Do you give personal info to fraudsters?
Be careful on social media, as scammers are adept at exploiting what you share on the internet, discovers Sam Meadows
Think of fraudsters targeting you online and your mind will probably be drawn to high-profile hacks or dubious emails from a Nigerian prince. But new research suggests that we could be taking a cavalier attitude to our personal details and openly giving away our own information.
Nearly a third of fraud victims make their personal information freely available on the internet, says the report from fraud prevention agency Cifas and digital experts Forensic Pathways.
To illustrate how much personal information we share on social media and how easy it is to discover other identifiable details online, The Daily Telegraph gave the names of 11 staff members to fraud experts at Barclays.
They sifted through the online presence of their targets and found as much information as they could.
For one target the experts were able to access information, including a full address and date of birth, which could be devastating in the hands of scammers. Another target had unwittingly revealed the name and birth date of a family member by posting a photo of a newborn baby.
Sandra Peaston, director of insight at Cifas, said: “With identity fraud reaching record levels in recent years, more personal information available online, and increasing numbers of data breaches, the protection of personal data must be viewed as a collective responsibility.
“Everyone should play their part, from social media platforms taking more responsibility around security settings, to organisations prioritising the security of personal data.”
What information does a fraudster need to target you?
Think about the last time you called your bank or phone company. The security questions the call operators ask usually revolve around your name, address and birthday. All this information could be readily available online.
Jim Winters, a fraud expert at Barclays, said: “That starting point really helps the criminals.”
Our investigation shows that many people share their birthdays on social media – whether by posting publicly on the day itself or updating a profile on a professional site like Linkedin.
One of our targets had been careful not to list his birth year on Facebook or Linkedin, but had used numbers from his year of birth in his Instagram username, allowing hackers to piece together his date of birth.
Home addresses are also available online, through directory services such as 192.com or via Companies House, the public registry. Although these sites will not confirm that the address relates to you, fraudsters could corroborate it by searching your public Facebook friends list for other people who are listed at the address.
Company directors are particularly at risk of fraud. Barclays’ experts were able to find a home address and month and year of birth for one of our targets via Companies House.
Other readily available information online can hint to your password, or the answer to security questions. Have you used your mother’s maiden name as the answer to password security questions on the internet? She’s very likely to have shared this on her Facebook account. Mr Winters said it was incredibly easy to forget the significance of what you might be sharing online.
“Even if they can only see your home town, maybe you have posted a picture of your kid’s first day at school and your street number is in the background,” he said. “They know roughly where you live from the school uniform. That could be everything the fraudster needs to get access to your home address.”
Fraudsters aren’t likely to search for you specifically, but the report warns that the explosion of screen-scraping technology has made it easier for criminals to quickly acquire public information on a wide group of people.
The Cambridge Analytica scandal, in which the firm was able to use a Facebook game to gain access to a user’s friends list, is a recent example.
What can they do with it?
Once a criminal has got hold of basic personal information, they could use what they have to trick you into divulging more details that help them gain access to your finances. If they manage to find a phone number they could call you posing as staff at your bank. Thousands of TSB customers experienced this after the bank’s recent data breach.
Another common tactic among fraudsters, an investigation by consumer champions Which? found, is to use your personal information to set up an impostor bank account. This could be used to access overdrafts, set up fraudulent credit cards or even launder the proceeds of other scams.
Are you putting your friends and family at risk?
Cifas’s research has renewed warnings about so-called “sharenting”, when family members share information about their children that could put them at risk.
One of the targets in our investigation had, by posting a picture on Instagram celebrating the birth of her niece, given away her full name and date of birth, which could put her at risk in the future. Mr Winters said: “Many parents are sharing what is actually quite sensitive information without realising it, but other relatives can also be sharing all sorts of things. Lots of it started many years ago, so those kids are now adults with bank accounts. The damage could have been done a long time ago.”
Can you protect yourself?
Short of deleting all your social media accounts and becoming a digital recluse, it’s difficult to protect yourself entirely. But Mr Winters said just having awareness of the possible consequences of your posts would help.
“We definitely don’t want to warn people off social media entirely, but just be careful about what you’re sharing and be careful with what you allow others to share about you,” he said. “Unravelling it could just be as simple as having a flick through your profile and deleting anything you think could be suspect. Tidying it up will help going forward.”
‘Many parents are sharing sensitive information without realising it’