NAMED SENDER · THREE KINDS OF MAIL
By Peter · 3 November 2026 · 11 min read
Is Kroll legit? Yes. The letter in your hand is the part you have to check.
Kroll writes to people for three different reasons: after somebody else lost their data, when a court case owes them money, and when a bankrupt company owes them a claim. Each kind of mail is checked in a different place, and each one has already been copied by scammers.
Kroll is a real company, and three parts of it contact consumers: Kroll identity monitoring, offered free by companies after a data breach; Kroll Settlement Administration, which runs class action payouts for courts; and Kroll Restructuring Administration, the claims agent in bankruptcies such as FTX. A real name proves nothing about the message. Check it by finding the sender yourself: the breached company's notice on a state attorney general list, the case's own settlement website, or the bankruptcy case page.
"…nobody will call, text, or email out of the blue to ask you for your credit card or bank account numbers, or to ‘help’ you get your free credit monitoring. Anyone who does is a scammer…"
People search "is Kroll legit" because a letter, an email or a check has arrived with a name they have never seen before, and usually on the back of bad news: their data was in a breach, or they are owed money from a lawsuit they barely remember joining. That is exactly the moment a copy works best. You were half expecting something, the real thing is slow, and a message that arrives first only has to look official.
The facts below come from Kroll's own sites, two real breach notices filed with the California Attorney General in 2026, the official website of a settlement Kroll runs, and the Federal Trade Commission, all read on 3 November 2026.
Which Kroll is writing to you? Sort the mail first
"Kroll" on an envelope or in an email can mean three different jobs, and each one is verified somewhere else. Start by matching what you received to one of these rows.
| What arrived | Who really sent it | Where to check it |
|---|---|---|
| A letter offering free identity or credit monitoring, with an activation code or membership number | The company that lost your data. Kroll is the provider it hired. | That company's sample notice on a state attorney general breach list, then enroll.krollmonitoring.com typed by hand |
| A class action notice, a claim form, or a settlement check or e-payment | Kroll Settlement Administration, acting for a named court case | The case's own settlement website, found by searching the case name, never the link in the message |
| An email about a bankruptcy claim, often a crypto platform such as FTX | Kroll Restructuring Administration, the court's claims and noticing agent | The case page on restructuring.ra.kroll.com, or the verification address that page publishes |
The identity monitoring letter comes from the company that lost your data, not from Kroll
When a company has a data breach, it often pays Kroll to give affected people free identity monitoring. So the letter is from the company, and Kroll is the service it bought. Two real examples, both filed with the California Attorney General in 2026:
- Lennar Corporation told customers that an unauthorized party used social engineering to reach some of its systems between 24 and 30 March 2026, and that it had "secured the services of Kroll to provide two years of identity monitoring services." Its sample notice sends people to https://enroll.krollmonitoring.com, gives an activation deadline and a membership number, points to info.krollmonitoring.com for more, and lists a Lennar call center number for questions.
- The Moody Bible Institute of Chicago offered a one-year membership of Kroll 3B Identity Monitoring Services in a notice dated 23 July 2026, with three steps that begin at Enroll.krollmonitoring.com/redeem and a deadline to enroll by 26 October 2026. It also says enrolling "will not hurt your credit score."
Both describe the same services: credit monitoring (one bureau in Lennar's offer, all three in Moody's), unlimited consultation with a Kroll fraud specialist, and identity theft restoration by a Kroll licensed investigator. That is the shape of a real letter. It names the company and what happened, names Kroll as the provider, gives you a code or number of your own, sends you to enroll.krollmonitoring.com, and has a deadline.
The strongest check is a public list. In California, any business that notifies more than 500 residents of a breach must send a sample copy of the notice to the Attorney General, which publishes them in a searchable list: search the company name, open it and click "Sample Notification". If your letter matches the sample, it is real. Other states, including Maine and Massachusetts, publish similar lists.
To see how common the Kroll offer is, we read the 50 newest sample notices on California's list on 3 November 2026, reported between 13 October and 2 November 2026. 46 had readable text, and 6 of those offered identity monitoring through Kroll: University of Mississippi Medical Center, EyeMed Vision Care, The Nueva School, Aesto, Del Monte Foods and the City of Foster City. Several of the samples also print "Return to Kroll" in the return address field, which is why an envelope can carry Kroll's name while the letter inside is signed by the company.
A notice of a breach is also an invitation for a second approach. If you were in the Conduent breach or any other large one, your name may already be on lists sold to people who follow up pretending to help. Here is how those lists are built and used.
Why the sign-up asks for your Social Security number, and where it is safe to type it
"Is it safe to give my SSN to Kroll?" is one of the questions people ask most. The sign-up does need it, and only one place is safe to give it.
Both breach notices say that to receive Kroll's credit services you must be over 18, have established credit in the US, "have a Social Security number in your name, and have a U.S. residential address associated with your credit file." Credit monitoring watches your credit file, and it can only find your file if it can match you to it. The enrollment site, when we opened it, first asked for the member number from the letter, a last name and a zip code, and then moved to identity verification.
So the rule is not "never give it to Kroll." It is: type it only into enroll.krollmonitoring.com, reached by typing the address yourself, using the code from a letter you have checked. Never give it to anyone who calls, texts or emails you first, whatever name they use.
The settlement notice or check: Kroll is the court's administrator, and each case has its own website
Kroll Settlement Administration runs class action settlements on behalf of courts. It sends notices, takes claims and pays out the money, but it does not decide who gets paid or how much. The court-approved terms of each case do that, and every case has its own official website.
The AT&T data breach case shows what that looks like. The official site calls itself "the only authorized website for this case" and gives a phone number and a mailing address in care of Kroll Settlement Administration LLC. Its update of 30 October 2026 says the court granted final approval on 2 October 2026, that payments cannot be made until the settlement becomes effective after any appeals, and that payments are not expected to be issued in 2026. So in 2026, any message saying your AT&T payment is ready describes something that has not happened. We follow the case in why the AT&T settlement has not paid.
That gives you the test for any settlement message: find the case's website yourself by searching the case name, and check whether the message matches the stage the site describes. A claim form for a case whose deadline has passed, a payment the site says is not due, or a fee to release your money are all signs the message is not from the administrator.
A check from Kroll can be perfectly real. Before you deposit one, check the case website, and if anything does not match, call the number on that website rather than the one printed on the check. The same named-sender logic applies to other letters people do not expect, such as the Pathward unclaimed property letter.
The bankruptcy claim email, and the fake that already happened
Kroll Restructuring Administration is the claims and noticing agent in large bankruptcies, which means it tracks the claims and keeps creditors informed. In the FTX case that put it in direct contact with crypto customers, and that is where the most damaging copy so far appeared.
According to Kroll's own page for FTX claimants, an unauthorized party reached Kroll's cloud systems in August 2023 and accessed, or may have accessed, claimants' names, email addresses, mailing addresses, account balances, phone numbers and claim details, and for a limited number, dates of birth. Kroll announced it on 25 August 2023. Kroll says it notified affected claimants by email from noticing@ra.kroll.com. The same page names a fake sender, info@omnichannel[.]blaster[.]biz, and warns that any email from it, or any message saying withdrawals are now available on your FTX account, is "part of a phishing scam."
The page also lists what the court, Kroll and FTX will never ask or require you to do in connection with the claims or the distribution of FTX assets:
- link a cryptocurrency wallet to a website or application
- provide your seed phrase or private keys
- download any software or use a particular wallet application
- provide your password over email, text message or the phone
- provide personal identifying information, such as your birthday or Social Security number, over email, social media or any other way than a court-approved process posted on the case website or the court's docket
Anything that asks for one of those is not Kroll, however real the email looks. Check claims only through the case page on restructuring.ra.kroll.com. The wallet-connect trick is the same one behind the fake delisting emails that ask for seed phrases.
Eight checks for any letter, email or check from Kroll
These work for all three kinds of mail and take about twenty minutes.
- Work out which Kroll is writing. A monitoring offer comes from the company that had the breach, a settlement notice or check comes from Kroll as administrator for a named court case, and a bankruptcy claim email comes from Kroll as the court's claims agent. Each one is checked in a different place.
- Find the sender without using the message. For a breach letter, search the company's name on a state attorney general breach list and open its sample notice. For a settlement, search the case name and find the official settlement website. For a bankruptcy, open the case page on restructuring.ra.kroll.com.
- Compare the details. A real monitoring letter matches the sample notice: the same company, the same Kroll service, an enrollment address at enroll.krollmonitoring.com and a deadline. A real settlement message matches the stage the official site describes.
- Type the address yourself. Go to the enrollment site, the settlement website or the case page by typing it, not by tapping a link or calling a number from an unexpected email, text or call.
- Give identity details only inside that sign-up. Credit monitoring has to match you to your credit file, so the sign-up can ask for your Social Security number. Type it there, on a site you reached yourself, and never give it to someone who called, texted or emailed you first.
- Never pay to receive money. No real settlement or monitoring offer charges a fee, a tax or a release payment, and none asks for gift cards, wire transfers or cryptocurrency.
- Never link a wallet or share a seed phrase. Kroll's own guidance for FTX claimants says the court, Kroll and FTX will never ask you to link a cryptocurrency wallet, give a seed phrase or private keys, or download software.
- If you already gave details, act the same day. Call your bank on the number on your card, freeze your credit with all three bureaus, report the identity theft at IdentityTheft.gov and the scam at ReportFraud.ftc.gov.
If you already gave details to someone, the order matters: your bank first, then a credit freeze, then reports at IdentityTheft.gov and ReportFraud.ftc.gov. It is not your fault that a copy of a real company reached you first. Moving fast is what limits the damage.
Kroll is real, which is exactly why its name proves nothing on its own. Find the sender yourself, type the address yourself, and give your details only to a site you reached that way.
Questions about Kroll letters, emails and checks
Is Kroll legit?
Yes. Kroll is a real company, and three parts of it write to ordinary people: Kroll identity monitoring, which companies hire to protect customers after a data breach; Kroll Settlement Administration, which runs class action settlements for courts; and Kroll Restructuring Administration, which handles claims in bankruptcy cases such as FTX. That Kroll is real proves nothing about the letter, email or call you received, because scammers copy real names. Check the message by finding its sender yourself: the breached company's sample notice on a state attorney general list, the case's own settlement website, or the bankruptcy case page.
Is it safe to give my Social Security number to Kroll?
Only inside the sign-up you reached yourself. The breach letters we read state that to receive Kroll's credit services you must have a Social Security number in your name and a US address on your credit file, because credit monitoring has to match you to that file. So the sign-up at enroll.krollmonitoring.com can ask for it. What should never happen is someone calling, texting or emailing you first to collect it. Kroll's guidance for FTX claimants says it will never ask for your Social Security number over email or social media outside a court-approved process.
Why did I get a letter about Kroll identity monitoring?
Because a company that held your data had a breach and is offering you free monitoring through Kroll. The letter comes from that company, not from Kroll, and names the service, the length of the offer (one or two years in the samples we read), an enrollment address at enroll.krollmonitoring.com, a membership number or activation code, and a deadline. In California you can check it by searching the company on the Attorney General's breach list and opening its sample notice.
How much are people getting from a Kroll settlement?
There is no single Kroll settlement. Kroll Settlement Administration runs many separate cases, and the court-approved terms of each case decide who is paid and how much. In the AT&T data breach case, for example, the official site says individual amounts are unknown and depend on the valid claims received, administration costs and court-awarded fees. In that case, which Kroll administers, the court granted final approval on 2 October 2026 and the official website says payments are not expected to be issued in 2026. Any message promising a specific amount, or asking for a fee to release it, is not from the administrator.
I got a check from Kroll Settlement Administration. Is it real?
It can be. Kroll pays out settlements for courts. Before you deposit it, find the case's official settlement website by searching the case name, and check that the site says payments are being made now. For example, the AT&T data breach settlement site says payments are not expected in 2026, so an AT&T settlement check in 2026 would not match. Call the number on the official website, not one printed on the check or in a letter, if anything does not fit.
Is an email from Kroll about my FTX claim real?
Check it before you click anything. In August 2023 Kroll had a security incident that exposed FTX claimants' names, email addresses and claim details, and fake emails followed. Kroll's FTX page says its notices came from noticing@ra.kroll.com, warns about emails from info@omnichannel[.]blaster[.]biz and any message saying withdrawals are available, and says the court, Kroll and FTX will never ask you to link a wallet, give a seed phrase or private keys, or download software. Verify anything through the case page on restructuring.ra.kroll.com.
Sources and review
Every source was read at origin on 3 November 2026: Kroll's monitoring, enrollment and FTX claimant pages, two sample breach notices and the breach list published by the California Attorney General, the official AT&T settlement website and FAQs, and the FTC. Kroll's monitoring site lists frequently asked questions whose answers did not load for us, so nothing on this page quotes them. Tutela Digitalis has no relationship with Kroll or any company named here.