What Data Brokers Know About You and How Scammers Use It

Where Scammers Get the Details That Fool You

When a scammer calls and already knows your name, the name of your employer, and the street you live on, that information almost certainly came from a data broker profile. Data brokers — companies that aggregate personal records and sell access to them — have been operating for decades, but their outputs now feed directly into modern social engineering attacks.

Scammers use this pre-gathered intelligence to practice pretexting: constructing a believable backstory before making contact. A caller claiming to be from your bank's fraud department sounds far more credible when they can recite your home address to "verify your identity." The detail itself becomes the weapon.

For a deeper look at how personal data gets collected across the digital ecosystem, see our comprehensive guide to online privacy.

What Data Brokers Actually Know

The scope of a compiled broker profile surprises most people. A typical profile may include:

• Full legal name and aliases — including maiden names and nicknames drawn from public records
• Current and past addresses — compiled from property records, utility registrations, and credit header data
• Employer and job title — often sourced from professional networking sites and resume databases
• Relatives and household members — derived from census data, voter rolls, and address co-occurrence
• Estimated income and net worth — modeled from property values, vehicle registrations, and purchase data
• Phone numbers and email addresses — aggregated from app sign-ups, loyalty programs, and public listings
• Political affiliation and religion — inferred from voter registration records where publicly available

Each data point in isolation is fairly innocuous. Combined into a single record attached to your name, the profile provides enough context for a skilled social engineer to impersonate a coworker, a utility provider, or even a family member.

How Scammers Convert Data Into Attacks

With a detailed profile in hand, attackers shift from generic mass-blast scams toward targeted spear-phishing and vishing (voice phishing). The attack patterns follow predictable templates:

Impersonation of trusted institutions

A caller references your real bank, your actual employer, or a utility company servicing your real address. The specificity signals legitimacy and lowers your guard before the actual request — usually for credentials, a one-time code, or a payment — arrives.

Family emergency fraud

Knowing the names of your relatives, scammers can call posing as a grandchild, sibling, or friend in distress, or as a law enforcement officer referencing a real family member by name. This variant disproportionately targets older adults.

SIM swap setup

Broker data helps attackers answer the security questions carriers use to verify identity, enabling them to port your number to a device they control. Understanding this risk is covered in detail in our article on SIM swap fraud and how to prevent it.

Reducing Your Exposure Over Time

Eliminating your presence from data broker databases entirely is not realistic for most people, but meaningfully reducing your profile is achievable through consistent habits:

1. Submit opt-out requests to major data brokers directly. Most are legally required to honor them, though you will likely need to repeat requests every few months as data is re-ingested from upstream sources.
2. Audit app permissions regularly. Location, contacts, and calendar access granted to apps often flow into third-party data pipelines without your awareness.
3. Limit public social media. Employer, hometown, and family relationship data displayed publicly on social profiles feeds directly into broker aggregation.
4. Use unique email addresses for different services so that data leaks from one provider cannot easily be cross-referenced with other accounts.

For more on your legal rights and practical steps to limit broker reach, see what data brokers know and how to limit their reach. You can also explore the broader landscape of mobile-targeted threats in our overview of digital threats for smartphone users.