How did scammers get my information?
Mostly legally, and mostly cheaply.
That answer matters, because the whole reason a caller recites your address and the last four of your card is to make you think only your bank could know that.
Anyone can know that. For about a dollar.
The five sources
1. Data brokers. Companies whose entire business is compiling and selling files on individuals: name, current and past addresses, age, phone numbers, relatives, home value, estimated income, buying habits. Legal in most of the United States. There are hundreds of them.
2. Breaches. Companies you've done business with get hacked — insurers, retailers, hospitals, credit bureaus, phone companies. Those files circulate for years. Almost every American adult is in several.
3. Public records. Property deeds, voter registration, court filings, business filings, marriage and death records, obituaries. Obituaries in particular are a gift to scammers: they list surviving relatives by name and relationship.
4. Social media. Birthdays, pets, schools, grandchildren's names, the town you grew up in, where you're on vacation right now — which is also, not coincidentally, the answers to most security questions.
5. Lists of previous victims. If you've been scammed once, that fact gets sold. It's called a sucker list and it's why the second scam always comes.
What this means in practice
A caller knowing your details is not evidence of anything.
They may know your name, address, birthday, bank's name, last four digits, children's names, and that you bought a hearing aid in 2019. None of it means they work where they say they work.
This is the whole reason the first step is to hang up and call a number you looked up yourself. It's the only test that works, and it works regardless of what they know.
Can I get it taken down?
Partly. You won't get it all, and you shouldn't spend your life trying — but a few hours does reduce your exposure meaningfully.
Free, and worth doing:
- Freeze your credit at all three bureaus. Biggest single win.
- Opt out of the big data brokers. Start with Spokeo, Whitepages, BeenVerified, Intelius, Radaris, and PeopleFinders. Each has an opt-out page.
- Opt out of pre-approved credit offers at optoutprescreen.com or 888-567-8688. Cuts down mail theft too.
- Register at donotcall.gov. It won't stop criminals, who ignore it, but it thins out the legitimate calls so the odd ones stand out.
- Set social media to friends-only — yours, and encourage grandchildren to do the same. Their public videos are what voice cloning uses.
- Google your own name and see what comes up. It's what a scammer does first.
Paid services that remove you from brokers repeatedly do work, but the data gets re-listed, so it's an ongoing subscription rather than a fix. Reasonable choice, not a necessary one.
Don't spend your worry here
You can't undo what's already out. And you don't need to — the whole defense on this site is built to work even though they know things about you.
Reducing your exposure is good hygiene. Hanging up and calling a number you looked up yourself is the actual protection.
Don't spend your worry here
You can't undo what's already out, and you don't need to. Every defense on this site is built to work perfectly well against someone who knows your name, your address, and your bank.
Reduce your exposure because it's sensible. Then let it go, and keep the habit that actually decides the outcome: hang up, look it up, call back.
More detail: How they got your information