Why Keeping Your Birthday Private Can Help You Thwart Scammers
Retailers often ask for a date of birth they do not need. Security experts explain how it helps scammers build a fake identity, and what to enter instead.
A birthday typed into an online checkout can become a gift to scammers. Combined with other leaked personal details, it can make a false identity seem credible, cybersecurity professionals warn. A date of birth alone is not especially valuable, but it can help criminals build a profile that persuades people or supports identity fraud.
That risk can start with an ordinary online sign-up. Retailers, loyalty schemes, newsletters and competitions may ask customers for a birth date, adding personal information to accounts that could later be exposed in a breach.
Why can a birthday help scammers?
Jake Moore, an adviser for cybersecurity company ESET, said stolen information may be sold and used to trick people into trusting a caller or to impersonate them. “A date of birth alone is not particularly valuable to criminals, but combined with other information, such as names and phone numbers, it can help criminals … commit identity fraud,” he said.
The details can be assembled over time. Serpil Hall, a security expert from Datos Insights, described how information from separate leaks and public profiles can be combined into a richer identity record. One breach might expose a name, birth date, email and address; other leaked data can add credentials, phone numbers and identifiers.
That profile can make a phishing email look more authentic or help someone convince a company help desk that they are the account holder, Hall said. The danger is not limited to the moment a company announces a breach: exposed details may be combined with other information later.
A recent hack at online retailer Asos included customers’ dates of birth among the details taken by scammers. The example illustrates why information collected for routine account registration can matter beyond the original transaction.
When should you leave the birthday field blank?
For a routine retail account, cybersecurity professionals advise against providing personal details that are not required. Moore said using a different birthday on low-risk websites can reduce exposure, while leaving optional fields blank is better.
“It is even worth using a separate email address for shopping online, too, so you can bin the email if it gets caught up in a breach and you can start again,” Moore said.
Alexandre François, who investigates scams for intelligence company WhoisXML API, found that eight out of 14 retailers in a recent survey asked for a birth date during sign-up. He said retailers may keep the field because a full date reveals a customer’s age, which can support marketing and targeting.
For shoppers, the practical distinction is between a retailer collecting information for an account and an institution that needs to verify identity. François said shops need payment card details and a delivery address. Some purchases of age-restricted items, such as knives, may require age verification.
He said a real birth date and name should be reserved for settings where they are checked against official records, including banks and lenders, tax offices, driving licence and passport agencies, right-to-work checks and police notices. A shop, he said, is not one of those systems.
When an optional field cannot be left empty, François suggested using the same alternate date across retailers to avoid forgetting it. He said a possible choice is the first day of the birth month. People should also be wary of unexpected callers, even when those callers appear to know personal details.
