How I Protect My Personal Information Online

Why Personal Information Is Worth More Than People Think

Your personal information is worth more than you'd think, and not just to you. Your name, date of birth, address, and a few answers to "security questions" are often all a scammer needs to open credit in your name or talk their way past a call centre pretending to be you. Companies want it too, sometimes for good reasons and sometimes just to sell you things. I don't think you need to become paranoid about this, but I do think most people hand over far more than they realise, far more often than they need to.

The Information I Never Give Out Without a Reason

There's a short list of details I treat as genuinely sensitive: my date of birth, my home address, my mother's maiden name, and anything that looks like a security question answer. If a website, a caller, or a text message asks for one of these out of nowhere, I stop and ask myself why they actually need it. A genuine bank will never ask you to confirm your full password or PIN over the phone. A genuine competition doesn't need your date of birth to enter you into a prize draw. When in doubt, I give the minimum required and nothing more.

Where Most People Leak Data Without Realising

Most of the damage isn't done by a dramatic hack. It's done a little at a time, through things that feel harmless. A "which Harry Potter character are you" quiz that asks for your birthday. A loyalty card sign-up that wants your full address and phone number. An app that asks for access to your contacts, location, and photos just to let you crop an image. Social media profiles set to public, with a birthday, hometown, and school all sitting there for anyone to piece together. None of these feel dangerous on their own, which is exactly why they work.

The Habits That Actually Protect It

The habits that make the biggest difference are boring, and that's fine by me. I use a password manager so every account has a different, properly random password instead of a variation on the same one. I turn on two factor authentication everywhere it's offered, so a leaked password alone isn't enough to get in. I go through my social media privacy settings every so often and lock down anything that doesn't need to be public. And I've got into the habit of pausing before I fill in a form, just long enough to ask whether this particular website genuinely needs my date of birth to sell me a phone case.

What I Do If My Information Has Already Been Exposed

If you think your details have already been caught up in a data breach, you can check services like Have I Been Pwned to see whether your email address has turned up in a known leak. If it has, change the password on that account and anywhere else you've reused it, and turn on two factor authentication if you haven't already. Keep an eye on your bank statements for anything you don't recognise, and report anything that looks like fraud to Action Fraud. My Safety Toolkit has more on locking things down properly, or you can get in touch and I'll help you work through it.