How do scammers get your information?
Have you received one too many scam texts, calls, or emails? If so, you might be wondering what you can do to put an end to them. The logical solution is figuring out where scammers find your information and removing it.
Your personal information is extremely valuable to cybercriminals as they rely on it in order to target you. And unless you’re actively working on removing your information from the internet, it is quite easy to find.
How do scammers get your information?
Data brokers and people search sites
If scammers have the money to spend, even just a little bit, they don’t even have to put any real effort into compiling a profile of your personal information. They can simply buy it online, sometimes for as little as a dollar. Worse yet, removing your personal information from sites that sell it is no easy feat, unless you have help.
People search sites publish your personal information online for anyone to access. They often publish basic information such as your name and address for free, but provide detailed records containing an alarming amount of your personal information for a price.
These records can include:
- Full name
- Date of birth
- Addresses
- Phone numbers
- Email addresses
- Social media profiles
- Employment history
- Education history
- Relatives and associates
- Property records
- Criminal records
- Bankruptcies
- Liens and judgments
- Vehicle ownership
- Professional licenses.
Data brokers work a little differently. They sell information to organizations, rather than individuals. Normally, their clients include marketers, insurance companies, banks, recruitment bureaus, and other legitimate organizations.
However, some data brokers have been caught selling the personal information of vulnerable individuals directly to scammers. Three of the biggest data brokers in the industry recently faced charges for knowingly selling the personal information of elders to scammers, for example.
Companies that sell user data
Data brokers aren’t the only companies that sell your personal information. Lots of companies that get their hands on your information sell or trade it for personal gain. These can include online shopping sites, services you subscribe to, developers of apps you install on your devices, and more.
All of these entities collect user data and often sell it for marketing purposes. You can check the privacy policies for details regarding how companies handle your personal information.
Social media and personal sites
Some of the first places scammers go to collect your personal information are your social media profiles. This is because social media platforms are free, often publicly accessible, and contain a wealth of personal information—from your contact details to your plans for the upcoming weekend.
Common social media platforms scammers like to prowl include Facebook, Instagram, LinkedIn, and X (formerly Twitter). They generally target public accounts but some more determined scammers may even create fake social media profiles, sometimes masquerading as acquaintances, and send friend requests in the hopes of gaining access to private accounts as well.
Phishing scams
Phishing scams are scams specifically designed to steal personal information. Cybercriminals create fake competitions and lotteries you never signed up for, surveys with too-good-to-be-true rewards, and even quizzes for those who can’t turn down a fun little challenge.
Scammers may also call you, posing as customer service representatives of companies they know you’re a client of. Most commonly, you’ll find phishing scams shared on social media, sometimes by your own friends and family who took part in and passed them along, not knowing the malicious intent behind them.
These all appear relatively harmless, leading to no immediate or noticeable consequences, but that’s the whole point. The goal is to fly under the radar while the scammers collect enough of your personal information to launch a serious attack.
A little bit of your demographic information here, a bit of your background information there, a sprinkling of a few of your online accounts, and before long, they have all the personal and financial information they need to launch highly targeted and convincing attacks or just steal your identity.
Mail and sensitive documents
Not all scammers rely strictly on the internet to harvest your personal information. Documents can contain the most valuable types of personal information—your Social Security number, IDs, bank details, and more. They can just as easily steal them from your mailbox or from your bag, your desk at work, and even your garbage bins.
Hacking and data breaches
When tricks don’t work, there’s always brute force. Hackers can target your computer and mobile device, email, social media, and other online accounts to get their hands on your personal information.
There are many methods hackers can use to do this. Emails and messages can contain spyware that you may accidentally download, connecting to an unsecured network can leave you open to man-in-the-middle attacks, and malware-infected USBs may be left among your belongings with the hope that you insert one into your device.
Not only can hackers break into your accounts to steal your personal information, they can also target companies that hold large amounts of consumer data, meaning your information may end up in large-scale data breaches.
This happens more often than you might think, to both industry giants and small businesses. Statista’s list of the most significant data breaches includes companies like Facebook, Yahoo, LinkedIn, Marriott, and more.
The dark web
One place cybercriminals love is the dark web. Scammers are no exception. Personal information often ends up on the dark web for sale, whether through data breaches or accidental leaks. There are specialized marketplaces where scammers can use cryptocurrency to buy data in bulk.
Unfortunately, it’s difficult to know for sure whether your personal information is on the dark web. Even worse, once there, there’s no real way to get it off. The dark web isn’t indexed and can’t be navigated like the clearnet (the part of the internet we’re all familiar with).
What kind of information might scammers steal?
- Social Security number (SSN)
- Financial account numbers (e.g., bank account, credit card details)
- Personal Identification Numbers (PINs)
- Passwords
- Full name
- Addresses
- Date of birth
- Driver’s license number
- Passport number
- Email addresses
- Phone Numbers
- Social media account information
- Health insurance information
- Medical history
- Employment history
- Educational background
- Vehicle registration information
- Mother’s maiden name
- Utility account information (e.g., electricity, water)
- Biometric data (e.g., fingerprints, facial recognition)
How can you protect your information from scammers?
Remove personal information from data broker sites
One of the most effective measures you can take to prevent scammers from obtaining your personal information is removing it from data brokers and people search sites. Not only will this remove the easy option of simply buying your data online, it’ll also limit the number of legitimate companies that hold your data, making it less likely for your information to end up in data breaches.
Unfortunately, your personal information is valuable to data brokers and people search sites, so they won’t give it up easily. Laws and regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) give you the right to remove your personal data. However, data brokers may make you jump through hoops to exercise these rights.
First, you’ll have to track down which data brokers and people search sites have your personal information. Then, each of those companies has its own opt-out procedure. Doing this once isn’t enough. Many of these companies simply collect and sell your personal information again. All in all, it can be a painstaking and time-consuming process.
Check out our list of the biggest data brokers and people search sites, along with opt-out guides to help you get started on your data removal journey. Alternatively, try Incogni’s personal information removal service to handle the entire process for you.
Use a VPN
If you’re not already using one, we recommend starting with a Virtual Private Network (VPN). A VPN encrypts your internet connection and routes it through a secure server before reaching its destination. This prevents scammers from accessing sensitive information like login credentials and financial details. It also masks your IP address, enhancing anonymity online, especially crucial when using public WiFi where cybercriminals can intercept unencrypted data transmissions.
We recommend avoiding free VPNs as they can pose privacy and security risks. Instead, opt for reputable providers like Surfshark or NordVPN.
Use antivirus software
To maintain your device’s security, consistently monitor it for malicious software. Antivirus programs detect and remove malware such as viruses, trojans, and spyware, safeguarding your personal information.
They scan files and incoming data streams in real-time, identifying and neutralizing threats before they can compromise your device’s integrity. Security software can also block access to phishing websites, helping you avoid online scams designed to steal your data.
Much of the personal information that falls into scammers’ hands isn’t stolen but willingly shared. In the internet age, oversharing is common across social media profiles, personal blogs, and business websites.
It’s vital to be mindful of what you share and with whom. Unless you’re a public figure or utilize these platforms for business, we recommend keeping your social media profiles private and optimizing the privacy settings on all your online accounts, including social media, e-commerce, and messaging platforms.
Check out our complete guide on how to remove your personal information from the internet for step-by-step instructions on how to keep your personal information private on the web.
Handle documents responsibly
As we mentioned above, scammers sometimes like to go dumpster diving. When handling documents containing sensitive details, make sure to shred them before disposal. As for digital documents, don’t forget to permanently delete anything you no longer need. Never keep the files on USBs or external drives that can be easily stolen. Keep them—as well as paper documents—under lock and key to prevent unauthorized access.
Telltale signs a scammer has your personal information
Even if you do everything right, there’s unfortunately always still a chance that scammers may get your personal information. It happens to the best of us. It’s important to know the signs if this happens to you.
Here’s what you should watch out for:
- Unexpected account activity: If you notice unfamiliar transactions on your bank statements or credit card bills, someone likely has access to and is misusing your financial information.
- Unsolicited communications: Unexpected emails, text messages, or phone calls asking for your personal information or to take urgent action (such as giving them sensitive details or clicking on links) usually mean scammers already have some of your personal information.
- Unauthorized changes to accounts: If you receive notifications about changes to your account settings, passwords, or contact information that you didn’t make, someone has accessed your accounts without your permission.
- Credit report anomalies: Unexplained changes in your credit score and inquiries you didn’t make could indicate fraudulent activity or even identity theft.
- Missing mail or documents: If you’re suddenly missing important mail or documents, such as bills, statements, or tax forms, it’s possible that someone intercepted them.
- Data breach notifications: Companies that have experienced data breaches will usually let you know that your personal information may have been compromised.
- Unexplained account closure or denial of service: If you suddenly can’t access an account or service that you regularly use, or if you receive a notification that your account has been closed due to suspicious activity, this could be an indication that scammers have tampered with your accounts.
What to do if a scammer has your details?
If you’ve noted any of the above signs, the last thing you should do is ignore them. It’s important that you act quickly to mitigate the potential consequences and regain control over your privacy and security.
Here are the steps you should follow if you suspect scammers have your personal information:
- Stay calm and be patient: Dealing with fraud and identity theft can be difficult and time-consuming, but maintaining a positive attitude can reduce your stress levels and lead to better outcomes.
- Change your passwords: Update the passwords for your email, social media, and financial accounts. Make sure to set new, unique passwords for each account and that they are at least 8 characters long and include special symbols.
- Enable two-factor authentication (2FA): Activate two-factor authentication wherever possible to add an extra layer of security.
- Contact credit bureaus: Consider contacting the major credit bureaus (Equifax, Experian, and TransUnion) to place fraud alerts or credit freezes on your credit reports. This can help prevent scammers from opening new accounts in your name.
- Report identity theft: If you believe your identity may have been stolen, report it to the Federal Trade Commission (FTC) at IdentityTheft.gov. They provide step-by-step instructions for creating a personalized identity theft recovery plan.
- Inform relevant institutions: If your Social Security number, driver’s license, or other government-issued identification has been compromised, notify the relevant government agencies.
- Monitor your accounts: Regularly check your bank and credit card statements for any unauthorized transactions and report any suspicious activity immediately.
FAQ
How does a scammer know my name and address?
Scammers can find your name and address through people search sites, public records, social media profiles, companies sharing your data, or data breaches. Unless you actively work to suppress your personal information, it’s easy for anyone, including scammers, to find it online.
What information does a scammer need to access my bank account?
To access your bank account, a scammer typically needs your bank account number, sort code, and any associated login credentials like usernames, passwords, and security questions. With this information, they can attempt unauthorized transactions or identity theft.
Should I be worried if a scammer has my phone number?
A scammer having your phone number can pose risks such as phishing attempts, identity theft, and even harassment. You can mitigate the risks by blocking all spam numbers, not answering unknown calls or replying to messages from unknown numbers, and never sharing sensitive information over the phone.
Can a scammer do anything with your email?
Scammers can’t do “anything” with your email, but they can do significant harm. They can send you phishing scams and malware, try to hack into your email account, and use your email address to access other accounts linked to that email by using password resets or account recovery processes.
Can a scammer do anything with your phone number?
With just your phone number, scammers can conduct activities like phishing attempts, identity theft, SMS scams, or SIM card swapping to gain unauthorized access to your accounts or personal information.
Can a scammer be traced?
Tracing scammers is possible, but it can be challenging. Scammers often use fake identities or VPNs or operate from jurisdictions with lax regulations. While law enforcement agencies use various tactics to catch them, successful tracing requires significant resources and international cooperation.
Do fraudsters get caught?
Fraudsters can be caught, but it depends on factors like the scale of the cybercrime, available evidence, jurisdictional challenges, and cooperation from involved parties. Law enforcement agencies and institutions such as the FTC continually work to identify, prosecute, and prevent fraud.
