News
Guardian News and Media reports that retailers collecting dates of birth give fraudsters a detail that makes fake bank calls sound genuine.
Reported by
Guardian News and MediaScammers use a stolen date of birth, combined with your name and address, to convince you a fake bank caller is genuine, or to convince a company help desk that they are you. Guardian News and Media reports that cybersecurity professionals now warn people to stop giving retailers and loyalty schemes a real date of birth. If a site asks for your birthday and does not need it, leave it out or enter a false one.
A date of birth sits in online accounts for retailers, loyalty schemes, newsletters and competitions, wherever someone typed it in to sign up. Asos customers had their dates of birth taken in a recent hack of the online retailer. On its own, a date of birth does little for a criminal. Jake Moore, an adviser for the cybersecurity company ESET, says it becomes useful once it sits alongside a name and a phone number, enough to support identity fraud.
The scam depends on a caller sounding legitimate before any money is mentioned. A fraudster rings claiming to be from a bank, reads out a name, address and date of birth taken from a breach, and the victim relaxes because a stranger could not plausibly know all that. The information is not proof the caller is the bank. It is proof the caller has read a leaked file.
Serpil Hall, a security expert from Datos Insights, describes how the profile builds over time rather than all at once. A retail breach supplies a name, date of birth, email and address. A separate leak adds a password or a phone number. Public social media profiles and employment details add more. Each piece arrives from a different source and at a different time, and the scammer's job is to fit them together, what Moore calls a jigsaw.
Alexandre François, who investigates scams for the intelligence company WhoisXML API, surveyed fourteen retailers and found eight of them ask for a date of birth at sign-up. Retailers keep the field partly because it is useful for marketing, since the full date reveals a customer's age. That commercial reason for collecting it has nothing to do with protecting the customer who hands it over.
None of this requires a reader to have done anything wrong. A birthday typed into a competition entry years ago can resurface in a phone call that sounds exactly like a bank doing its job. The detail that makes the call convincing is the same detail that makes it dangerous.
Received something like this? Paste it into the Flggd message checker before you reply, click or pay.
