You met him Saturday at a friend’s backyard barbecue. He seemed like a friendly guy. You talked for about twenty minutes about work, weekend plans, and the Lisbon trip you just got back from.
He never got your last name… He didn’t need it.
Sunday, he scrolls through your friend’s party photos. You’re tagged in a few of them. One tap, and he has your full name and your Facebook and Instagram accounts. Your Facebook profile still lists your high school. Your LinkedIn profile tells him where you work. A free people-search site hands over your home address, your age, and a list of your relatives, including your mom. Your Instagram handle, the same one you’ve used since college, leads him to an old car forum where you once bragged about your first car. And a public post from last week shows you tagging an airline in an all-caps rant about a three-hour delay on the way home.
All of this information was gathered in 15 minutes. No hacking. No passwords. Just a search bar.
Now swap him for an ex-lover who never quite moved on or the creepy coworker who sits silently in meetings with you. Same search. Same results.
He was just curious. Yes, creepy, but curious. The next person who searches your name might be more than creepily curious.
How a Stranger Can Find You Online in Under 15 Minutes
Security pros have a name for this. It’s called open-source intelligence, or OSINT (because we all love acronyms). In plain English, it means building a profile of someone using nothing but public information. Investigators use it to track down criminals. Criminals run the same playbook on you. This isn’t science fiction or something uncommon. At the 2018 RSA Conference, a cyber-risk manager named Zee Abdelnabi picked a random Midwestern man and, using only public sources, pieced together his birthday, his kids’ names and ages, his high school, his car, and even his Fitbit sleep data. After less than an hour of searching, she had everything she needed to impersonate him online.
Criminals do it because it pays. In 2025, nearly 30% of people who reported losing money to a scam told the FTC it started on social media. Reported losses hit $2.1 billion, up eightfold since 2020. That’s roughly $240,000 an hour, every hour of the year. The FTC says scammers “often tailored their pitch based on people’s profiles,” then invented a crisis or steered people toward fake investment platforms. That last move by scammers using this information is pig-butchering scams, but it’s been used by romance scammers for years.
What Can a Scammer Actually Do With That?
Every detail they find is a way in. Here are some examples of how scammers use the information they find:
Scenario A: The Airline “Rescue”
Remember that all-caps rant about the airline on social media? Scammers hunt for posts exactly like it. The FTC warns that they “crawl social media looking for posts from upset travelers,” then reply from fake support accounts wearing the airline’s logo. The reply is fast and sympathetic: So sorry about the delay! Send us your confirmation number and we’ll get you rebooked. You’re tired, annoyed, and you just want to get home. That’s exactly when your guard drops. One reply hands them your booking. One click on their “rebooking” link hands them your login or your bank details. It’s still phishing. It just moved out of your inbox and into your replies.
Scenario B: The Call Your Mom Gets
Your mom’s phone rings. It’s your voice, shaky and panicked. There’s been a car accident. You need money right now. Sounds far-fetched until you see how little it takes. In a 2023 60 Minutes demonstration, ethical hacker Rachel Tobac found a staffer’s cell number on a business networking site. She cloned correspondent Sharyn Alfonsi’s voice from TV clips in about five minutes, spoofed the caller ID so the call appeared to come from Alfonsi, and dialed. The staffer started reading off Alfonsi’s passport number.
You’re not on TV. But if you’ve posted a video with your voice in it, you’ve handed over a sample. The FBI warns that criminals use AI-generated audio clips of a loved one’s voice “to impersonate a close relative in a crisis situation.” Everything else is already public: your mom’s name, your travel plans, who you’d call for help. More on how these calls work in Scammers Are Calling Grandma and Grandpa, and how your photos feed AI impersonation in Protecting Your Identity from AI.
Scenario C: The Password Reset
Think about the security questions your bank asks when someone calls claiming to be you:
- What high school did you attend? It’s on your Facebook profile.
- What was your first car? It may be on a forum or a quiz you completed.
- What is your mother’s maiden name? Her people-search listing may show it right there, filed under “also known as.”
Some answers don’t even take research. Google found that one guess at “What is your favorite food?” was right for nearly 1 in 5 English speakers. (It was pizza.) Viral trends fill in the blanks too. The AI caricature craze handed scammers a perfect script, pet names and hobbies included. When the answers are public, the questions protect no one.
“Yeah, But I Barely Post Anything”
Good. Posting less is smart, and we’ve covered how oversharing feeds sharper scams. But it won’t save you on its own. Look at how the guy from the barbecue found you. He found you through your friend’s photos, not yours. Your digital footprint grows whether you post or not. Data brokers collect property records, voter registrations, phone numbers, and family connections, then package them into profiles on people-search sites where anyone can look you up, often for free. You never posted your address. The county did when you bought your house, and scammers use those same records to forge deeds and steal homes. Other data companies even know how much money you make. If you’ve bought your home in the last few years, the listing photos are probably still online, floor plan and all, and criminals use them to case your home.
You can’t stop your friends and family from tagging you in group photos, posting your pictures from events, and checking you in or tagging your location on social media. Unfortunately, your privacy settings don’t reach their accounts.
How to Fight Back and Shrink Your Digital Footprint
You don’t have to disappear from the internet. You just have to be harder to find and piece together than the next person.
Search Yourself First
- Search your full name in quotes, plus your city, employer, or school. Then search your emails and old usernames.
- Turn on Google’s free “Results about you” tool. It flags search results showing your phone number, address, email, or even your Social Security number, and lets you request removal.
- Incogni also offers a free scanning tool to see what personal information may be out there.
Get Off the People-Search Sites
- Opt out of the big ones: Whitepages, Spokeo, Radaris, and FastPeopleSearch.
- Want it on autopilot? Services like Incogni and DeleteMe keep filing removal requests for you. Our privacy opt-out tools roundup covers more options.
- Live in California? The state’s free DROP tool sends one deletion request to every registered data broker, and they have to recheck for new data every 45 days.
Break the Links Between Your Accounts
- Use separate emails and usernames for banking, for friends and family, and for shopping and forums.
- Give every account its own password with a password manager. Tips on Managing Passwords Securely shows you how.
- Turn on multi-factor authentication, the extra code or prompt on your phone, for your email, bank, and phone carrier.
- Lie on security questions, and make the lies random, since people who invent answers tend to pick the same fake ones. Store them in your password manager.
- Agree on a family code word. The FBI recommends one, and a cloned voice won’t know it.
Post Later, Share Less
- Set personal profiles to private and remove followers you don’t actually know.
- Share vacation photos after you’re home. More travel habits that keep you safe: How to Outsmart Thieves and Pickpockets.
- Airline trouble? Use the airline’s official app or website, never an account that showed up in your replies. The same rule stops most impersonation scams.
- Log in to accounts you abandoned years ago, delete what’s there, and close them.
Frequently Asked Questions about Protecting Your Personal Information
What can a stranger find out about you online?
More than most people expect. A stranger can usually find your home address, age, phone number, relatives, employer, and schools online for free, plus old accounts tied to usernames you’ve reused. Add your public posts, and they can learn your travel plans, your family’s names, and the details scammers use to sound legitimate.
What is OSINT?
OSINT stands for open-source intelligence: collecting and connecting information from public sources like search engines, social media, public records, and people-search sites. Investigators use it to track criminals and threats. Scammers use the same techniques to research their targets.
Can scammers clone my voice from social media videos?
Yes. Voice-cloning apps can copy a voice from recorded clips, and the FBI warns that criminals use cloned audio to impersonate relatives in a crisis. Keep public videos with your voice to a minimum, agree on a family code word, and learn the warning signs in our guide to spotting an AI deepfake.
Take 15 Minutes and Delete Your Personal Data
Tonight, set a 15-minute timer and search yourself the way the guy from the barbecue did. Anything you can find about yourself online, a stranger can find too. So start erasing it with our step-by-step guide: Delete Your Personal Data from the Internet for Free.
