure as a snapshot from that year, not a current price list.

You do not need to visit any of these places to protect yourself. Nothing in the official guidance we reviewed tells ordinary consumers to go looking. What matters is what you can find out through legitimate tools and what you do next.

How personal data ends up there

The FTC's business post draws a direct line between a breach and the dark web. When a business suffers a breach, the FTC says, the dark web is often the next stop that sensitive data makes after it has been stolen.

So the first route is a breach at a company that holds your information. You did nothing wrong, and you may never have been told. Have I Been Pwned (HIBP) defines a breach as an incident where data is inadvertently exposed in a vulnerable system, usually because of insufficient access controls or security weaknesses in the software. HIBP also notes that breaches in its collection are not always the result of a security compromise. Sometimes data is simply left exposed.

The second route is phishing. The FTC explains that phishing messages are designed to try to steal your passwords, account numbers or Social Security numbers. The FTC says scammers could get access to your email, bank or other accounts, or sell your information to other scammers. That last part is the link to underground markets: information taken from one person can be resold to someone else.

The third route is malicious software. The FTC says that links and attachments in phishing messages may also install harmful malware. HIBP's FAQs say breaches in its collection come from exposed systems and, in some cases, from malware. It also mentions "stealer logs," though the page we read does not go into detail about how they work, so we will not either.

Put simply, there are three common starting points:

• A company that holds your data is breached or leaves it exposed.
• You, or someone you know, respond to a phishing message.
• A device gets infected with malware after a bad link or attachment.

Once the data leaves your control, it can be copied and passed around. That is why changing a password after a breach matters, and why it matters more if you reused that password somewhere else.

What a dark web scan can actually check

This is the section most guides skip, so it is worth being direct.

When a consumer tool offers to "scan the dark web" for your email, the sources we could verify point to something narrower than a live search of every hidden site. The best-documented example is Have I Been Pwned (HIBP). Its About page describes it as a free resource for anyone to quickly assess if they may have been put at risk because of an online account that was compromised. Its data centers on breaches, meaning data exposed to people who should not have been able to see it. Its FAQs add that it also loads pastes and data collected by malware.

So the core of a typical scan is a comparison. You give it an email address. It checks that address against the breaches it has loaded. If your address is in one, it tells you which one.

HIBP's FAQs add useful detail:

• Before a breach is loaded, HIBP checks its legitimacy, for example whether the affected service acknowledged it and whether the data appears elsewhere online.
• Pasted data is added through a combination of manual and automated means.
• Some breaches are marked sensitive. HIBP says these are breaches where being a member "may adversely impact" someone if others can discover it. They cannot be searched publicly. Only the verified owner of the email address can see them, after signing in to the dashboard.
• A separate password check tells you whether a password has previously appeared in a data breach. HIBP says every password is SHA-1 hashed and that it stores no information about whose password it was, only that it was exposed and how many times it was seen.

None of this is described as a live search of the dark web. That does not make the check useless. A breach list tells you something real: your address was in a specific exposed dataset. But it is a different thing from "we looked at every hidden marketplace and found nothing."

Our own free scan works along similar lines. It checks known breach data through Have I Been Pwned and LeakCheck, shows any passwords masked, and looks at the public web and a registry of people-search sites. It does not claim to see the whole dark web, and it cannot promise what it will find.

The limits you should know about

Every scan has limits. These are the ones we can support with sources.

It only sees what is in its data. HIBP says it contains but a small subset of all the records that have been breached over the years. A breach it has never loaded cannot show up.

An empty result is not a clean bill of health. HIBP quotes a line that is worth remembering: "Absence of evidence is not evidence of absence." An address can also be missing because it was opted out or because a breach was retired from the collection.

It checks what you enter. If you check one email address, you learn about that address. You do not learn about your other addresses, your old accounts or your family members' accounts. HIBP notes that its notification feature only works for the address being monitored, and that you cannot monitor someone else's address or one you no longer control.

It does not tell you how the data is being used. A breach entry says your address was exposed. It does not say whether anyone tried to misuse it. Only your own accounts, statements and credit reports can show that.

It cannot fix anything. A scan is information. The protection comes from what you do afterward: changing passwords, turning on multifactor authentication, checking credit and, if needed, freezing it.

Some scan results can themselves be a scam. The FTC has warned about emails claiming your personal information is for sale on the dark web. Some list stolen details such as part of a Social Security number, a date of birth or a driver's license number. The FTC's advice is not to click links or call numbers in the message, because it could be a phishing email. We cover this in its own section below.

Free scans, paid monitoring and how to compare them

You will see two broad kinds of offers. Free breach checks tell you whether your address appears in known breaches. Paid monitoring plans from various companies generally promise ongoing alerts. We do not recommend or rank any of them here, and we do not quote prices, because plans and prices change.

The questions below will help you judge any service, free or paid.

What exactly does it check? Look for a clear statement of the data sources. "We scan the dark web" with no detail should make you cautious. A good service says what it compares against.

What does it do when it finds something? A useful result names the breach, the date if known, and the type of data exposed. A vague "your data was found" tells you little.

What does it ask from you? Be careful about handing over more than you need. Entering a Social Security number into a monitoring tool is a serious decision. Checking an email address does not require it. If a service asks for sensitive numbers, read how it stores and uses them before you decide.

Does it overpromise? No tool can promise your data is safe or that no one will misuse it. Treat any claim of complete protection with suspicion.

Is the "free" check a doorway to something else? The FTC warns about this in a different context. On free credit reports, it says only AnnualCreditReport.com is authorized to fill orders for the free annual reports, that imposter sites exist, and that unsolicited emails, pop-ups or calls claiming to be from it are probably a scam. The same caution is reasonable for any site that uses fear to sell you something.

One more point about alerts. HIBP's FAQs say its notification feature stores the email address, the subscription date and a random verification token, because it has to keep the address to tell you if you appear in a later breach. That is a trade-off worth knowing about with any alert service. To watch for new problems, a service has to keep something about you.

If a message says your data is for sale

Many people first meet the phrase "dark web" in an alarming email. The FTC has a consumer alert on exactly this. It says some emails claim your sensitive personal information is being sold on the dark web, and some list details such as all or part of your Social Security number, date of birth or driver's license number.

Here is the FTC's advice, in order:

1. Do not click links or call numbers in the message. The FTC says it could be a phishing email. If you think it may be legitimate, contact the company through a website or phone number you already know is real.
2. Secure your email first. The FTC says to change your passwords, starting with your email, because email is often the weak link: password resets for your other accounts go there. It recommends a password manager, unique passwords for each account and multifactor authentication where available.
3. Check your credit reports. Get them free at AnnualCreditReport.com and look for accounts you do not recognize. The FTC says to report any you find at IdentityTheft.gov.
4. Consider a credit freeze. The FTC calls a freeze the best way to protect against an identity thief opening new accounts in your name. A fraud alert is an alternative.
5. Report the email. The FTC asks you to tell it at ReportFraud.ftc.gov if you get one.

CISA gives similar general advice for any suspicious message. It says to watch for urgent or emotionally appealing language, requests for personal or financial information, and email addresses or links that are slightly off. It also says not to rely on spelling or grammar, because AI can now produce flawless messages. Its three steps are to resist, verify and delete. To verify, use a method you already trust, such as an official website you type in yourself.

The same approach applies when a "dark web scan" result arrives unprompted. A real breach notice from a company you do business with is still best confirmed through the company's own website, not through a link in the message.

What to do if your data is found

A hit on a breach list is not an emergency. It is a prompt to act in a sensible order. Start with the steps that protect the most and take the least time.

1. Find out what was exposed

Look at the breach name and the data types listed. An exposed email address and an exposed password carry different risks than an exposed Social Security number. The FTC points to IdentityTheft.gov/databreach for steps that depend on what information was exposed. Use that page to match your next moves to your situation.

2. Secure your email account first

The FTC puts email at the top of its list. Anyone who controls your email can request password resets for your other accounts. Change the email password, make it long and unique, and turn on multifactor authentication.

The FTC's general advice on passwords is to make them long and hard to guess. It suggests aiming for at least 15 characters, and says a passphrase of random words is an option if long passwords are hard to remember. A password manager can generate and store them.

3. Change the password on the breached account and anywhere you reused it

If the exposed data included a password, change it on that service. Then change it anywhere else you used the same one. This is where reuse hurts. One exposed password can open several accounts.

4. Turn on multifactor authentication

The FTC explains that a hacker who steals your password cannot log in to your account without the second authentication factor. It adds that an authenticator app or security key is more secure than a text or email code, so choose one of those if it is offered.

5. Check your credit reports

The FTC says the three nationwide credit bureaus have made a free weekly program permanent. It lets you check your report from each bureau once a week for free at AnnualCreditReport.com. Federal law also requires each bureau to give you a free copy once every 12 months if you ask. The FTC says only AnnualCreditReport.com is authorized to fill orders for the free reports, and that you can also call 1-877-322-8228 to order your free annual reports.

Look for accounts, inquiries or addresses you do not recognize.

6. Decide on a credit freeze or fraud alert

The FTC describes them this way.

A credit freeze: "While a credit freeze is in place, nobody can open a new credit account in your name, including you." It is free to place and lift. You contact each of the three credit bureaus, Equifax, Experian and TransUnion. It lasts until you lift it.

A fraud alert: lenders must verify your identity before they grant new credit in your name. Unlike a freeze, it does not block businesses from seeing your credit report. It is free. An initial fraud alert lasts one year, and you can renew it. You contact one of the three bureaus, and that bureau must notify the other two.

An extended fraud alert lasts seven years. The FTC says it is available to people who have experienced identity theft and have filed either an FTC identity theft report or a police report.

Which one fits you is your decision. The FTC's own wording is that a freeze is the best way to protect against new accounts being opened in your name, with a fraud alert as an alternative. If you plan to apply for credit soon, remember that a freeze also stops you from opening an account until you lift it.

7. Watch your statements and accounts

The FTC lists signs of identity theft: charges for things you did not buy, bank withdrawals you did not make, bills that stop arriving (which could mean someone changed your billing address) and accounts on your credit report you do not recognize.

8. Report identity theft if it happens

If someone is using your information, report it to the FTC at IdentityTheft.gov. The FTC says you will get a free personal recovery plan with next steps. The plan lets you track your progress, update it, and print pre-filled letters and forms for credit bureaus, businesses and debt collectors. If you need another language, the FTC lists a phone line at 877-438-4338 (press 3), with interpreters available 9:00 a.m. to 5:00 p.m. ET.

Common mistakes

Paying to "remove" data from the dark web. We found no official source describing a way to pull stolen data back out of underground markets. Be cautious with anyone who says they can.

Clicking the link in the alert. The scariest messages are the ones most likely to be phishing. Go to the company's site yourself.

Fixing only the account that was named. If the breached password was reused, the damage is not limited to one service. Change it everywhere.

Skipping email. Email is the key to password resets. Secure it before anything else.

Treating a clean result as final. A scan reflects what its data contains on the day you run it. Check again from time to time, and keep your protections on regardless.

Handing sensitive numbers to an unknown tool. If you do not know who runs the service and how it stores what you enter, do not enter your Social Security number.

Ignoring your credit reports because nothing looks wrong. The weekly free access exists so you can look. Misuse of your information may not show up in your inbox.

If you responded to a phishing message

Sometimes the data did not come from a company breach. You may have given it away yourself. The FTC says that if you gave out sensitive information, you should go to IdentityTheft.gov, which lists the specific steps to take based on the information you lost.

If you clicked a link or opened an attachment, the FTC says to update your security software, run a scan and remove anything it flags.

You can also report the attempt. The FTC lists these options:

• Forward phishing emails to reportphishing@apwg.org.
• Forward phishing texts to SPAM (7726).
• Report the attempt at ReportFraud.ftc.gov.

CISA adds that you can use the report option near the sender's address, or the "report spam" button in your email settings, to protect yourself and others.

Habits that reduce the damage next time

You cannot stop every breach. You can make each one matter less.

• Use a unique password for every account. A password manager makes this practical.
• Turn on multifactor authentication wherever it is offered, starting with email, banking and shopping accounts.
• Install software updates quickly. The FTC says criminals target weaknesses before companies can fix them, and that updates often contain critical patches. Automatic updates help.
• Be careful with unexpected links and attachments. The FTC's advice is not to click on a link in an unexpected email or text.
• Check your credit reports on a schedule. With weekly free access, a regular look is easy to build into a routine.
• Keep an eye out for breach notices. If a company tells you your data was exposed, treat it as a prompt to take the steps above, after confirming it through the company's own website.

Where a free scan fits

A free breach check is a good first step because it is quick and it replaces guessing with a specific answer: which known breaches include your address. It is not the whole picture, and a good scan says so.

Our free scan takes a few minutes and does not ask you to create an account. It checks known breaches, shows passwords masked, looks at the public web and compares you against a registry of people-search sites. We cannot tell you ahead of time what it will find. Whatever it shows, the steps above are the same: secure your email, use unique passwords, turn on multifactor authentication, check your credit and decide on a freeze.

If you take one thing from this guide, make it this. The dark web is not a place you need to search. The useful work happens on your own accounts, and you can start it today.