You get a call from your bank saying there has been suspicious activity on your account. They read out your name, address and date of birth so you are happy it is a legitimate caller.
But you are talking to criminals who have used your date of birth as part of a web of verifying information to convince you they are someone else.
People’s DOBs are often held in online accounts after being entered as part of a sign-up process for a retailer, loyalty scheme, newsletter or online competition. In a recent hack of the online retailer Asos customers’ dates of birth were among the details taken by scammers.
Now cybersecurity professionals have warned people to resist entering a date of birth, or to put in a fake one, to limit the amount of personal data that is online, frustrating criminals’ attempts to “jigsaw” together personal profiles.
Jake Moore, an adviser for the cybersecurity company ESET, says information gathered during hacks can be sold on and used by scammers, either to trick people into trusting them, or to impersonate them.
“A date of birth alone is not particularly valuable to criminals, but combined with other information, such as names and phone numbers, it can help criminals … commit identity fraud,” he says.
Alexandre François, who investigates scams for the intelligence company WhoisXML API, found that eight out of 14 retailers he surveyed recently asked for a date of birth on sign-up. “Retailers may also have little incentive to remove this field, as the full date gives them the customer’s age, which is useful for marketing and targeting,” he says.
What it looks like
You may hear about a hack either in the news, or in an email from an organisation telling you that your data has been compromised. How the scam manifests itself will depend on what happens to the information that has been stolen.
If a retailer is hacked, and the details end up on the dark web, they can be used to make phishing emails look more authentic, says Serpil Hall, a security expert from Datos Insights. Hackers can also use them to try to convince company help desks that they are talking to the victim. But it may not all happen straight after a security breach.
“The process typically runs like this: a retail breach provides a name, date of birth, email and address,” she says. “Other leaked data adds credentials, phone numbers and identifiers. Public information such as social profiles, employment details and relatives adds more context. The result is an enriched identity profile with more identifiers and greater confidence when matching records.”
What to do
Be wary of anyone who contacts you out of the blue, even if they seem to have a lot of information.
“Using a different birthday on low-risk websites can reduce exposure, but it is even better to not enter any personal fields that aren’t mandatory,” says Moore. “It is even worth using a separate email address for shopping online, too, so you can bin the email if it gets caught up in a breach and you can start again.”
François says shops only need your payment card details and a delivery address. (You will, however, need to verify your age in some cases if you are buying age-restricted items, such as knives.)
François says: “Strictly speaking, you only need to give your real date of birth, and your real name, where they are checked against official records and used to prove who you are: your bank or any lender, the tax office, the driving licence and passport agencies, right-to-work checks, a police notice. In those systems the date of birth works as a key. A shop is not one of them.”
Leaving a birthday field blank is best, he says. “If this is not an option, use the same date across all retailers, possibly the first day of your birth month, so that you do not forget it.”
