A request for your personal information is not automatically proof that the requester is legitimate or that every detail requested is necessary. Verify the requester, understand the purpose and share only what is reasonably needed.
Personal information can be useful for legitimate services, but unnecessary or exposed information can also support impersonation, fraud and social engineering.
Before sharing sensitive information, verify who is asking, why it is needed, who will receive it and whether you can provide less information without preventing the legitimate service.
Use this process when a person, business, platform, caller or message asks for personal information.
Do not answer a vague request for your personal information with a blanket yes.
A legitimate organisation should be able to explain the purpose of the request.
Do not use the request itself as proof that the requester is genuine.
A legitimate purpose does not automatically mean every requested detail is necessary.
Some information can give someone a much stronger opportunity to impersonate you or access your accounts.
Even a legitimate organisation can be impersonated through a message, social account or phone call.
The goal is not to refuse every request for information. The goal is to verify the request and reduce unnecessary exposure.
A message says you have been selected for a giveaway and asks for your NIN, phone number and bank details. Instead of sending them, find the organisation's official website and independently confirm whether the promotion exists and what information is genuinely required. If the offer cannot be verified, do not provide the requested data.
Someone claims to be from your bank and says they need the code sent to your phone to confirm that you are the account owner. The code is itself an authentication secret. Do not disclose it. End the call and contact the bank through the official app, website or a phone number you already trust.
A service provider asks you to send a complete identity document through an ordinary chat. Before sending it, verify the company independently, ask why the document is required, who will receive it, how it will be used and whether a safer or less detailed verification method is available.
A person contacts you through social media and says your account needs to be verified. They ask for your password and recovery code. Do not provide either. Open the service's official website or app yourself and use its legitimate account-security or support process.
A simple registration form asks for your full home address, date of birth, identity document and several account details even though the stated service does not clearly require them. Pause and ask which fields are necessary. Avoid providing extra information simply because a form contains a field for it.
1. Request: Do I know exactly what information is being requested?
2. Purpose: Has the requester clearly explained why it is needed?
3. Requester: Did I verify who is asking through an independent channel?
4. Necessity: Is every requested detail actually necessary for the legitimate purpose?
5. Secrets: Am I being asked for a password, PIN, OTP or recovery phrase that should never be disclosed?
6. Channel: Am I sharing through a legitimate and appropriate channel rather than an unexpected message or account?
Verify the requester independently, understand the purpose and provide only what is reasonably necessary. If you cannot verify the request, stop before sharing sensitive information.
VERIFY BEFORE YOU TRUST.