Interestingly, some time ago as part of my job I tested this out -- how effective is a fake breach settlement website / notification as a phishing vector? It tu

Interestingly, some time ago as part of my job I tested this out -- how effective is a fake breach settlement website / notification as a phishing vector? It turns out, to my surprise, not very. You can't harvest anything particularly juicy beyond basic PII without arousing a lot of suspicion, and as far as vectors for harvesting basic PII, more "normal" approaches are a lot more effective. Outside of very limited circumstances (e.g. when everyone is really angry, Hello Equifax!), the average person is remarkably uninterested in filling out data in return for an unknown amount of money, at some nebulously undefined future date, that is likely to be somewhere between $7 and $0.