WHAT NOT TO SHARE: INFORMATION ATTACKERS CAN USE AGAINST YOU
Attackers often begin by collecting information rather than immediately attempting to break into an account. They may use small pieces of information to support impersonation, account takeover, fraud or targeted social engineering.
THE CORE PRINCIPLE
A REQUEST FOR INFORMATION SHOULD BE VERIFIED BEFORE YOU TREAT IT AS LEGITIMATE.
01 · NEVER CASUALLY SHARE AUTHENTICATION SECRETS
Be extremely careful with passwords, PINs, one-time authentication codes, recovery codes, recovery phrases and other information that can provide access to an account or wallet.
02 · PROTECT FINANCIAL INFORMATION
Be cautious with payment-card details, banking information, transaction information and other financial data. Use legitimate official channels when financial information genuinely needs to be submitted.
03 · PROTECT IDENTIFICATION DOCUMENTS
Identity documents can contain multiple identifiers in a single image. Verify who needs the document, why it is needed and how it will be handled before sending it.
04 · PROTECT SECURITY QUESTIONS AND RECOVERY INFORMATION
Information used to recover an account can be as important as the password itself. Do not provide answers or recovery details simply because someone claims to be support staff.
05 · BE CAREFUL WITH UNEXPECTED REQUESTS
A caller, message or social-media contact may ask for information while creating urgency or claiming authority. The request itself should be verified independently.
06 · USE OFFICIAL SUBMISSION CHANNELS
When sensitive information genuinely needs to be submitted, use the organization's official website, application or established process rather than an unexpected link or message.
EXAMPLE
A caller claims to be from a service provider and says they need your one-time code to “confirm ownership.” The correct response is not to provide the code. End the interaction and contact the provider through its known official channel.
WHAT TO DO
- Treat passwords, PINs, OTPs and recovery information as secrets.
- Verify requests for financial or identity information.
- Do not let urgency override verification.
- Use official channels for legitimate sensitive-data submissions.
- If you already disclosed a secret, take protective action promptly.
WHY THIS MATTERS
Attackers can combine several ordinary pieces of information to create a convincing attack. Protecting information is therefore part of protecting your accounts and identity.