How they got your information

Listen to this page This recording is of an earlier version of this page.

Most scam advice skips this, and it shouldn't. It's the piece that explains why a caller can recite your address and still be a total stranger.

The pipeline

Data brokers. Hundreds of companies buy and sell files on people. One file can hold your name, every address you've had, your age, your phone numbers, and your relatives. It can also hold whether you own your home and what it's worth, your likely income, what you buy, and what they think you like. This is legal in most of the US. Some brokers focus on exactly the groups scammers want most. Recent widows. People with health conditions. People who've replied to a sweepstakes offer.

Breaches. Companies you dealt with get hacked: insurers, pharmacies, retailers, hotels, hospitals, credit bureaus, phone companies. Those files get passed around for years, and they get combined with each other. A name in one file. A card number in another. An address in a third. Put them together and they make a full picture of you.

Public records. Property deeds, voter rolls, court filings, business registrations, marriage records, death records, obituaries. Obituaries are worth a lot to a scammer. They name the surviving relatives, in order. They spell out who is who. The grandparent scam runs partly on obituaries.

Social media. Birthdays, pets, schools, hometowns, grandchildren's names and faces, and where you are this week. This is also, not by coincidence, the answer key to most security questions.

Sucker lists. If you've lost money once, that fact is itself a product. It's sold, and it's why the second approach always arrives.

Your own voice and face. Any public video is enough audio for voice cloning. A livestreamed service, a grandchild's TikTok, a work presentation.

The two consequences

1. 1

   Nothing a caller knows about you means anything.

   Your address. Your bank's name. Your birthday. Your children's names. The last four of your card. Anyone can buy all of it. Recited details are a script, not a credential. Is that what's making you doubt yourself right now? It has its own page: it's a scam if they already know my address?

2. 2

   You are targeted, not selected at random.

   The calls that reach you are often aimed. A purchased list can be filtered by age, by home ownership, by recent widowhood, and by whether someone has been scammed before. That's not paranoia. It's how the lists are sold.

Which is oddly reassuring. The amount of contact you get isn't a sign that you've done something careless. It's a sign that you're in a group someone bought.

Reducing your exposure

You can't undo what's out there. And you shouldn't organize your life around trying. But a few hours makes a real dent:

Short version below. Would you rather be walked through each one, with what it does and how to do it? Use Shrink what they can find.

Do these, free, high value:

• Freeze your credit at Equifax, Experian, and TransUnion. Biggest single win available to anyone.
• Equifax: 888-298-0045
• Experian: 888-397-3742
• TransUnion: 800-916-8800
• Opt out of pre-approved offers: optoutprescreen.com or 888-567-8688. Fewer offers in the mailbox also means less mail theft.
• Set social media to friends-only. Yours, and ask grandchildren to do the same. Their videos are the voice-cloning source.
• Remove birth year and phone number from public profiles.
• Register at donotcall.gov. Criminals ignore it. But it thins out the real calls, so the strange ones stand out more.
• Search your own name. See what a scammer sees before they see it.

Worth an afternoon:

• Opt out of the major data brokers individually. Start with Spokeo, Whitepages, BeenVerified, Intelius, Radaris, PeopleFinders, and MyLife. Each has an opt-out page. Each takes a few minutes.
• Use a password manager, or a paper notebook kept somewhere private. Both beat reusing one password everywhere. That is the most damaging habit in everyday computer use.
• Turn on two-factor authentication on email and banking. Email first.

Optional:

• Paid removal services do work. But your data gets re-listed, so it's a subscription rather than a fix. Reasonable, not necessary.

Keep this in proportion

Privacy hygiene reduces how often you're targeted. It doesn't decide whether a scam succeeds.

What decides that is the three steps. Hang up. Call a number you looked up. Wait a day. Those work perfectly well against someone who knows everything about you.

Reduce your exposure because it's sensible. Don't rely on it, and don't lose sleep over it.

The good news buried in all this

If knowing things about you were the same as proving who they are, you'd be defenseless. That information is out there, and you can't get it back.

But it isn't the same, and you aren't defenseless. The number you dial is something they can never buy, breach, or fake. Every bit of information they've collected about you becomes useless. You just have to hang up and call a number you chose yourself.