Asos hack hands scammers customers' dates of birth
Eight of 14 retailers ask for a birth date at sign-up, security advisers now recommend faking yours because almost nobody checks
Images
Giving your date of birth can reveal an important piece in the jigsaw for scammers hoping to steal your identity. Photograph: kmt_rf/Alamy
theguardian.com
A woman delivering a package from Asos. Photograph: True Images/Alamy
theguardian.com
When the online retailer Asos was hacked recently, the thieves took customers' dates of birth — the one identifier that banks and call centres still use to confirm you are you. Cybersecurity professionals now recommend a defence that no sign-up form will appreciate: keep the real date out of the internet, or enter a false one.
A birth date alone is worth little to a criminal. Combined with a name, an address and a phone number it becomes a skeleton key — enough for a scammer posing as a bank to read back the details that convince a victim the caller is legitimate. Alexandre François of the intelligence firm WhoisXML API surveyed 14 retailers and found eight asked for a date of birth at sign-up. Retailers keep the field, he notes, because the full date yields the customer's age — useful for marketing and targeting.
Serpil Hall of Datos Insights describes the assembly line that follows. A retail breach provides name, birth date, email and address; other leaked data adds credentials, phone numbers and identifiers; public profiles contribute employment details and relatives. The result is an 'enriched identity profile' — enough matching identifiers for a fraudster to pass for the victim at a company help desk.
The asymmetry is structural. Loyalty schemes, newsletters and competitions all ask for the birth date because it costs the collector nothing to store and yields an age for targeting; the person whose details end up on the dark web absorbs the loss. The security industry's remedy is addressed to the individual: use a fake birthday on low-risk sites, keep a separate email address for shopping so it can be discarded after a breach, and skip every field that is not mandatory.
Jake Moore, an adviser at ESET, notes that a date of birth is strictly necessary only where it is checked against official records — buying a knife online, for example. A shop otherwise needs just a payment card and a delivery address. For everything else, the form is only asking so the marketing department knows how old the customer is.