Oversharing online: How criminals use public information against you

In the age of social media, sharing moments from our personal and professional lives has become second nature. From vacation photos and family celebrations to career updates and daily activities, people routinely post information online without considering who else may be watching. While social media helps us stay connected, it also provides a valuable source of intelligence for criminals seeking to exploit unsuspecting individuals.

Unlike traditional cyberattacks that rely on technical vulnerabilities, many modern attacks begin with information that people willingly share online. Criminals carefully review public profiles on platforms such as Facebook, Instagram, LinkedIn, X, and TikTok to gather personal details. Information such as family relationships, workplaces, hobbies, birthdays, and travel plans can help attackers build a detailed profile of a target.

One of the most common threats is social engineering. Criminals use publicly available information to create convincing messages that appear trustworthy. For example, if someone frequently posts about their employer, an attacker may impersonate a colleague or company representative. Because the message references real information, the victim is more likely to respond, click a malicious link, or disclose sensitive information.

Public figures, business leaders, and professionals are particularly attractive targets. Their online presence often reveals organisational roles, business connections, and event participation. Attackers can use this information to launch targeted phishing campaigns, impersonate executives, or conduct business email compromise (BEC) attacks. A single post about attending a conference or meeting with industry partners can provide valuable context for a highly tailored scam.

Location sharing is another significant risk. Posting real-time updates from airports, hotels, restaurants, or events can reveal where someone is and, more importantly, where they are not. Criminals may use this information to identify opportunities for theft, fraud, or stalking. Even photos can unintentionally disclose location details through visible landmarks, badges, or geotags.

Oversharing can also contribute to identity theft. Many people unknowingly reveal information commonly used in security questions, such as pet names, schools attended, family members, or birthdays. When combined with information obtained from data breaches or other public sources, these details can help criminals gain unauthorized access to accounts and services.

The growing use of artificial intelligence has increased the risk further. Publicly available photos, videos, and voice recordings can be used to create convincing deepfakes or impersonation attempts. Criminals may use this content to deceive friends, family members, colleagues, or customers into believing a fraudulent request is legitimate.

Protecting yourself begins with being mindful about what you share. Review privacy settings regularly, limit the visibility of personal information, and avoid posting sensitive details such as travel plans, home addresses, financial information, or security-related answers. Consider whether a post could provide useful information to someone with malicious intent before publishing it.

Social media is a powerful communication tool, but every post contributes to a digital footprint. Criminals increasingly rely on publicly available information to plan attacks, commit fraud, and manipulate victims. By sharing responsibly and maintaining strong privacy practices, individuals can enjoy the benefits of social media while reducing the risk of becoming a target.

Anoop Paudval is Head of Information Security Governance, Risk, and Compliance (GRC) for Gulf News.