What Personal Information Is Worth to Criminals

Quick read

For everyone

Main point

Main point: personal information is valuable because it can help criminals pretend to be you, target you, or trick you more convincingly.

Scammers may ask for obvious things like passwords, bank details, or identity documents.

But they may also collect smaller details, such as:

Your full name
Your date of birth
Your address
Your phone number
Your email address
Where you work
Names of family members
Photos, posts, or public profile details

One small detail may not seem important by itself.

But when criminals combine details from messages, social media, data breaches, public records, and previous scams, they can build a more complete picture of you.

A safer habit: be careful when someone asks for personal information, especially if the request is unexpected, urgent, or connected to money or account access.

A little deeper

For curious readers

Context

So far in this series, we have focused on slowing down, recognising pressure, and checking important requests before acting.

Now we are looking at one of the things scammers often want: your personal information.

Personal information is valuable because it can make other scams easier.

A scammer who knows your name and phone number can make a message feel more personal.

A scammer who knows where you work can pretend to be a supplier, manager, colleague, customer, or recruiter.

A scammer who knows you recently bought something, moved house, booked a trip, or contacted a business can make their message seem like it fits your life.

Small details can become powerful when combined.

For example, a criminal might collect:

Your name from one place.
Your email address from a data breach.
Your workplace from a social media profile.
Your phone number from an online listing.
Your family details from public posts.
Your address from a form, delivery scam, or leaked record.

Each piece may seem harmless. Together, they can help someone impersonate you, answer security questions, target your accounts, or create a scam that feels believable.

Personal information can be used to:

Make phishing messages look more real.
Guess answers to security questions.
Impersonate you to a company, bank, or phone provider.
Open accounts or apply for services in your name.
Trick your friends, family, or workplace.
Pressure you with information that seems private.
Build trust before asking for money or access.

This does not mean you should be afraid to use the internet. It means you should think carefully before sharing information, especially when you did not start the conversation.

A safer habit:

Be cautious when a form asks for more information than seems necessary.
Do not share identity documents unless you know who is asking and why.
Avoid posting details that could help someone impersonate you.
Be careful with quizzes, giveaways, surveys, and competitions that ask personal questions.
Check privacy settings on social media and public profiles.
Treat unexpected requests for personal information as untrusted until verified.

If someone asks for information and you are unsure, pause and ask:

“Why do they need this, and can I verify the request another way?”

Technical notes

For confident users

Technical

Personal information is useful to criminals because it supports identity theft, impersonation, credential recovery abuse, targeted phishing, account takeover, and social engineering.

Not all personal information has the same level of sensitivity. Some details are high-risk on their own, such as identity documents, tax file numbers, passport numbers, driver licence details, bank account details, card details, Medicare details, passwords, and multi-factor authentication codes.

Other details may seem low-risk in isolation, but become valuable when combined. These include names, email addresses, phone numbers, usernames, dates of birth, addresses, employer details, family relationships, photos, locations, and personal interests.

Criminals may collect this information from many sources, including:

Phishing forms.
Fake competitions or surveys.
Social media profiles.
Public websites.
Data breaches.
Marketplace listings.
Business directories.
Leaked documents.
Previous scam attempts.
Compromised email or cloud accounts.

This process is sometimes called profiling or reconnaissance. The goal is to gather enough context to make a later attack more convincing or more effective.

For example, personal information can be used to reset passwords, pass weak identity checks, request a SIM swap, impersonate a customer, target a workplace, or create a message that appears to come from someone who knows you.

This is especially important for high-risk information and actions, including:

Uploading identity documents.
Sharing full date of birth and address together.
Providing bank, card, tax, or medical details.
Answering security questions.
Sharing passwords or multi-factor authentication codes.
Posting travel plans or location details publicly.
Publishing workplace, role, and contact details together.
Completing forms reached through suspicious links or QR codes.

A useful rule is to treat personal information as cumulative.

One piece of information may not seem dangerous by itself, but each piece can reduce the attacker's work.

Good privacy habits reduce the amount of information available to criminals. Good verification habits reduce the chance that criminals can use that information to pressure you into trusting them.