Security experts urge shoppers to stop giving real birth dates to online retailers

Cybersecurity professionals are advising people to think twice before typing their real date of birth into online sign-up forms, according to a report in The Guardian. The concern is that birth dates stored by retailers, newsletters, competitions and loyalty schemes can leak in data breaches and then help criminals impersonate victims or win their trust.

How a birth date becomes useful to fraudsters

On its own, a date of birth is of limited value. The risk comes from combining it with other leaked details such as names, phone numbers, email and home addresses. Experts quoted in the report describe how criminals piece together data from several breaches and public sources, including social media profiles, to create a fuller picture of a person. That profile can then be used to make phishing emails look genuine, to fool company help desks, or to stage calls that appear to come from a bank. Such misuse may happen long after the original breach.

The report notes that customers' birth dates were among the information taken in a recent hack of the online retailer Asos. One researcher found that eight of 14 retailers he examined requested a date of birth at sign-up, and suggested shops have reasons to keep asking, since knowing a customer's age helps with marketing.

What the experts recommend

• Leave optional personal fields, including birthday, blank wherever possible.
• Where a date is required on low-risk sites, use a consistent made-up one, such as the first day of the birth month, so it is easy to remember.
• Consider a separate email address for online shopping that can be abandoned if it is caught up in a breach.
• Treat unexpected contact with suspicion, even when the caller already knows personal details.

Real details, the experts say, are only needed where they are checked against official records, such as with banks and lenders, tax authorities, passport and driving licence agencies, or right-to-work checks. Shops generally need only payment details and a delivery address, although age verification may apply to restricted items. One investigator summed it up plainly: "A shop is not one of them."

What it means for internet users

For anyone who regularly creates accounts on websites and apps, the advice is a reminder that data minimisation is a practical security habit. Every extra detail stored by a service is another item that can be exposed in a breach. Reviewing which fields on a registration form are truly mandatory, and keeping shopping accounts separate from more sensitive ones, can reduce the material available to anyone trying to assemble a stolen identity.