Where can criminals get my data?

Fraudsters can hunt down or buy your personal data to hack into your accounts, which could lead to them draining your bank accounts, stealing your identity or worse.

We've rounded up some of the more common places fraudsters can get access to your personal information, and how you can better protect it.

Top 10 tips to protect your personal data

  1. Set strong passwords for all your online accounts. Read how to create and store strong, unique passwords for tips and advice.
  2. Change your passwords regularly - especially if your email address has been part of a data breach. You can check whether it has at haveibeenpwned.com.
  3. Delve into your social media settings and ensure that fraudster-friendly personal details such as your birthday, middle name and contact details aren’t visible to the public. See our guide to secure what you share with others and advertisers.
  4. Don't send sensitive information in emails or online messages. If your account is hacked, all this information is available to criminals.
  5. Cleanse your online history - think back to all the old social media accounts you might have created, like MySpace, and delete them to stop inadvertently sharing more information about yourself.
  6. Opt out of the open electoral roll, make your landline telephone number ex-directory and ask to be deleted from online directories.
  7. Keep software up to date - this includes your computer, mobile phone and apps, as this will reduce any new security vulnerabilities.
  8. Your mother’s maiden name is a matter of public record. If asked to use it for a security question, make up a fake decoy answer (providing you can remember it).
  9. You can also make up the answers to other security questions - you’re not under oath to answer them truthfully!
  10. Tear-up or shred any documents that contain personal information before binning it.

The dark and surface web

The dark web is hidden and the surface web is what’s readily available to the general public - and both are places for criminals can get hold of your personal data.

Getting hold of someone's data on the dark web is more expensive but it means criminals can buy and sell it anonymously. 

There, criminals can buy profiles which contain information like a name, date of birth, banking details, security questions and answers.

The profiles can be copied and pasted multiple times in different forums on both the dark and surface web.

Public social media profiles

If your privacy settings aren’t set to private, criminals can glean a wealth of information from your profiles just by scouring them.

An easy way to give criminals an insight into your life is by sharing too much on social media without making sure your profile is set to private.

It’s wise to review your privacy settings - you can use our free guide to lock down the personal information you share on Facebook - as well as scanning through your friends list and deleting anyone you don’t know.

Data breaches

As well as using a data breach to get access to your accounts, criminals can use the publicity around a prolific data breach to make their scam approaches to appear more credible.

They can do this through messages, emails, phone calls or other forms of communication to scare people into sharing their data.

They can do this by sending a message from what appears to be a credible source, such as a bank, and telling someone to check if their data was breached by clicking a link.

If you do become aware that your personal data has been lost in a data breach you should change your password immediately, and keep an eye on your credit report.

Follow our step-by-step guide if your personal information is lost following a data breach.

Please tell us what you think of the Which? Consumer Rights website.

Your feedback is vital in helping us improve this site. All data will be treated confidentially. This survey will take approximately 5 minutes to complete.

Please take our survey so we can improve our website for you and others like you.