How they got your information

Most scam advice skips this, and it shouldn't, because it's the piece that explains why a caller can recite your address and still be a total stranger.

The pipeline

Data brokers. Hundreds of companies whose business is compiling and selling dossiers on individuals: name, every address you've had, age, phone numbers, relatives, whether you own your home and what it's worth, estimated income, purchase history, and inferred interests. This is legal in most of the US. Some brokers specialize in exactly the categories scammers want most — recent widows, people with health conditions, people who've responded to sweepstakes.

Breaches. Companies you dealt with get hacked: insurers, pharmacies, retailers, hotels, hospitals, credit bureaus, phone companies. Those files circulate for years and get combined with each other. A name in one file plus a card number in another plus an address in a third becomes a rich profile.

Public records. Property deeds, voter rolls, court filings, business registrations, marriage records, death records, obituaries. Obituaries are especially valuable to a scammer: they name the surviving relatives, in order, with relationships spelled out. The grandparent scam runs partly on obituaries.

Social media. Birthdays, pets, schools, hometowns, grandchildren's names and faces, and where you are this week. This is also, not by coincidence, the answer key to most security questions.

Sucker lists. If you've lost money once, that fact is itself a product. It's sold, and it's why the second approach always arrives.

Your own voice and face. Any public video — a livestreamed service, a grandchild's TikTok, a work presentation — is enough audio for voice cloning.

The two consequences

1. Nothing a caller knows about you means anything.

Your address, your bank's name, your birthday, your children's names, the last four of your card — all purchasable. Recited details are a script, not a credential.

2. You are targeted, not selected at random.

The calls that reach you are often aimed. Age, home ownership, recent widowhood, and previous victimization are all filterable fields in a purchased list. That's not paranoia; it's how the lists are sold.

Which is oddly reassuring: the volume of contact you get isn't a sign that you've done something careless. It's a sign that you're in a demographic someone bought.

Reducing your exposure

You can't undo what's out there, and you shouldn't organize your life around trying. But a few hours makes a real dent:

Do these — free, high value:

• Freeze your credit at Equifax (888-378-4329), Experian (888-397-3742), and TransUnion (800-916-8800). Biggest single win available to anyone.
• Opt out of pre-approved offers — optoutprescreen.com or 888-567-8688. Fewer offers in the mailbox also means less mail theft.
• Set social media to friends-only. Yours, and ask grandchildren to do the same — their videos are the voice-cloning source.
• Remove birth year and phone number from public profiles.
• Register at donotcall.gov. Criminals ignore it, but it thins legitimate calls so the strange ones stand out more.
• Search your own name. See what a scammer sees before they see it.

Worth an afternoon:

• Opt out of the major data brokers individually. Start with Spokeo, Whitepages, BeenVerified, Intelius, Radaris, PeopleFinders, and MyLife. Each has an opt-out page; each takes a few minutes.
• Use a password manager, or a paper notebook kept somewhere private. Both beat reusing one password everywhere, which is the single most damaging habit in ordinary computer use.
• Turn on two-factor authentication on email and banking. Email first.

Optional:

• Paid removal services do work, but data gets re-listed, so it's a subscription rather than a fix. Reasonable, not necessary.

Keep this in proportion

Privacy hygiene reduces how often you're targeted. It doesn't decide whether a scam succeeds.

What decides that is the three steps — hanging up, calling a number you looked up, and waiting a day. Those work perfectly well against someone who knows everything about you.

Reduce your exposure because it's sensible. Don't rely on it, and don't lose sleep over it.

The good news buried in all this

If knowing things about you were the same as proving who they are, you'd be defenseless — because that information is out there and you can't get it back.

But it isn't the same, and you aren't defenseless. The number you dial is something they can never buy, breach, or fake. Every bit of information they've collected about you becomes useless the moment you hang up and call a number of your own choosing.