You get a call from your bank saying there has been suspicious activity on your account. They read out your name, address and date of birth so you are happy it is a legitimate caller. But you are talking to criminals who have used your date of birth as part of a web of verifying information to convince you they are someone else.
People’s DOBs are often held in online accounts after being entered as part of a sign-up process for a retailer, loyalty scheme, newsletter or online competition. In a recent hack of the online retailer Asos customers’ dates of birth were among the details taken by scammers. Now cybersecurity professionals have warned people to resist entering a date of birth, or to put in a fake one, to limit the amount of personal data that is online, frustrating criminals’ attempts to “jigsaw” together personal profiles.
Jake Moore, an adviser for the cybersecurity company ESET, says information gathered during hacks can be sold on and used by scammers, either to trick people into trusting them, or to impersonate them. Alexandre François, who investigates scams for the intelligence company WhoisXML API, found that eight out of 14 retailers he surveyed recently asked for a date of birth on sign-up. You may hear about a hack either in the news, or in an email from an organisation telling you that your data has been compromised.
How the scam manifests itself will depend on what happens to the information that has been stolen. If a retailer is hacked, and the details end up on the dark web, they can be used to make phishing emails look more authentic, says Serpil Hall, a security expert from Datos Insights. Hackers can also use them to try to convince company help desks that they are talking to the victim.
But it may not all happen straight after a security breach. Public information such as social profiles, employment details and relatives adds more context. The result is an enriched identity profile with more identifiers and greater confidence when matching records.” Be wary of anyone who contacts you out of the blue, even if they seem to have a lot of information.
In those systems the date of birth works as a key. A shop is not one of them.” Leaving a birthday field blank is best, he says.
Extract — continue reading at the source.
