How Data Brokers Compile Profiles That Fuel Scams

Even individuals diligent about online security can find their personal information exposed on data broker sites. These profiles, compiled from public records and commercial data, can be used by scammers to make fraudulent communications more convincing and harder to detect.

Data brokers gather information from sources beyond typical data breaches or phishing attempts. Publicly available records such as property deeds, voter registrations, court filings, marriage and divorce records, bankruptcy filings, and professional licenses are routinely collected. In many U.S. states, these records are accessible to the public, allowing data brokers to acquire them through purchase, scraping, or licensing.

Beyond public records, everyday consumer activities also contribute to these databases. Loyalty program sign-ups, warranty registrations, magazine subscriptions, and contest entries can all feed commercial aggregators. These entities combine this data with public records to create detailed consumer profiles.

This compiled information can be exploited for malicious purposes. In one instance, data broker InfoUSA reportedly sold a list of elderly sweepstakes players to scam artists, who then defrauded victims of over $100 million by posing as government or insurance workers. In another case, two former employees of Epsilon Data Management were sentenced after selling consumer data to a fraudster who used it to defraud over 218,000 victims out of more than $23.7 million.

These incidents highlight how ordinary actions, like entering a sweepstakes or registering a product warranty, can place personal information into a pipeline that ultimately fuels targeted scams. Scammers leverage these details to personalize their attacks, making them more believable and difficult to discern from legitimate communications.

Practicing strong online habits like using strong passwords, password managers, and two-factor authentication helps protect online accounts. However, these measures do not prevent data brokers from collecting and reselling public records. To mitigate this exposure, experts suggest several steps:

Searching one's name on people-search sites to understand what information is publicly available. Replacing easily guessable security answers with fabricated but consistent responses stored in a password manager. Being more selective about sharing personal information during sign-ups for loyalty programs or contests, and using alias email addresses or limiting phone number sharing. Discussing security measures and establishing code words with older relatives who are often targets of such scams. Utilizing data removal services to systematically request the removal of personal information from data broker and people-search sites, recognizing that this often requires ongoing monitoring as data can reappear.