Is a cold call about a data breach compensation claim a scam?
Very often yes. Unsolicited calls about data breach claims are lead generation for unregulated claims companies or outright fraud.
Last reviewed: 1 August 2026
Explanation
After major data breaches, cold callers claim to be law firms or claims management companies and tell you that you are entitled to significant compensation. They ask you to confirm personal details to 'register your claim', charge an upfront fee, or ask you to sign documents giving them a large percentage of any payout. In reality, genuine data breach compensation in most jurisdictions requires you to have suffered documented harm, is typically small, and any legitimate claim can be made through official channels or regulated solicitors without unsolicited calls. Unregistered claims management companies are illegal in the UK under the Financial Guidance and Claims Act. Providing your personal details to cold callers also puts you at risk of further fraud.
There is an irony at the heart of this scam worth noticing: the caller is offering to help you with a privacy violation while committing one. Whatever details you confirm on the call — full name, address, date of birth, which bank you use — are added to the very kind of dataset the call pretends to remedy, and victims frequently receive waves of follow-up fraud attempts afterwards. Legitimate compensation processes never begin with an inbound call asking you to prove who you are; they begin with you contacting a regulator or regulated solicitor through published channels.
Common red flags
- You received a call about compensation for a breach you did not enquire about
- Caller asks for personal or financial details to 'register' your claim
- Upfront fee required before you receive any compensation
- Company cannot show their regulatory authorisation number
- Promised payout seems disproportionately large
What to do now
- Do not provide personal or financial details to unsolicited callers
- If interested in a legitimate claim, contact the relevant data protection authority yourself
- Verify any claims company through the relevant regulatory register
- Report unsolicited calls to your national spam or fraud reporting service
Frequently asked questions
Can I actually claim compensation for a data breach?
In the UK and EU, individuals can claim compensation for material or non-material harm caused by a data breach under GDPR. However, not all breaches lead to individual payouts. Consult a regulated solicitor or the ICO rather than responding to cold callers.
The caller already knew my name and which company leaked my data — does that mean they are genuine?
No. Breach datasets circulate widely, so knowing you were affected proves nothing about who is calling. Scammers use those very details as credentials. Hang up and, if you want to pursue a claim, start it yourself through the regulator or a regulated solicitor.