Imagine: you open your email and find a message from a "bank" with the exact balance on your card. Or a call: "Ivan Petrovich, we're from the security service, confirm the transfer." Scammers know your name, address, card number — and they didn't get it all by hacking, but from open sources. A data leak isn't necessarily a loud scandal with millions of records. Often it's enough to have one old forum where you left your phone number, or a store that still stores your passport data.
The good news: in one evening you can understand what the internet knows about you and significantly reduce your attack surface. This article provides a step-by-step plan for digital self-checking and protection against scammers. No complex terms or panic.
Why your data ends up in the public domain at all
When you register on a website, buy a ticket, or order delivery, you leave a trace. Companies store this data for years — sometimes without proper protection. A leak can occur due to a hack, an employee error, or an unscrupulous contractor. As a result, a database with your full name, phone number, and address ends up in the public domain or on shadow forums.
Scammers don't sit in ambush: they collect information bit by bit. Knowing your number and name, it's easy to fake a call from "support service." Knowing your address — to send a fake receipt. The more data, the more convincing the scenario.
Step 1. Check if you've been "exposed" in known leaks
Start with free services that aggregate data from public leaks. For example, Have I Been Pwned (haveibeenpwned.com) — enter your email and see which databases it appears in. Similarly, you can check your phone number on specialized resources, but be careful: not all of them are honest.
Important: if a service asks for a password or passport data — close the page. To check, an email or phone number is enough.
If you find your email in a leak, don't panic. The main thing is to understand what data leaked (password, phone, address). At this stage, you can have an AI twin (asibiont.com) compile a summary: it will scan open sources based on your request and provide a list of services where your data was exposed. But the decision to delete or change your password is still yours.
Step 2. Check privacy settings on social media and marketplaces
Scammers often look for victims through open profiles. Go to the settings of each social network and hide from strangers: phone number, email address, date of birth, geolocation. Ideally, leave only your name and photo visible.
On marketplaces (Ozon, Wildberries, Yandex.Market), check if your phone number is displayed in reviews or questions. If so, delete or edit it. Also disable the ability for strangers to send you private messages, if such a function exists.
Step 3. Check which sites still store your data
Remember where you registered in recent years: old forums, online stores, delivery services. Go to each and, if possible, delete your account. If you can't delete it, withdraw your consent to the processing of personal data. According to the law "On Personal Data" (152-FZ), you have the right to demand that processing be stopped and data deleted. Write a letter to support with this demand.
If you have many accounts, an AI twin can help: it will find registration emails in your inbox, group them by service, and prepare draft deletion letters. You'll still have to send them — AI doesn't file official statements without a configured integration.
Step 4. Make "digital hygiene" a habit
Protecting personal data is not a one-time event but a set of habits. Here are the main ones:
- Different passwords for different services. Use a password manager (e.g., Bitwarden or the one built into your browser). One password for everything is the biggest mistake.
- Two-factor authentication (2FA). Enable it everywhere possible: email, bank, social media. This is when you need to enter a code from SMS or an app to log in.
- Don't publish too much. Photos of your passport, tickets with QR codes, boarding passes — all of these contain your data.
- Verify calls. If someone calls "from the bank" — hang up and call back using the official number on your card.
Step 5. What to do if your data has already leaked
If you know for sure that your data has become publicly available, act quickly:
- Change passwords on all services where the same password was used.
- Check bank accounts for suspicious transactions. If anything, block the card.
- Write to Roskomnadzor a complaint about the site that illegally distributes your data. This can be done through the agency's official website.
- Warn your loved ones so they don't react to calls made in your name.
Where people most often make mistakes
Many believe they "have nothing to hide" and leave their profiles open. But scammers use even harmless data: pet's name, mother's maiden name, school name. All of this often becomes the answer to a secret question for password recovery.
Another mistake is using the same password for email and social media. Having hacked a forum, an attacker gains access to your email, and through it — to all other accounts.
Non-obvious conclusion: you can't completely delete data, but you can reduce risks
You won't be able to completely disappear from the internet: databases of government agencies, banks, and telecom operators exist by law. But you can make sure that open sources provide minimal information. The less data publicly available, the harder it is for scammers to construct a convincing legend.
What you can delegate to an AI twin
The AI twin on asibiont.com connects to your services (email, calendar, documents) and performs routine work. In the context of data protection, it can:
- find emails from services where you registered in your inbox and compile a list of accounts to delete;
- prepare draft letters to support demanding data deletion;
- check whether you have published your passport number or other sensitive data in open sources (based on your documents in the storage);
- remind you to change your password if you haven't done so in a long time.
But remember: AI does not file official statements with government agencies and does not replace a lawyer. Responsibility for decisions remains with you.
What to do next
Start by checking your email on haveibeenpwned.com. Then close public profiles on social media and enable two-factor authentication. If you find a leak — change passwords and report to Roskomnadzor. And don't forget: digital hygiene is a process, not a one-time event.
And if you want to save time searching for old registrations and preparing letters — try the AI twin on asibiont.com. It will take on the routine, leaving you only with decision-making.