Report to LastPass
Last updated September 18, 2026
The short answer
Send LastPass-branded phishing to abuse@lastpass.com
LastPass is a high-value target, and it runs repeated warnings about active campaigns. The rule underneath all of them is short: nobody at LastPass will ever ask for your master password.
What they handle
- Emails using LastPass branding
- Urgent messages telling you to back up or migrate your vault
- Lookalike domains imitating LastPass
- Anyone asking for your master password
How to file a report
- 1
Send it to abuse@lastpass.com
If you are unsure whether a LastPass-branded email is genuine, submit it there.
- 2
Never give the master password
No one at LastPass will ever ask for it. It is the one credential that unlocks everything else.
- 3
Check the actual sending address
Campaigns have used display name spoofing, where the name reads as LastPass while the real sending address is unrelated. Expand the sender before trusting it.
- 4
Treat a deadline as the tell
One campaign told customers LastPass was about to perform maintenance and they had 24 hours to back up their vaults. Urgency is the mechanism, not a detail.
What you'll need
- The email, with the full sending address
- The link it contained, unclicked
- The date you received it
What to expect
LastPass publishes alerts about active campaigns, so the reports feed those. If you entered the master password anywhere, change it and rotate the credentials in the vault.
Frequently asked questions
The email really said LastPass in the sender name. Does that mean anything?
No. Campaigns against LastPass customers have used display name spoofing, where the name says LastPass and the actual address is unrelated. Expand the sender to see it.
Company guide
LastPass scams
Knowing which scam you were hit by makes the report better. This is how scams impersonating LastPass actually work, what the company will never ask you for, and the warning signs to recognise next time.
Read the guide →