A date of birth may seem harmless when requested during an online sign-up, but cybersecurity professionals warn that it can become valuable when combined with other personal information. Criminals may use it to make fraudulent calls, emails or account-recovery attempts appear legitimate.
Dates of birth are often collected by retailers, loyalty programmes, newsletters and online competitions. They can also be exposed in data breaches and later sold or combined with information from other sources. In a recent breach involving online retailer Asos, customers’ dates of birth were among the information taken.
Jake Moore, an adviser at cybersecurity company ESET, says a date of birth on its own is not especially valuable to criminals. Combined with names, telephone numbers and other details, however, it can help them impersonate victims or commit identity fraud.
Alexandre François, who investigates scams for intelligence company WhoisXML API, found that eight of 14 retailers he recently surveyed asked customers for their date of birth during registration. He says retailers may retain the field because a customer’s age can be useful for marketing and targeting.
Stolen information may be used to make phishing messages more credible or to persuade company help desks that a criminal is speaking to the real account holder. Serpil Hall, a security expert at Datos Insights, says a retail breach can provide a name, date of birth, email address and physical address. Other leaked data and publicly available information, such as telephone numbers, social profiles, employment details and relatives, can then be added to create a more complete identity profile.
People should be cautious when contacted unexpectedly, even if the caller or sender knows apparently convincing personal details. Moore says using a different birthday on low-risk websites can limit exposure, while leaving unnecessary personal fields blank is preferable. He also suggests using a separate email address for online shopping so it can be discarded if it becomes involved in a breach.
François says retailers generally need payment-card information and a delivery address. Age verification may still be required for purchases involving restricted products, such as knives.
He advises reserving a real date of birth and real name for organisations that verify identity against official records, including banks, lenders, tax authorities, driving licence and passport agencies, right-to-work checks and police notices. For ordinary retail accounts, he says, leaving the birthday field empty is the best option. If a website makes that impossible, using the same alternative date across retailers may make it easier to remember without disclosing the real one.
Sources: The Guardian Technology.