Why "harmless" posts aren't always harmless

Social media is designed to encourage sharing — and most of the time, sharing is genuinely fine. The problem isn't social media itself; it's that certain types of information, when posted publicly or even semi-publicly, can be combined by scammers and identity thieves to do real damage. This is sometimes called the "aggregation problem": a single post might seem innocuous, but several posts together can paint a detailed picture of who you are, where you live, and how to impersonate you.

The details below are among the most commonly overshared — and the most useful to bad actors. None of this requires you to quit social media. It just means being thoughtful about what you put out there. For context on how exposed information gets used after the fact, see our article on what happens after your information is exposed.

Public vs. private: it's not always obvious

Most social platforms default to sharing more than users expect. A post you think is visible only to friends may actually be accessible to friends-of-friends — or even to anyone on the internet. It's worth periodically reviewing your audience settings on each platform. For a practical walkthrough, see our guide on privacy settings that actually matter.

1

Your full birthdate

Sharing your complete date of birth — day, month, and year — is one of the most common oversharing mistakes. Many financial institutions and government agencies use your birthdate as a primary identity verification point. Combined with your name, which is already visible on most profiles, a complete birthdate gives bad actors a significant head start on impersonating you or accessing accounts in your name. If you want to celebrate your birthday publicly, consider sharing only the month and day, and leaving the year out of your profile entirely.

A full birthdate paired with your name gives scammers a significant head start on impersonating you.

2

Your home address or neighborhood

Posting your street address obviously creates risk, but even casually tagging your neighborhood — or checking in at a local business repeatedly — builds a picture of where you live. Burglars have historically used public social media posts to identify vacant homes. Stalkers can use location patterns to find people. Avoid listing your city and neighborhood in combination with other identifying details, and think carefully before using location tags on posts from near your home.

Repeated location tags near your home can reveal where you live to anyone watching your profile.

3

Vacation plans and travel dates

Posting "heading to Florida for two weeks starting Friday!" is essentially a public announcement that your home will be unoccupied. This type of post has been linked to real-world break-ins. A safer approach is to share vacation photos after you return. You can still enjoy sharing travel memories without broadcasting a window of opportunity to would-be thieves. If you want to update close friends and family in real time, use a private group or direct messages rather than a public or semi-public feed.

Sharing travel dates publicly signals to strangers that your home will be empty and unguarded.

4

Security question answers hiding in plain sight

Many account recovery systems still ask questions like "What street did you grow up on?" or "What was your first pet's name?" The answers to those questions are often scattered across years of social media posts. A nostalgic post about your childhood dog, a throwback photo captioned with the street you grew up on, or a "fun facts about me" thread can unknowingly provide the puzzle pieces someone needs to reset your passwords. Treat the answers to common security questions like passwords — don't share them openly.

Nostalgic posts can unknowingly reveal the answers to your account security questions.

5

Photos of sensitive documents

Photos of passports, driver's licenses, boarding passes, insurance cards, or even partially visible mail are regularly shared on social media without much thought. Boarding pass barcodes, for example, encode personal information that can be read with a free scanner app. Insurance card photos reveal your policy and member ID numbers. Even a photo taken in your car that accidentally includes your license plate in the background can be used to look up additional personal details in some states. Crop or blur any document details before posting images.

A boarding pass barcode contains personal data readable by anyone with a free scanner app.

6

Your phone number or email address

Posting your phone number publicly — even temporarily, such as when coordinating an event or selling something — opens you up to spam, phishing calls, and SIM-swapping attacks. SIM swapping is a technique where a fraudster convinces a mobile carrier to transfer your phone number to a device they control, potentially bypassing two-factor authentication on your accounts. Your email address similarly becomes a target for phishing attempts if it's widely visible. Use platform messaging features or temporary contact methods when coordination is needed.

A publicly listed phone number is all a SIM-swapping fraudster may need to hijack your accounts.

7

Hints about your financial situation

Posts that reveal financial details — whether you've just received a large tax refund, bought a new car outright, or are struggling to pay bills — can attract the wrong attention. Signals of wealth invite targeted scams and theft. Signals of financial stress can attract predatory loan or "investment opportunity" schemes. Neither extreme serves you well when broadcast to a wide audience. Keep discussions about your financial situation to trusted conversations rather than public posts.

Financial hints — whether wealth or hardship — can make you a target for scammers and predatory schemes.

Small habits that make a real difference

Protecting yourself online doesn't require technical skills — it mostly comes down to pausing before you post. Ask yourself: could this detail help someone find me, impersonate me, or access my accounts? If the answer is yes, save it for a private conversation.

Do a quick personal information audit

Search your own name on a few social platforms and look at your profile as a stranger would. Note anything that reveals your location, routine, birthdate, or document details. You may be surprised what's visible when you step outside your own perspective. Our Digital Safety Audit checklist can guide you through a more thorough review.

For a broader look at the routines that reduce your digital risk without requiring any expertise, see the habits that keep most people's accounts safe online. If you're helping an older family member navigate these risks, our guide on online safety for older adults covers the tactics most commonly used to target that group.