Protect your email, phone number and personal data

In an increasingly connected world, it’s common to have to hand over personal data to use a service.

We tend to be careful when asked for sensitive data such as an ID card or a bank card, but much less so when asked for our email address or phone number, even though this information matters just as much.

The value of personal data

As some of you know, data is often called the new oil. So how can such small pieces of information be worth so much?

Data has countless uses, so I’ll just mention a few examples.
First, your data lets companies get to know you better and target you with ads.

Another use is selling or renting this data to other companies. It’s normally anonymised, but that doesn’t change the practice (here’s an article that makes you think twice about anonymisation, in French).

As a rule, remember that your information is stored in databases, and those databases can always leak.

Personal data in the wild

Contrary to what some of the people I train tell me, data breaches are not rare. Just look at the Have I Been Pwned RSS feed: tens of millions of records leak every month… The Bouygues Telecom cyberattack, which exposed the data of 6.4 million customers, is just one recent example.

To find out whether you’ve been caught up in a data breach, Have I Been Pwned offers several tools to search for your email address, phone number or password in the breaches it has collected.

Several password managers also connect to this service to alert you automatically when you appear in a breach. Yet another good reason to use this essential tool!

So how can you protect your personal data? There’s no silver bullet, but a few good practices limit the risks and your exposure.

Protecting your email address

Most data breaches include email addresses. Attackers love them, because they can send phishing emails in bulk or cross-reference them with older breaches. If the attacker gets lucky because you don’t use a password manager and two-factor authentication, they may get hold of your “universal” password.

Fortunately, there are sites like 10 Minute Mail. Type the name into your favourite search engine and you’ll find several similar services that generate a temporary email address for you.

The idea is simple: we often have to sign up to a website to do something once, never to return. Giving our real email address is annoying, since it increases the chances of ending up in a breach. Yet we still have to provide an address and open the inbox to confirm it exists. That’s where 10 Minute Mail-type services come in.
As the name suggests, a random email address is generated for you and stays valid for 10 minutes (the duration can often be extended).

So if, two months or two years later, the site you’ve long forgotten gets hacked, your real email address will never appear in the leak, simply because you never gave it.

The rare downside is that some sites know these providers’ domain names and ban them. A bit more searching will usually turn up a service that isn’t blacklisted.

Protecting your phone number

The same thing exists for phone numbers but, for technical reasons, these numbers are usually shared, which makes signing up to some sites harder. Paid services offer dedicated numbers.

Phone numbers very often appear in data breaches. Malicious actors then send you fraudulent texts (pay postage on a parcel, use up your remaining training credit, etc.) or try vishing (voice phishing).

If your phone supports dual SIM, a basic €1-a-month plan can do the job.

Conclusion

The key takeaway: the moment you share personal information with a third-party service, you’re trusting it and accepting the risk that this information may one day end up in the wild because of a human or technical error.

You have three options:

• accept the risk: sometimes there’s no choice, for example on the Air France website when buying named tickets (and even big names get breached, as the Air France data breach showed).
• provide non-personal information: use a temporary email address to access a site without giving your real one.
• refuse the risk: too much personal information is requested for a service that isn’t worth it.

Don’t sign up just anywhere (I’m thinking of the personality quizzes on Facebook whose only real goal is to harvest as much of your personal information as possible), stay alert and all will be well!