How not to verify a data breach (and why some really want you to get "pwned")