Leaked birthdays can help fraudsters build convincing profiles of customers
Cybersecurity experts advise giving retailers a false date of birth or leaving the field blank, because information exposed in data breaches can help scammers build convincing profiles and impersonate customers. A birthday on its own is of limited use to criminals, but combined with names, contact details and other leaked or public information, it can make fraud more plausible.
A survey by scam investigator Alexandre François found that eight of 14 retailers asked for a date of birth at sign-up, which can also help with marketing. Experts suggest avoiding optional personal fields and using a separate email address for online shopping; if a birthday is required, using the same memorable false date across retailers may reduce exposure. Real details should be reserved for organisations that need them to verify identity, such as banks, lenders and government agencies.
In short
- Retailer breaches can help scammers piece together identity profiles.
- Leave optional birthday fields blank or use a false date.
- Give your real date of birth where identity checks require it.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Giving retailers a false birthday or leaving an optional field blank can limit the personal information available if a company is breached, making it harder for criminals to combine leaked details into a convincing impersonation. Retailers may use birthdays for marketing, but shoppers can reasonably prioritise privacy and reserve accurate details for organisations that need them to verify identity.
The case against
Accurate birthdays can help retailers personalise offers or provide services linked to a customer’s age, and keeping details consistent may make accounts easier to manage. A birthday alone has limited value to fraudsters, so some customers may judge the convenience or benefits of sharing it worth the risk, especially where the field is optional and the retailer’s data practices are trusted.
Explained simply
Retailers may ask customers for a date of birth when they create an account, sometimes to tailor marketing. Personal details can also be exposed when a company suffers a data breach, or pieced together from information available elsewhere.
Fraudsters may combine a birthday with a person’s name, contact details and other information to make an impersonation attempt seem more convincing. A date of birth alone is usually of limited use, but it can add credibility to a wider set of stolen or public details.
Banks, lenders and government agencies may need accurate details to check someone’s identity. Retailers generally have less need to verify a customer’s birthday, so experts advise considering whether optional personal information is necessary before sharing it.
Read the full article at the source →
Originally published by The Guardian as “A gift to scammers: why you should probably keep your birthday a secret”.