Cybersecurity professionals are advising people to avoid entering their date of birth online or to use a fake one, as the information can be weaponised by scammers seeking to steal identities. Jake Moore, an adviser for cybersecurity company ESET, explained that whilst a date of birth alone holds limited value for criminals, when combined with other personal data such as names and phone numbers, it becomes a powerful tool for committing identity fraud.
The risk intensifies when retailers are hacked and stolen data ends up on the dark web. According to Serpil Hall, a security expert from Datos Insights, the typical process involves a retail breach exposing a name, date of birth, email and address. This initial information is then enriched with other leaked data including credentials and phone numbers, alongside publicly available information such as social media profiles and employment details. The result is a detailed identity profile that gives scammers greater confidence when attempting to impersonate victims or convince company help desks that they are the account holder.
Alexandre François, who investigates scams for intelligence company WhoisXML API, surveyed 14 retailers and found that eight of them requested a date of birth during sign-up. He noted that retailers often have little incentive to remove such fields, as the information helps them determine customer age for marketing purposes. However, François stressed that shops only genuinely need payment card details and a delivery address. He advised that people should only provide their real date of birth to organisations that verify it against official records, such as banks, lenders, tax authorities, driving licence agencies and passport services.
Moore recommended using a different birthday on lower-risk websites to reduce exposure, or better still, avoiding any personal fields that are not mandatory. He also suggested using a separate email address for shopping that can be discarded if caught up in a breach. If leaving a birthday field blank is not possible, François suggested using the same date across all retailers, such as the first day of your birth month, to avoid forgetting multiple variations.
For UK savers and borrowers, this means that identity theft risks from data breaches can be reduced by withholding or falsifying dates of birth on retail websites, whilst still maintaining security with financial institutions that require verified personal information.