What Can Scammers Actually Find About You Online?

It's worth walking through this from the other direction for once — not "how do I protect myself" but "what does someone trying to scam me actually do first." Understanding the process demystifies it, and makes the eventual protective steps make a lot more sense.

Step 1: A cheap starting point

Scammers rarely start with sophisticated tools. They usually start with a phone number obtained cheaply — bought in bulk from a data broker, scraped from a leaked database, or simply dialed at random as part of a mass campaign. At this stage, they know almost nothing specific about you.

Step 2: Quick, free lookups

A basic Truecaller or Google search on the number often returns a name. This alone is enough to make a cold call sound personalized — "Hi, is this [name]?" — which dramatically increases how convincing the call feels, even though the scammer has done almost no real work at this point.

Step 3: Cross-referencing with breach data

If the same number or an associated email shows up in a leaked database from an unrelated breach — a delivery app, an old forum, anything — the scammer may be able to pull additional fragments: a city, a partial order history, an employer, sometimes a rough address. None of these individually seem dangerous, but combined, they start to sound like inside knowledge.

Step 4: Social media scan

A quick look at public social profiles fills in more blanks — where you work, your city, sometimes even recent life events (a new job, a purchase, a trip) that a scammer can reference to sound current and legitimate rather than generic.

Step 5: The pitch is built around what they found

This is where the fragments become useful. A scammer who knows your name, your bank, and roughly your city can open a call sounding like they're from your actual bank's fraud department, referencing "unusual activity on your account ending in [partial number]" — details vague enough to not require real account access, but specific enough to sound convincing under pressure.

What this process reveals about actual risk

The unsettling part isn't that scammers have sophisticated access to your accounts — usually, they don't. It's that a surprisingly small amount of publicly available or leaked fragmentary data is enough to construct a convincing-sounding pitch. The defense isn't really about hiding everything; it's about reducing how many fragments are floating around for someone to piece together, and staying skeptical of calls that reference "real" details, since those details are cheaper to obtain than most people assume.

Where to focus your defense

• Reduce publicly listed information — opt out of caller ID databases, tighten social media visibility, remove your number from old public listings.
• Assume any single detail a caller states could be from a leak, not real access — verify independently by calling your bank back on their official number rather than trusting the incoming call.
• Check your own exposure so you know roughly what fragments are actually out there, rather than being caught off guard when a scammer references something accurate.

This is the exact gap Scan My Shadow addresses — checking your phone number and email across 1,500+ sources so you can see what a scammer piecing together a profile on you would actually find.

Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.