Imagine a stranger who has never met you knows where you work, who your friends are, what job you're looking for, and where you spent your weekend.
They haven't hacked your phone. They haven't guessed your password. They haven't broken into your accounts.
They simply looked at what you shared online.
Your LinkedIn profile. Your Instagram photos. A comment you left on a public post. Maybe a picture a friend tagged you in months ago.
Now imagine that stranger uses those details to send you a message that feels completely genuine. They know your profession, mention someone you recognise, and offer you an opportunity you've been hoping for.
Before we look at how this happens, take ten minutes to check your own digital footprint. You might discover that you're sharing more information than you realised.
You don't need specialist tools or technical knowledge. All you need is an internet connection and a few minutes to look at your online presence from a stranger's perspective.
Open Google and search for your name. If you have a common name, include your profession or public username.
Look at what appears without signing in to your accounts (use an Incognito / InPrivate browser window).
Review your LinkedIn, Instagram, Facebook and other public profiles.
Look at your biography, old posts, tagged photographs and comments. Check whether your personal and professional information is more connected than you'd like.
Check whether your public posts reveal your regular locations, travel plans, birthday, phone number or personal email address.
You don't need to remove every photograph. Focus on information that you would prefer strangers not to know.
Check the security settings on your important accounts:
If you find an unfamiliar session or connected application, investigate it through the platform's official security settings immediately.
Don't finish the exercise with a list of worries. Make at least three practical improvements.
You could also remove an old connected application or stop sharing live location updates.
Finding personal information online can feel uncomfortable, but don't panic. Discovering exposed information doesn't automatically mean someone has misused it. What matters is taking the right steps.
Delete unnecessary personal details from public profiles, adjust privacy settings, and limit access to older posts. If a website publishes details you want removed, use their removal process.
If you notice an unfamiliar login or suspicious activity, change passwords from a trusted device, turn on MFA, and sign out other sessions.
A public photograph is very different from an exposed password, government ID, or financial record. Address account credentials and financial data first.
Contact the relevant platform. If you suspect identity fraud or financial theft, alert your bank and file a report with official national reporting authorities.
Check your changes: View your profile as a member of the public would. Confirm that the information you intended to hide is no longer visible. You don't need to fix everything in one sitting. Start with the biggest risks and work through the rest over time.
Let's say someone finds your LinkedIn profile.
They can see your name, where you work, your qualifications and the kind of job you do. Perhaps you've also shared a post about looking for a new opportunity.
The person searches for your name on other social media platforms. They find your Instagram account, where you've posted pictures from a recent trip. A public Facebook post shows your birthday celebration, and a friend has tagged you in a photograph at a restaurant.
Nothing seems unusual. These are things people share online every day.
But someone with bad intentions might start connecting the dots.
They now have an idea of your profession, some of your interests, the people you know and the places you visit.
This is one way a technique called Open-Source Intelligence (OSINT) can be misused. OSINT involves collecting and analysing information from publicly available sources. Cybersecurity professionals and blue teams use it for legitimate investigations, threat hunting, and external surface management. But criminals can use the exact same approach to learn about potential victims.
The information may be public. The way it is combined is what makes it useful.
Let's imagine how this reconnaissance timeline could happen in real time:
A quick search might reveal your professional profile, education, employer and other accounts. If you use the same username across several platforms, it may also be easier to connect those accounts. A few accurate details may be enough to make a future message seem believable.
Your public comments, tagged photographs and posts may reveal the names of your friends or colleagues. Now imagine receiving a message from someone you've never spoken to:
You recognise Sarah's name, so you feel more comfortable replying. The problem is that the sender may not know Sarah at all. They might simply have seen her name on your profile. A small detail has made a stranger seem less like a stranger.
People often share photographs from their favourite cafés, gyms, workplaces and holidays. Over time, these posts can reveal more about their routines than they realise. Regularly posting from the same location may give someone an idea of where you spend your time. Sharing holiday updates in real time may reveal that you're away from home. One photograph doesn't tell someone everything about your life. But several public posts can provide useful clues.
Now imagine the scammer notices that you're looking for a job. They know your background, the kind of position you want and perhaps the companies you follow.
They send you a message claiming to be a recruiter. The role sounds perfect. The message mentions your experience, and the company name looks familiar. You're asked to complete an online assessment through a link.
You click it and enter your email address and password on what appears to be a legitimate website. Except it isn't.
This is how publicly available information can help a criminal create a convincing phishing attempt. Instead of sending the same generic message to thousands of people, they can make the message feel personal.
The scammer now puts the details together. You receive a message like this:
It sounds reasonable, particularly if you're actively searching for work. But the sender might be impersonating a recruiter, and the link could lead to a fake login page designed to steal your credentials.
The scammer didn't necessarily need access to your private accounts to make this message convincing. Public information may have given them enough material.
Ten minutes is an illustration, not a guarantee. How much someone can discover depends on what is publicly available and how easily the information can be connected. The important point is that a targeted scam can begin with information you've shared yourself.
Your job title might seem harmless. So might a photograph with your friends or a post about an upcoming holiday.
Individually, these details may present little risk. But when combined, they can help someone build a clearer picture of your life.
Might help a criminal impersonate a colleague or vendor with internal terminology.
Could make a cold, unsolicited message instantly seem familiar and safe.
Provides the perfect pretext for a fraudulent recruiter or fake interviewer to contact you.
The scammer isn't necessarily interested in every detail. They're looking for something that gives them an advantage. Sometimes, that advantage is simply knowing what to say to get your attention.
This is why privacy matters even when you haven't shared anything that seems particularly sensitive.
From a Security Operations Centre (SOC) perspective, this kind of activity connects to several core cybersecurity concepts:
Adversaries search websites and social media to gather intelligence on target personnel and organizational infrastructure.
Adversaries gather victim identity details such as employee names, email addresses, phone numbers, and job roles.
Adversaries send tailored spear-phishing messages with malicious attachments or links targeting the specific individual.
The wider lesson is that cybersecurity isn't only about protecting devices and networks. It's also about understanding how people and information can become part of an attack.
The self-audit is a useful starting point, but protecting your digital footprint is an ongoing process:
Consider whether personal information truly needs to be public, or if it can be shared only with close contacts.
Avoid routinely revealing your live location or daily movements. Post travel pictures after returning home.
A password manager helps create and maintain distinct passwords so one breach cannot unlock everything.
Add another layer of protection to important accounts, ensuring a compromised password alone isn't enough.
Check recruiters, companies, and purported acquaintances independently via official public directories.
Remove unnecessary third-party application permissions and investigate active logins on your accounts.
You don't need to disappear from the internet. The goal is to make deliberate decisions about what you share and reduce opportunities for someone to misuse it.
We often picture cybercriminals using sophisticated tools to break into computers and steal data.
But some attacks begin much earlier, with nothing more than a search engine and a few public profiles.
A scammer might learn that you're looking for a job, discover the name of someone you know and use that information to create a message that feels genuine.
They don't need to know everything about you. They only need enough to make you trust them.
That's why online privacy isn't just about keeping secrets. It's about thinking carefully about what you share, who can see it and how different pieces of information might be used together.
Take ten minutes today to review your digital footprint. If you discover something you don't want to share, take action: change the relevant settings, remove unnecessary details and secure any account that may be at risk.
You might discover very little, or you might find something worth changing. Either way, you'll have a better understanding of what your online presence reveals.
Cyber Insight — Cybersecurity for Everyone. This article uses illustrative scenarios to explain online privacy and social-engineering risks. The amount of information someone can discover varies depending on what is publicly available.
How state-sponsored operators and cybercrime syndicates weaponize recruitment lures.
Have a question or a suggestion? Prepare an email below. Feedback is private and is sent only when you press Send in your email app.
Likes and claps are your personal reactions on this device.
You can also email Poorna directly.
Your feedback stays private. Nothing is sent from this page automatically.