When online retail customers receive a phone call about suspicious account activity, scammers often read out a name, address, and date of birth to convince victims they are speaking with a legitimate bank representative. Cybersecurity professionals warn that these dates of birth are frequently harvested from online retail sign-up forms, loyalty schemes, newsletters, and online competitions.
Retailer Data Collection and the Asos Security Breach
Customer dates of birth were among the personal details stolen during a cyberattack on online retailer Asos. Alexandre François, who investigates scams for the intelligence company WhoisXML API, surveyed 14 retailers and found that eight of them required a date of birth during the account creation process. François stated that retailers have little incentive to remove this data field because the full date gives them the customer’s age, which is useful for marketing and targeting.
Cybersecurity advisers point out that while a date of birth alone is not particularly valuable to criminals, it becomes a powerful tool when paired with other breached records. Jake Moore, an adviser for the cybersecurity company ESET, explained that information gathered during hacks can be sold on and used by scammers to either trick victims into trusting them or directly impersonate them.
How Scammers Weaponize Enriched Identity Profiles
When a retailer experiences a data breach, the leaked information typically includes names, dates of birth, email addresses, and physical locations. Serpil Hall, a security expert from Datos Insights, detailed how criminals build comprehensive records over time by combining retail leaks with credentials and phone numbers from separate breaches.
Fraudsters supplement these datasets with public information gathered from social profiles, employment details, and relatives. Hall noted that this process creates an enriched identity profile, giving scammers greater confidence when matching records, crafting authentic-looking phishing emails, or tricking company help desks into granting unauthorized account access.
Protecting Personal Information Against Jigsaw Scams
Security experts advise consumers to limit their digital exposure by refusing to fill out non-mandatory fields on retail websites. Jake Moore suggests entering a fake birthday on low-risk websites or leaving the field entirely blank if the platform permits. Alexandre François noted that shops only need your payment card details and a delivery address, except when verifying age for restricted items such as knives.
For accounts where a date of birth is mandatory and cannot be left blank, François recommends using the same date across all retailers, possibly the first day of your birth month, to prevent memory lapses. Experts also recommend maintaining a separate email address specifically for online shopping, allowing consumers to easily abandon an inbox if it becomes compromised in a retail data breach.
Frequently Asked Questions
Why do online retailers ask for a date of birth during sign-up?
Retailers collect dates of birth because the full date gives them the customer’s age, which is useful for marketing and targeting. Alexandre François of WhoisXML API noted that companies may have little incentive to remove this data field.
Which organizations actually need a real date of birth?
A real date of birth is used where it is checked against official records and used to prove who you are. Alexandre François stated that this includes banks or any lender, the tax office, the driving licence and passport agencies, right-to-work checks, and a police notice.
How does a retail hack turn into a targeted phone scam?
Hackers combine retail breach data—such as names, dates of birth, email and address—with other leaked data and public information. Serpil Hall of Datos Insights explained that this results in an enriched identity profile that scammers use to sound authentic when contacting victims.
Worth a look