Locking Down Your Social Media Footprint
Attackers use your public profile to build convincing scams and guess security answers. A privacy pass takes less time than you'd think.
Social media profiles are more than a privacy concern in the abstract — they're a direct input into targeted scams. Attackers researching a target for a phishing attempt, a fake "friend in trouble" scam, or a password-reset security question routinely start with a public profile, because people volunteer an enormous amount of exploitable detail there without thinking of it as a security risk.
Audit what's actually public
Most platforms let you view your own profile as a stranger would see it. Do this on each platform you use, and look specifically for:
- Your full birth date (a common identity-verification data point for banks and other services)
- Your hometown, current city, or daily routine details (school pickup time, gym schedule)
- Family member names, especially a mother's maiden name or similar detail sometimes used as a security question
- Answers to common security questions hiding in casual posts — first pet, first car, favorite teacher
Tighten the defaults
Set your posts, friends list, and "About" details to be visible only to people you've actually connected with, not the public internet. Review your list of connections periodically and remove ones you don't actually know — a fake profile pretending to be an old acquaintance is a common way attackers gain access to your friends-only content.
Rethink location tagging
Tagging your real-time location broadcasts where you are and, by extension, where you aren't — including that your home may be empty. When you want to share a location, consider posting after you've left rather than while you're still there.
Watch for quiz and "get to know me" posts
The viral "fill in these 20 facts about yourself" posts are, structurally, identical to a list of common security questions. They're fun, but they're also a low-effort way to hand an attacker exactly the details needed to answer "what was your first car" on a password recovery flow.
Separate your security answers from reality
Where a site requires security questions, treat the answer field like a second password rather than a factual question — store a made-up, unrelated answer in your password manager instead of your real first pet's name. That way, no amount of social media research helps an attacker guess it.
None of this requires disappearing from social media. It just means treating your profile as a source an attacker could realistically use, and closing the gaps that provide them the most value.
Found this useful?
Share it with someone who could use the reminder — most breaches are prevented by habits, not luck.