Security researchers are raising concerns about the widespread practice of collecting dates of birth during online transactions, citing the vulnerability this creates when such information is compromised in data breaches.
According to cybersecurity professionals, dates of birth become particularly risky when combined with other personal details stolen during security incidents. Jake Moore of the cybersecurity firm ESET notes that while a date of birth alone holds limited value to criminals, it becomes a potent tool when paired with names, phone numbers, and other identifying information. This combination allows fraudsters to construct convincing profiles for impersonation schemes or to pose as legitimate institutions during social engineering attacks.
A recent investigation found that retailers frequently request dates of birth during account registration processes, with eight of 14 surveyed retailers including this field. The motivation for collecting such data is primarily commercial—businesses use the information for age verification, customer profiling, and targeted marketing. However, this practice creates vulnerability when retailers experience security breaches. Serpil Hall, a security expert, explains that hackers systematically compile stolen data from multiple sources, layering retail breach information with credentials from other leaks and publicly available details to construct detailed fraudulent profiles.
Experts recommend that consumers exercise caution when providing personal information online. Rather than entering accurate dates of birth on non-essential websites, users can employ fake dates or leave fields blank where permitted. Alexandre François suggests that dates of birth are only necessary when dealing with entities that verify information against official records, such as banks, tax agencies, and government licensing bodies. For retail transactions, he notes that payment card details and delivery addresses are typically the only information merchants genuinely require. Consumers are advised to use separate email addresses for shopping accounts and to be skeptical of unsolicited contact, even when the caller appears to possess legitimate personal information.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI