Tell us what data you had leaked and we’ll show how a scammer can ruin your life

OK, no worries. I’m sure I can reverse engineer that from some of your other details.

That makes my life a little harder. Date of birth won’t get me much by itself but it’s commonly used by companies like banks and telecommunication companies as part of the verification process.

Geez, that’s a shame (for you). Addresses are another piece of information that’s commonly used to verify someone’s identity.

But perhaps more importantly, knowing your address presents a physical risk. I can now send you mail or intercept it. I could even turn up at your house or direct others to do so.

And while it’s possible to move to change your address, it’s a real pain.

Lucky! Addresses are another piece of information commonly used to verify someone’s identity.

But perhaps more importantly, knowing your address presents a physical risk. If I had it, I could send you mail or intercept it. I could even turn up at your house or direct others to do so.

And while it’s possible to move to change your address, it’s a real pain.

It’s pretty common to give out your email so this isn’t a huge threat by itself.

I can send some spam or scam attempts your way, but most email providers are pretty good at picking these up. Still, maybe I can use the address to phish my way into more of your information.

Your email is also your username for a lot of websites. Usually, I can put your email in to know whether you use a service. But the really important stuff is inside your email, which brings me to…

It’s pretty common to give out your email so I could probably figure this out another way if I wanted to.

Once I’ve got your email I can send some spam or scam attempts your way, although most email providers are pretty good at picking these up. Still, maybe I can use the address to phish my way into more of your information.

Your email is also your username for a lot of websites. Usually, I can put your email in to know whether you use a service. But the really important stuff is inside your email, which brings me to…

Well now I can do a lot of things.

First, I’ve got access to your private information (private conversations, business secrets, nudes) that I could use to extort you. Did you ever email a password for another service or other personally identifying information (like a picture of your passport) to yourself? I’ll find it.

Then I can use your email to access other accounts by resetting their passwords — like a shopping spree paid for by you!

That’s good because if I had your email password, I could do a lot of things.

First, I would have access to your private information (private conversations, business secrets, nudes) that I could use to extort you. Did you ever email a password for another service or other personally identifying information (like a picture of your passport) to yourself? I’ll find it.

Then I could use your email to access other accounts by resetting their passwords — like a shopping spree paid for by you!

Nicely done! 2FA is usually standard now, and will stop all but the most dedicated bad actors. 

That’s a bit of an own goal. 2FA is usually standard now, and will stop all but the most dedicated bad actors. If you don’t have it turned on, you should do it pronto.

Obviously, I can use it to contact you directly. I can harass you, spam and scam you via call or text.

Additionally, phone numbers have emerged as an important method of identity verification through 2FA. If I can figure out a way to take control of that phone number — a practice known as ‘simjacking’ or ‘sim swapping’ — I can pretty much take over your life. Many of the organisations and platforms that control important and valuable information (banks, myGov) rely on being able to use your phone number to verify your identity. Thankfully, recent changes have made this much harder but it all starts with your phone number.

It’s a no brainer. I’m going to spend your cold, hard cash. Despite being immediately impactful and often expensive, having your card details leaked is actually one of the easiest problems to fix by simply cancelling it.

You dodged a bullet. Beyond being 25 points of identification, I’ve been told that a Medicare card (along with some other basic personal information that I’ve also pilfered) will grant me access to your MyHealthRecord and can even help deanonymise your medical data that’s in a public dataset.

In short, I could get my mitts on a lot of your highly sensitive health information.

These are the ones that can really hurt. Depending on whether I get the numbers, expiration dates, or even a photo of these, it is extremely easy for me to commit large amounts of identity fraud with somewhere between 40-70 points of identification.

I can apply for credit cards, take out loans or join buy-now-pay-later services on your behalf. I can use government services. And If I’m feeling particularly frisky, I can create replica copies of your passport or driver’s licence to commit crimes or maybe even cross borders.

It’s usually possible to get these cancelled and replaced, but it’s not cheap. So best to take care with these crucial documents.

That’s for the best because these are the ones that can really hurt.

Depending on whether I get the numbers, expiration dates, or even a photo of these, it is extremely easy for me to commit large amounts of identity fraud with somewhere between 40-70 points of identification.

I can apply for credit cards, take out loans or join buy-now-pay-later services on your behalf. I can use government services. And If I’m feeling particularly frisky, I can create replica copies of your passport or driver’s licence to commit crimes or maybe even cross borders.

It’s usually possible to get these cancelled and replaced, but it’s not cheap. So best to take care with these crucial documents.