Your phone rings. The caller says they're from the fraud team at your bank and need to check they have the right person before going any further. They read out your full name, your home address and your date of birth. All correct.
They're calling about a payment on your card, flagged a few minutes ago in another state. Are you traveling at the moment?
If you say yes, the charge doesn't match where you are, and that's what worries them. If you say no, someone else has got into your account. Either way the advice is the same: the account is compromised, and the safest thing is to move your balance into a new account they've set up for you while they lock the old one down. It needs doing now, before anything else goes out.
The call is made up, and every move in it is real. The caller never said which bank they were from, and it didn't seem to matter, because they had already shown they knew who you were.
How a Psychic Works a Room
Psychics say a bunch of things, see which one gets a reaction, then let you volunteer the information that fills the gaps. Psychologists call it cold reading. It runs on statements that are true of most people but feel personal to whoever hears them. "We're calling about a payment on your card" is one. Nearly everyone has a card, so the line lands on almost anyone, and the person on the other end supplies the detail.
It works because a lot of what feels personal is common. When Google studied hundreds of millions of security questions in 2015, a single guess at "What is your favorite food?" was right for about one English-speaking user in five. The answer was pizza.
The travel question is the fishing step. Yes and no both keep the call going, and whichever you give, you've handed over something new. Psychics don't rely on guesswork alone, either. Some research a client before the reading, which is known as hot reading, and blend what they find with the cold-reading patter. Your name, address and date of birth were the hot reading. Spy dramas show the same method: the spy finds a lever, leans on it, then lets the mark do the rest of the work in surrendering trust.
Thin Context, Delivered With Authority
Look at what made the call convincing. Three facts about you, a pretext, the authority of a bank and a deadline. That is thin context and pretext, mixed with urgency and authority, taken as proof. It isn't proof.
A caller opens with whatever their research says is relevant to the person they're calling. It doesn't have to be emotional. It just has to catch the mark's attention. A threat to your money does that, and the deadline does the rest. The most common route to compliance is to tip someone into what the psychologist Daniel Kahneman called System 1, the fast, instinctive thinking that acts before the slower, deliberate System 2 gets a chance to check the facts. Panic, confusion, fear, worry: those are the states useful to a scammer, and a threat to your savings with a clock on it is built for exactly those. A longer con pulls a different lever, trust built up over weeks, but it starts from the same kind of research.
Where the Caller Got It
Nobody would say they accept public information as proof, and nobody does it consciously or deliberately. It happens because few people know the extent of what is freely available about them, or how much can be worked out from it.
The caller's opening is the easy part. In 2024, a background-check company called National Public Data confirmed a breach. The stolen records, sold and then posted online for free, held names, addresses, dates of birth, phone numbers and Social Security numbers. A caller with records like those can recite your details before you've said a word, and your number may well be in the same data or on a people-search site.
Some of what an outsider wants has never been published, and can still be worked out. In late 2017, Strava released a global map of where its users ran and cycled, built from more than a billion activities and described by the company as aggregated and anonymized. In January 2018, an analyst noticed it showed activity at military bases around the world, along with the routines of the people stationed there. In 2021, BuzzFeed News found President Biden's Venmo account in under ten minutes. His payments were private. His friends list was public, and it led to members of his family and senior staff.
Routines and connections are what turn a generic call into a convincing one. A caller who has worked out when you travel can time the out-of-state charge to a trip you're on. A caller who has worked out who you're connected to knows who else to ring.
When the Call Goes to Someone Else
If people work for you, the same call can go to whoever runs the household's accounts: a house manager, or the assistant who pays the bills. A public profile or a list of connections can be enough to point a caller at them, and they bring exposure of their own. Do your staff know how you expose yourself? Are they aware of what is out there about their own lives, or what a savvy outsider could infer from it?
Any threat actor sufficiently motivated can find a way to pretext or convince their way into the affairs of a household that isn't sufficiently suspicious, aware or security conscious about the things it values.
"We Already Pay Someone to Delete It"
Plenty of households pay a data removal service, and it's a sensible thing to do. It might well get your number off that people-search site. It can't reach the copy of your date of birth that has already been stolen and sold, because a removal service only deals with data brokers. Even there it has limits. In Consumer Reports' 2024 test, paid services had cleared about a third of profiles after four months (we went through it in Episode 3 of the SSC podcast).
Security is never a silver bullet. Protecting against adversaries who adapt takes several layers of defense working in harmony, and the more layers addressing different aspects, the better the protection. Against this call, removal shrinks one source. Knowing what is already public tells you which details to stop trusting. An agreed household rule that anyone can stop a call and check, without needing anyone's say-so, gives everyone permission to slow down. And calling the bank yourself settles it. The Federal Trade Commission's advice is to contact the company using a phone number, website or app you know is real, never the contact details in the message you received.
Don't Sweat What You Can't Delete
None of this is a reason to panic. Minimize what you can: travel posts while you're still away, out-of-office replies that say where you've gone, friends lists left public. What's already in breach data you can't take back, and to any practical degree you shouldn't sweat it. Seeing what an outsider can find out is meant to show you where you're exposed, and it shouldn't become an exercise in anxiety. Once you understand that those details are out in the public domain, they stop working as levers against you, precisely because anyone could have them.
Run the call again with that in mind. The caller reads out your name, address and date of birth. You know all three are public, so they prove nothing. You don't answer the travel question. You say you'll call back, hang up, and ring the number on the back of your card. If there's a problem, the bank will know about it.
If someone else handles your money, they need the same reflex, and your backing to use it, including on calls that sound exactly like you. Your Voice Is No Longer Proof It's You covers how.
Seeing Your Household From the Outside
Hanging up and calling back only happens if you're suspicious enough to do it, and a caller reciting your details is what switches suspicion off. Knowing which of your details are already public is what keeps it on. Finding that out is the work a Personal Cyber Exposure Review does. It looks at your household the way an outsider would: what can be found about you, your family and, with their consent, your staff, and what can be worked out from it. You get a plain-English report of where you're exposed, what is worth minimizing, and which of the details you think of as private are already public, so none of them pass as proof.
If you'd like to see your household the way a stranger can, reach out to SuperSimpleCyber about a Personal Cyber Exposure Review.