How Scammers Get Your Information & What You Can Do to Protect It

You receive an unexpected text from your bank. It alerts you to suspicious activity and asks you to follow a link and verify your identity. The message looks legitimate, you follow the instructions, and a week later you notice charges on your account you don’t remember making.

This isn’t an unusual scenario. Scammers obtain personal information in all sorts of ways, from phishing, malware, and data breaches to public records and social media. Once they have it, they can use it to access your accounts, impersonate you, steal money, or target their next victim. 

Though it’s impossible for this guide to cover every conceivable scenario, we’ll take a look at what information scammers want, how they typically get it, and what you can do to protect yourself.

What Kind of Information Do Scammers Target?

Scammers can use almost any bit of personal information. Some pieces of information are useful on their own, while others become valuable when combined with additional details. In practice, scammers usually aim to collect data from these categories:

• • Basic personal information: Full name, date of birth, home address, phone numbers, and email addresses. Scammers can often use these to get more information about their targets.
  • Government-issued identifiers: Driver’s license, passport, social insurance, or tax identification numbers. Scammers target these identifiers because they’re difficult to change and can be used to open new accounts in your name.
  • Financial details: Credit and debit card numbers, bank accounts, or payment app details. 
  • Login credentials: Usernames and passwords for email accounts, social networks, work platforms, and other online services. Your primary email account is particularly valuable to scammers because it’s often used to recover all your other accounts.
  • Personal context clues: Information that’s often used in security questions, such as previous addresses, names of pets, your mother’s maiden surname, or employment history. Scammers can also use these clues to make impersonation more convincing.

What Scammers Do With Your Information

Broadly speaking, scammers tend to use stolen information for three things: stealing money, gathering more information, or finding their next target: 

• • Purchases and withdrawals: Buying goods, withdrawing cash, or transferring funds using your card or bank account details. Depending on the information stolen, scammers could do a lot of harm before systems flag the activity as suspicious.
  • Account takeover: Logging in to your email or social media to lock you out, impersonate you, compromise your other accounts, or go through your contacts for the next target.
  • Identity theft: Opening accounts, taking out loans, and committing fraud using someone else’s name and legal identity. This can cause serious financial and legal problems for the target.
  • Synthetic identities: Combining real identifying information with falsified details to make believable fake identities that are harder to detect than “simple” identity theft.
  • Selling stolen data: Offering stolen information to other criminals, who might resell it as-is or after aggregating a more complete set of data about the target (also called “fullz”).

Methods Scammers Use to Get Your Information

Phishing

Phishing involves scammers pretending they’re a trustworthy entity to trick you into revealing personal information. This can involve emails or text messages that seem like they’re from a legitimate source, scam phone calls, fake websites, fake login screens, and more.

Phishing remains extremely common. For example, in 2025, the UK Home Office published a report claiming that 90–95% of cybercrime targeting businesses and charities were phishing attacks.¹

Social Engineering

Social engineering involves a broad range of manipulation tactics that target people, rather than their devices or online accounts. Instead of hacking into a network, the scammer convinces their target to provide information.

Some social engineering tactics can be quite simple, such as baiting, which is often a too-good-to-be-true offer that tricks you into installing data-harvesting malware. Scammers can also use a practice called spear phishing, where they tailor phishing attempts to a specific target.

Regardless of the specific tactic used, social engineering works because it exploits the human tendency to be helpful, polite, or deferential to authority. It often requires less technical skill than other tech-focused scamming methods.

Data Breaches

Companies often store large amounts of personal data, including names, emails, passwords, ID numbers, and more. A data breach happens when an organization has a security incident that exposes information about their clients, customers, or employees. Depending on the breach, scammers may later leak the data, share it in criminal communities, or sell it to other scammers.

Even old breaches can be useful. Scammers may combine exposed information with newer data from other sources, while leaked usernames and passwords can be used to try accessing other accounts if you reuse your credentials.

Malware

Many scammers use malware to obtain information from a large number of potential victims. Malware is software designed to infiltrate your device and perform some malicious action. Specifically, malware that collects information from an infected device is often called spyware.

Spyware can collect information that’s already on the system, but it can also monitor the device and record activity. For example, some spyware can take regular screenshots of your screen or log your browser activity. Some forms of malware, called keyloggers, can record every keystroke you make. It lets scammers capture your passwords, account numbers, or any other sensitive information you type in.

Unsecured Networks

Airports, hotels, cafés, and other public places don’t always configure their shared Wi-Fi networks securely. Attackers may try to exploit weaknesses in the network, impersonate legitimate Wi-Fi hotspots, or interfere with unprotected traffic.

However, most sites employ secure connections that should prevent snoops from seeing your online activity, even if they hijack the network router. Still, some sites might have outdated security (for example, using HTTP instead of HTTPS) that puts your information at risk. 

Public Information

Scammers often don’t need to hack anything to find a significant amount of useful information. Many personal details are available for the public: birthdays, addresses, names of family members, employment history, and more. Scammers can find these through public databases, professional networking sites, or corporate directories. The information isn’t secret, and it becomes more useful when combined with other collected information.

Social Networks

Social media can be a huge source of information for scammers, and the details you share voluntarily are often the easiest to find. Posts about birthdays, anniversaries, travel plans, new purchases, or daily routines all reveal some tidbits of personal information. Social media profiles often reveal relationships, interests, location history, or employer information.

Physical Information Theft

Many scammers rely on digital means to steal their targets’ information, so people might overlook the physical hazards. This can go as far as stealing the targets’ devices or mail. Discarded hard drives and smartphones can also contain recoverable data, even if they no longer work. Likewise, hard disks or smartphones that you toss in the garbage can still contain your data, even if the devices are otherwise unusable.

Skimming is another way scammers can physically get your financial information. It involves covertly placing a device on a payment terminal like an ATM to capture your card number, PIN, and other information on the card.

What to Do If Scammers Get Your Information

If you discover that a scammer compromised your information, acting quickly can help limit further damage. Here’s what to do:

• • Notify your financial institutions: Contact your bank and credit card issuers. Explain the situation and ask them to flag your accounts, review transactions, and issue new cards if needed.
  • Change your passwords: Begin with your primary email account, then your bank and other financial accounts, and then other online services. Use a strong, unique password for each account. If you reuse passwords, change them wherever you use them.
  • File a report: Contact the relevant authority, such as the FTC in the US, Report Fraud in the UK, or the Anti-Fraud Centre in Canada.
  • Monitor your bank statements: Review all bank and card statements over the following months and check every unrecognized charge. If your bank allows it, consider setting up transaction alerts.
  • Warn your contacts: Notify your friends, family, or coworkers if someone compromised your account. Warn them not to trust messages, requests, or links from that account.

How to Protect Your Information from Scammers

You can’t prevent every data breach, and you can’t make your information completely invisible. However, you can still adopt a few consistent practices related to security and privacy to reduce your risk:

• • Use a password manager: Generate and store unique, complex passwords for every account. This helps reduce the risk a compromised account poses to other accounts.
  • Enable multi-factor authentication (MFA): Turn on MFA wherever it’s available. Authenticator apps are generally a better choice than SMS verification because SMS-based codes can be more vulnerable to interception.
  • Keep everything up to date: Update your devices, operating systems, programs, and apps regularly. This helps patch out known vulnerabilities that scammers could exploit.
  • Verify the links and sites you visit: Be careful and pay close attention to the possible signs of an unsafe site.
  • Review your social network privacy settings: Limit your account visibility as much as possible. Avoid posting personal details, such as your full birth date, address, phone number, or travel plans.
  • Protect your data on public Wi-Fi: Check that you’re joining the correct network and avoid sites that don’t use HTTPS. Use a VPN to add another layer of privacy by encrypting your traffic between your device and the VPN server.
  • Consider using email aliases: Some services let you create unique email addresses that forward everything to your primary inbox. This helps keep your real email address out of circulation, and it can also make it easier to identify which site or company may have leaked your data.
  • Use an antimalware service: Set up an antivirus to perform regular scans and turn on real-time protection. This helps neutralize spyware and other malware before it can cause serious harm.

Protecting Your Data from Scammers Doesn’t Have to Be Difficult

Scammers don’t always need sophisticated hacking skills to get useful information about you. Sometimes a leaked password, an overshared social media post, or one convincing phishing message is enough to get started. The less information they can collect and connect, the harder you make their job.

While you can’t control every data breach or scam attempt, you can make yourself a much harder target. Strong passwords, MFA, careful sharing, and staying suspicious of unexpected messages can help keep you safer. CyberGhost VPN can add another layer of privacy by encrypting your internet traffic between your device and the VPN server. It can also mask your IP address, which is useful when you’re connecting through public Wi-Fi.

FAQ

References

1. Cyber Security Breaches Survey 2025 — GOV.UK