Your details were leaked: what to do

Almost everyone's phone number and email have leaked somewhere. What matters is which other details went with them, and what you do next.

First, understand what leaked

How serious a leak is depends on the kind of detail.

What leaked	What it enables	What to do
Name, phone number, email, address	More convincing scam calls, spam and phishing	Expect it; be stricter with callers who "know your details"
Password	Logging in to that account and to any other where you reused it	Change it everywhere it was used; add two-step verification
Card number, expiry, CVV	Online payments	Ask the bank to block and replace the card
Bank account number alone	Very little by itself	Watch statements
Identity documents (copies of Aadhaar, PAN, passport, licence)	SIMs, loans or accounts opened in your name	The checks listed below
Date of birth, mother's name, security answers	Passing identity checks on calls	Change security answers; add extra verification at your bank if offered
Photos, private chats	Embarrassment, blackmail	See sextortion; report and do not pay

If a password leaked

Change it on that site, to a new one used nowhere else.
Change it on every other site where you used the same or a similar password, starting with email and banking.
Turn on two-step verification on those accounts.
Check the account for changes you did not make: recovery email and phone, forwarding rules, saved addresses, linked devices.

Your browser or password manager can tell you which saved passwords appear in known leaks: Google Password Manager's Checkup, and the Security section of Apple's Passwords. Independent breach-notification sites let you look up an email address; use only well-established ones, and never type a password into any site that offers to "check if it is leaked".

If a card leaked

Call the bank's official number, block the card and get a replacement with a new number. Check recent transactions and dispute any you did not make at once. Under the Reserve Bank of India's rules, prompt reporting protects you; see who bears the loss. Turn off international and online use in the bank's app when you do not need them, and set limits.

If identity documents leaked

Copies of identity papers given to hotels, SIM shops, lenders and apps are the leaks that last longest. To watch for misuse:

Mobile connections in your name: the government's Sanchar Saathi portal lets you see how many connections are issued in your name and report those that are not yours. See Sanchar Saathi.
Loans in your name: check your credit report from a credit information company, requested on the company's own website (ask there about the free yearly report). Unknown loans or enquiries should be disputed with the lender and the credit company in writing.
Tax records: your annual information statement on the Income Tax Department's portal lists transactions reported against your PAN. Unknown entries deserve a query.
Aadhaar: UIDAI's official myAadhaar portal and mAadhaar app let you lock your biometrics and see the authentication history of your number.

For the future, when a photocopy is unavoidable, write across it the date and the purpose ("for hotel check-in only") and sign, and share a masked copy that hides most of the number wherever that is accepted.

Expect targeted scams after a leak

Fraudsters use leaked details to sound genuine: your name, address, last order, old password or part of a card number. Typical follow-ups are a "bank" call about a blocked card, a "refund" for a recent order, or an email quoting an old password and demanding payment. Knowing your details proves nothing. Judge every contact by what it asks for, and never give an OTP, PIN or password. See OTP scams.

If the company tells you about a breach

Read the notice on the company's own website or inside its app, not through a link in an email.
Do what it asks: usually a password reset.
Be wary of emails offering "compensation" or "identity protection" that need card details.

Reducing what can leak

Give the least: skip optional fields, and do not hand your main phone number to every shop.
Use different email addresses for banking and for sign-ups.
Delete accounts you no longer use.
Prefer "Sign in with" a well-protected main account, or a passkey, over yet another password.

How do I know if my data has been leaked?

Your password manager's leak check and breach-notification services can tell you about known leaks of your email and passwords. Assume that your phone number and email are already known to spammers.

Should I change my phone number or email after a leak?

Usually not. It is a great deal of trouble and the new one will leak in time. Strengthen passwords, add two-step verification and be careful with callers.