Settlement notices have become one of the most convincing phishing lures around. They name real companies and real lawsuits, and they often arrive after a well-publicized data breach, when people are already expecting to hear something. In an inbox, a real notice and a fake one can look almost identical.
For HR teams, this shows up in two ways. Employees forward these messages asking whether they're legitimate, and some notices are about the employer itself: a data breach, a retirement plan fee case or a pay dispute. A little preparation keeps both from turning into a security incident.
Why employees get so many of these
Employees hold accounts with dozens of companies, and many class actions now involve data breaches, apps and subscriptions. One person can be a class member in several cases a year. Workplace benefits add more: retirement plan fee settlements and breaches at benefits vendors generate notices that look official because they are.
Scammers exploit that volume. They copy the format of real notices, swap in a lookalike link, and ask for a "processing fee" or a bank login to release a payment.
What a real notice contains
Courts set rules for class notices, so legitimate ones share a recognizable structure:
the case name, case number and the court where it's pending
a plain description of who belongs to the class
the available options: file a claim, opt out, object or do nothing
deadlines for each option and the date of the final approval hearing
the name of the claims administrator and an official settlement website
A message that only says "you've been awarded money, click to collect" is missing almost everything a real notice includes.
A verification checklist for employees
HR can share this as a one-page reference:
Don't start with the link in the message. Search for the case name on your own and find the official settlement website from a trusted source.
Match the details. The case number, court and administrator in the notice should match what you find independently.
Watch for pressure. Real deadlines are weeks or months away. "Respond within 24 hours" is a scam tactic.
Never pay to get paid. Legitimate settlements don't charge filing fees, and they never ask for gift cards, crypto or wire transfers.
Share only what the form requires. A real claim form may ask for a notice ID, contact details and a payment method. It never needs your online banking password.
A short guide on how to tell whether a settlement notice is real walks through the same checks in more detail, and employees can use it without involving HR at all.
When the notice involves your own company
Some notices name the employer, or a vendor working for it. That changes HR's role.
Send questions about the case to legal counsel. When a company is a party to a class action, the court can restrict what it says to class members. Keep HR's answers factual and procedural.
Don't advise employees on whether to file, opt out or object. That decision is theirs, and the notice explains each option.
Point people to the official administrator. Claims go to the court-appointed administrator, not to the company.
Know how retirement plan settlements usually pay. In 401(k) fee cases, current participants are often credited automatically, while former employees may need to submit a form to get their share.
Build it into security training
Most phishing training covers fake invoices and password resets. Add settlement and refund scams to the rotation:
include a sample fake notice in the next phishing simulation
tell employees exactly where to forward suspicious messages, usually the IT or security team
remind people that clicking a fake notice in a work inbox puts company systems at risk as well as their personal accounts
A note HR can send today
If you want to get ahead of the next wave, a short message to staff covers most of it. Something like:
Subject: Settlement emails and how to check them
You may get emails or texts about class action settlements, including ones that mention companies you use. Some are real and some are scams. Before you click anything, look up the case name yourself and find the official settlement website. Real settlements never charge a fee or ask for your bank login. If a message looks suspicious, forward it to [security contact]. Questions about any case involving our company should go to [HR contact], who will route them to the right person.
Adjust the contacts, send it once, and repeat it in the next security newsletter. In phishing tests, track how many people report the fake notice as well as how many click it.
Where to start
If you only do one thing this quarter, share the checklist above along with the note to staff. Employees who know how to check a notice are less likely to fall for a fake one and more likely to claim money they're owed.
