Fraudsters are always on the lookout for small pieces of information about you that they can stitch together to create an identity to scam. Your full name, date of birth, home address, phone number, email, and Social Security Number fragments are the building blocks of identity theft. Even something as innocuous as the name of your pet or your mother’s maiden name can be enough to crack your passwords or answer security questions.

What to do instead: Keep your “About” section minimal. Use a nickname or first name only. Remove your birth year from public view. Never post photos of documents that contain your address, ID number, or financial information. Consider removing your name from websites that share your personal information obtained from public records.

It might sound harmless to post that you are excited about an upcoming holiday or to check in at the airport. But it could signify to someone monitoring your account that your property will be left unattended during that time. Burglars routinely scan social media for vacation announcements. A 2019 UK study found that 78% of burglars use social media to target properties.

What to do instead: Share vacation photos after you return home. Disable location tagging on all posts. Turn off “Check In” features. If you must share in real time, use private stories or close friends lists. Posting photos from the trip you are currently on could alert criminals that you are currently out of town—wait until you are back.

Some parents love sharing photos of their kids. But are your children old enough to provide consent? They may not appreciate pictures of them as naked babies or drooling toddlers plastered all over the internet by the time they are old enough to tell you to stop. Beyond embarrassment, there are more sinister risks: predators scrape the web for images of children, and parents disclosing children’s full names, birthdates, schools, and physical descriptions create profiles usable to open credit accounts in minors’ names.

What to do instead: Ask your children before posting photos of them—regardless of their age. Avoid posting school names, team uniforms with school logos, or routine schedules. Use private family albums instead of public posts. Never post images of anyone else’s children without explicit parental consent.

Posting pictures of some expensive jewellery, or a flashy new car, could provoke envy among your friends. But if there is anyone monitoring your account with darker schemes in mind, it might mark you out as a potential target for mugging or burglary. Even a blurry photo of a credit card can be enough for fraudsters to extract the number, expiration date, and CVV using image enhancement tools.

What to do instead: Celebrate your wins privately. If you want to share a new purchase, do so without showing price tags, receipts, or the item in a context that reveals your home address. Never post photos of checks, credit cards, bank statements, or investment portfolios. Never share any identification: Social security numbers, driver’s licenses, bank account numbers, passport numbers, or any other unique identification numbers.

What is worse than having an expensive item of jewellery stolen? Losing a job perhaps? That is why it is important to stay schtum about any controversial work-related goings on. If HR or even a disgruntled colleague finds you have been complaining about your workplace, co-workers, or boss, it could land you in trouble. Beyond personal risk, if an employee posts about a new product or project—even in the background of an awards ceremony photograph—it could reveal sensitive information that competitors can exploit.

What to do instead: Vent offline with trusted friends or colleagues. Never post about internal conflicts, layoffs, mergers, or confidential projects. Review your LinkedIn for sensitive details like security clearances or proprietary technologies. Remember: screenshots are forever, and “private” groups are not truly private.

This is the most insidious risk because it hides in plain sight. Seemingly harmless personal details often double as security questions. Childhood schools, first pets, street names, and full birth dates are classic prompts banks and email providers use to verify you. A throwback Thursday post about your first car, a birthday celebration photo, or a nostalgic note about your childhood home is not just sharing memories—it is handing attackers the keys to your accounts.

What to do instead: Treat every personal detail as a potential security question answer. Avoid posting about your first pet, childhood street, mother’s maiden name, high school mascot, or favorite teacher. When setting up security questions, lie—use answers that have no connection to your real life and store them in your password manager.

Social media is by its nature a public forum, even if your account is relatively locked down. That is why it is not the place to be sharing privileged information. Posting screenshots of private conversations, DMs, or text exchanges without consent is a violation of trust and, in some jurisdictions, a legal offense. Sharing someone else’s pregnancy announcement, job loss, or relationship status before they do can cause real harm to friendships and family bonds.

What to do instead: Adopt a simple rule: if it is not your news, do not share it. If someone confides in you, assume it stays between you unless they explicitly say otherwise. Screenshots of conversations should never be posted without the consent of all parties. When in doubt, ask.

Close up selfies, “fun” filters, videos, and voice notes all contribute to your biometric footprint. They capture your face from multiple angles and your natural speaking voice. This material can be reused in deepfakes or voice cloning scams—for example, a fake video of you endorsing a product, or a phone call that sounds like you asking a colleague or family member to send money. In 2026, just three seconds of audio is enough to create a convincing voice clone.

What to do instead: Be selective about the facial photos and videos you post publicly. Avoid posting high-resolution, front-facing portraits that show your face clearly from multiple angles. Be cautious with voice notes on public platforms. Consider whether a potential deepfake attacker could use your content to impersonate you. The more biometric data you share, the larger your attack surface becomes.

Social media sites are awash with prize draws and free giveaways. Often they are poorly disguised attempts to get hold of users’ PII, or even to spread covert malware. Those “What was your first car?” or “What city were you born in?” quizzes? They are not innocent entertainment—they are data collection tools designed to harvest the exact answers to your security questions. Cambridge Analytica was not an anomaly; it was a business model.

What to do instead: Think twice before filling in any online forms or sharing links to giveaways. If they seem too good to be true, they usually are. Never answer quiz questions that ask for personal details, even under the guise of fun. Data sharing with third-parties is a significant social media privacy concern, which is why it is important to read these terms when registering an account.

Real-time check-ins or travel announcements signal account owner absence, enabling SIM-swapping attacks or account access attempts timed to periods of reduced response capacity. Posting your gym schedule, your coffee shop routine, your commute route, or your “same time every week” yoga class creates a predictable pattern that stalkers, burglars, and social engineers can exploit. Exposing personal details about where you live, what you enjoy doing and where you enjoy doing it can be dangerous.

What to do instead: Share experiences, not schedules. Post about the concert after it ends, not while you are there. Avoid tagging locations in real time. Vary your routines when possible. Be especially cautious about posting when you are home alone, walking through remote areas, or following a predictable daily pattern. Privacy is not about hiding—it is about controlling who knows what, and when.