Social media safety: Protecting your identity

Over the last few years, about one in four people who reached out to the Federal Trade Commission (FTC) to report losing money to fraud said the scheme started on social media. In that same time period, losses to this fraud type reached $2.7 billion.

Here are some of the most common strategies:

• Scammers create a bogus account and try to befriend you, build trust, and convince you to send them money or share sensitive details.
• Bad actors use stolen credentials or other means to hack into your account in order to access your financial or personal information.
• Fraudsters buy ads offering deals that are too good to be true. These ads direct to fake retail sites that take your payment information — but the goods never arrive.

Some people are comfortable sharing a lot of personal details on social media but it’s also important to know that criminals can use your details to create targeted phishing attacks.

The more criminals learn about you, the more they can tailor their approach and highly personalized attacks are more likely to succeed.

For example, if you’ve shared your workplace online — like the more than 234 million people in the U.S. who are on LinkedIn — a bad actor could use that information to their advantage by pretending to be a colleague or supervisor in an attempt to get you to share money or personal information.

Or, if you’ve posted about a particular passion or hobby online, a fraudster could use those details to lure you to a landing page that looks legitimate, but actually installs malware on your computer or captures your payment or personal information.

And, if you communicate regularly with friends on social media, a phisher could mine those public conversations, using the details to convincingly pose as your friend and ask for your log-in information or other sensitive details.

Bad actors may also be monitoring your feed for clues to your password so make sure yours doesn’t include something easy to guess, like your dog’s name or birthdate.

Unfortunately, some criminals use social media before planning a crime in the physical world.

For example, if you’re posting in real-time about your two-week honeymoon abroad, you’re also sharing publicly that you won't be home for some time. Burglars could see your simple trip post as an invitation to stage a break-in.

The same idea also applies to daily life. Posting in real time could reveal your regular schedule or your location at any given time.

If you delay your social media posts or location check-ins by a few hours or even a few days, you’ll also have more time to make sure your posts aren’t revealing more than you intended — like that family photo taken on the front porch that happens to include your house number.

When you’re communicating online, it’s not always easy to confirm that a person is who they say they are.

Online “friends” may actually be fraudsters looking to mine your personal information. One way to reduce this risk is to decline friend requests from people you don’t know in real life.

Still, even close friends and verified public accounts can be hacked.

Additionally, any online request that involves sending payments or sharing personal information should be regarded with suspicion even if it seems to come from a trusted brand, celebrity, or real friend or acquaintance.

Life in the digital age isn’t without danger but that’s no reason not to enjoy the internet.

Consider these guidelines when using social media:

• Decline friend requests from people you don’t know in real life
• Wait a few hours, or even days, before sharing content that reveals your location
• Be thoughtful about sharing personal details online
• Be wary of requests for sensitive details or payment information even if they seem to come from a close friend, celebrity, or major corporation
• Be cautious when clicking links from your social media feed; hover your mouse over shortened URLs to confirm the real destination

As for your own accounts, many social media platforms allow you to set alerts for new sign-ins to your account – this can alert you if someone is trying to log in as you. Follow the platform’s recommendations if that happens, such as adding two-factor authentication (if available), changing your password or contacting their support team.

If you have an identity theft protection plan, you may be able to activate a social media monitoring feature that can alert you to suspicious activity like signs of account takeover and other types of fraud.