Dark web monitoring: what it actually does, and what to do with an alert

Breach / exposure. Updated 2026-09-13. About 4 minutes to read.

Set up free breach alerts, freeze your credit, and treat any alert as a to-do list; paid monitoring only adds value if you also want restoration help or insurance.

Dark web monitoring services search collections of stolen data for your email address, phone number, card numbers and ID numbers, then alert you when there is a match. That is useful. It is also much less than the marketing suggests.

Be clear about two limits before you pay. These services mostly watch the same breach datasets, stealer logs and criminal forums that free tools index, and none of them can remove your data from anywhere. The value is in what you do after the alert, and most of that is free.

What dark web monitoring really scans

No service scans the whole dark web. Criminal marketplaces and private channels are closed, change constantly and often sell data only to trusted buyers. Norton says it plainly on its own feature page: no one can guarantee to monitor 100 percent of the dark web and private forums.

In practice, monitoring companies collect or buy copies of data once it circulates widely, then search it for your identifiers.

Breach compilations: the same leaked databases that appear in free breach checkers such as Have I Been Pwned.
Stealer logs: usernames and passwords recorded by malware on infected devices.
Paste sites and forums where dumps are shared or advertised.
Chat channels where stolen card numbers and identity records are traded.

What monitoring cannot do

It cannot delete your data from a breach, a forum or a criminal's hard drive.
It cannot stop your data being resold.
It usually alerts you after the data has already been circulating for some time.
It does not change a reused password for you, so the password stays dangerous until you act.
It does not stop anyone opening credit in your name. A credit freeze does that.

Be wary of any service that says it will remove your information from the dark web. Nobody can.

Build free monitoring in 15 minutes

Subscribe every email address you use to Have I Been Pwned notifications, which alert you when a newly loaded breach includes the address.
Turn on breach alerts in your password manager, such as Password Checkup in Google Password Manager or security recommendations in Apple Passwords.
Turn on transaction alerts for every bank account and card at the lowest threshold allowed.
In the US, freeze your credit at Equifax, Experian and TransUnion, and check your free weekly reports at AnnualCreditReport.com.
In Australia, use a credit ban if your ID was exposed. In the UK, check your statutory credit reports at all three bureaus.

Google shut down its free dark web report in February 2026, so if you relied on it, replace it with the steps above.

What paid services add

Paid monitoring watches more identifiers than a free email check. Norton's Dark Web Monitoring, for example, lets you add a Social Security number, date of birth, driver's licence number, mother's maiden name, bank account and card numbers, phone numbers and addresses.

The bigger difference is what comes after the alert. Identity theft plans such as LifeLock add restoration specialists who work the case with you, credit monitoring, and reimbursement for stolen funds up to a limit set by the plan. If you would rather make the calls and write the letters yourself, the free stack does most of the job.

You got an alert: what to do by data type

Password: change it on that site and on every site where you used it, then turn on two-factor authentication.
Email address only: expect phishing and check the email account's recovery details and forwarding rules.
Social Security number: freeze credit at all three US bureaus, place a fraud alert, and get an IRS Identity Protection PIN.
Card number: call the issuer and ask for a new card number.
Bank account number: ask the bank to watch the account or issue a new account number.
Phone number: add a port-out lock with your carrier.
Driver's licence or passport: ask the issuing agency whether a replacement is recommended.

How to judge a paid monitoring service

Which identifiers it watches, and whether it covers your country.
Whether it offers restoration help from a real person or only alerts.
The reimbursement limits and exclusions in the summary of benefits, not the headline number.
The renewal price and how to cancel before an automatic renewal.
Whether the free tools above already cover what you need.

Frequently asked questions

Can I remove my information from the dark web?

No. Once data is copied and traded there is no way to recall it, and no service can do it for you. You can make the data useless by changing passwords, freezing credit and replacing card numbers.

Is a free dark web scan legitimate?

Many are, but a free scan is often a sales tool. A legitimate scan only needs your email address or phone number, never a password. Have I Been Pwned is free and does not try to sell you a plan.

My Social Security number was found on the dark web. What now?

Freeze your credit at Equifax, Experian and TransUnion, place a fraud alert, request an IRS Identity Protection PIN, and check your credit reports weekly. If you see accounts you did not open, report it at IdentityTheft.gov.

Do I still need dark web monitoring if I use a password manager?

A password manager with breach alerts covers passwords. It does not watch your ID numbers or credit. A credit freeze plus free breach notifications covers most of the rest without paying.

Is Norton or LifeLock dark web monitoring worth paying for?

The monitoring alone is not. The restoration help and reimbursement in identity theft plans can be worth it if you want someone else to handle recovery. Compare the plan's limits with a free credit freeze before you buy.