Amazon isn’t the first. Earlier this year, AT&T agreed to pay $177 million to resolve claims from two data breaches that exposed the information of tens of millions of customers. A year earlier, Meta (formerly Facebook) funded a $725 million settlement for misuse of user data, one of the largest privacy class actions to date. These settlements make headlines because of their size, but they also attract fraudsters who see a chance to exploit consumers eager for compensation.

Here’s how legitimate settlement notifications work. Once the claim process is ready, the settlement administrator typically notifies consumers by email and often by regular mail, either a postcard or a letter. For Amazon, notices can be sent by email, prepaid mail or through an official claims website. AT&T used both email and first-class mail for its data breach settlement. Meta primarily relied on email but also operated an official claims portal.

Why is regular mail safer? A physical postcard or letter is harder for scammers to fake at scale. An email address can be spoofed to look official, but forging a mailed card that includes the correct legal language, postage and unique identifiers is more difficult. If you receive a mailed notice, use the claim form or web address provided there. If you only receive an email, double-check the details before clicking anything.

Scammers take advantage of the confusion by building websites that look legitimate, complete with logos and “class action” language. Some will ask for sensitive information such as a full Social Security number or bank account details. Others demand a “processing fee” or “administrative cost” before releasing funds. Both are red flags. Settlement claims are free to file. If a site asks you to pay, close it and forward the message to the FTC.

So how do you make sure you’re in the right place? Start with trusted sources. The FTC’s website maintains a list of current settlements and how to claim. ClassAction.org also publishes legitimate settlement information and official claim URLs. Always check one of these before entering personal information online.

When it comes to personal data, most legitimate claim forms ask for basics, such as your name, mailing address and sometimes the last four digits of your Social Security number if needed for identity verification. They do not ask for your full social security number, your bank login or your credit card number. If you see those requests, it’s almost certainly a scam.

If you’re worried about clicking the wrong link, consider filing your claim the old-fashioned way: by mail. Most settlements provide a mailing address where you can send your form. It takes longer, but you avoid the risk of phishing sites entirely.

You can also add a layer of protection through your browser. Chrome users should enable Enhanced Safe Browsing, which uses AI to detect suspicious websites in real time. Unlike the basic Safe Browsing feature, which checks sites against a list of known threats, Enhanced Safe Browsing can flag newly created scam pages that aren’t yet on the list. To turn it on, sign into your Google account, go to the Security tab in account settings, find Enhanced Safe Browsing for your Account and toggle it on.

The bottom line: Settlements like Amazon’s are a win for consumers, but they also create openings for scammers. Take your time before responding to an email or clicking a link. Use the FTC’s site, check the domain name carefully and never pay a fee to file a claim. If a postcard shows up in your mailbox, that’s often your safest route.

Getting a legitimate payout is a small but meaningful victory for consumers. Just make sure the only thing you’re giving up is the time it takes to file your claim, not your personal information.

Leslie Meredith has been writing about technology for more than a decade. As a mom of four, value, usefulness and online safety take priority. Have a question? Email Leslie at asklesliemeredith@gmail.com.