LastPass scams
Last updated September 18, 2026
The short answer
LastPass users are phished for one thing: the master password. After encrypted vaults were stolen in the 2022 breach, attackers have been working to obtain master passwords that would decrypt them. LastPass will never ask for your master password, and it cannot recover it.
In 2022 attackers took encrypted customer vault backups from LastPass. Those vaults are only as safe as the master password protecting them, which created an unusual long-term situation: a known population of targets, holding a specific high-value secret, being worked on patiently by people who already possess the encrypted data. Phishing aimed at LastPass users is therefore unusually focused and unusually persistent, and it is still going.
How LastPass scams work
- 1
Master password phishing
An email or call warns of suspicious vault activity and directs you to verify by entering your master password. It is the only secret that matters, and LastPass never asks for it.
- 2
Support impersonation by phone
A caller claiming to be LastPass security says your vault is compromised and walks you through "securing" it, which means entering your master password on a page they control.
- 3
Fake breach notifications
Messages referencing the real breach, offering to check whether your vault was affected, and asking for credentials to run the check.
- 4
Extension and app impersonation
Counterfeit browser extensions imitating LastPass capture the master password at the moment you unlock.
Warning signs
- Anything at all asks for your master password
- A call claims to be LastPass security
- An email offers to check whether your vault was in the breach
- A browser extension prompts for the master password in an unfamiliar way
- A login page is not on lastpass.com
- You are urged to act within hours
- A message offers to recover a forgotten master password (impossible by design)
Examples
Verify your vault
An email headed "Unusual vault access detected" links to a convincing LastPass page asking for the master password to verify identity. The password is captured and used against the stolen encrypted vault, which decrypts every credential in it, including the seed for a crypto wallet.
The security team that called
A caller says LastPass has detected access from another country and needs to walk the user through securing the vault. The walkthrough ends with the master password entered on a phishing page. No such detection exists, and LastPass does not telephone users.
What to do
- Never enter your master password anywhere except the real LastPass app or extension.
- If your vault predates the 2022 breach, change every password in it, not just the master password. The stolen copy does not update.
- Turn on multi-factor authentication for the vault itself.
- Prioritise the high-value entries: email, banking, crypto seed phrases, domain registrars.
- Consider whether a password manager with a different security history is a better fit.
Report it to LastPass
Report phishing to abuse@lastpass.com. LastPass never asks for your master password, and by design cannot recover or reset it for you.
Getting your money back
If a master password was exposed and your vault existed before the 2022 breach, treat every credential in it as compromised — changing the master password does not help, because the attacker holds an old encrypted copy that the old master password still opens. Work through the vault by value: email first, then banking and payment apps, then anything holding crypto keys, then everything else. Turn on two-factor everywhere as you go. Crypto seed phrases stored in a vault should be considered burned: move the funds to a new wallet.
Frequently asked questions
Will LastPass ever ask for my master password?
No, and it cannot recover it either — the master password never leaves your device, which is the entire design. Anyone asking for it, in any channel, is trying to decrypt your vault. There is no exception.
My vault was in the 2022 breach. Is changing the master password enough?
No. The attacker has a copy of your vault as it was, encrypted with the old master password. Changing the master password protects the current vault but does nothing to the stolen copy. Every credential that was in it needs changing, starting with email, banking and anything crypto-related.
Why do LastPass users get so much targeted phishing?
Because the attackers already hold encrypted vaults and need only the master password to open them. That makes LastPass customers a defined, high-value target list with a single known secret worth pursuing — which is why the phishing is more focused and more persistent than for most brands.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about LastPass, these are the guides worth reading next.