Cybersecurity experts say parents should be cautious when sharing back-to-school photos on social media because the information can be used by scammers to build profiles for targeted attacks.
Tennessee Tech’s Regis Billings said details like a child’s age, school, and date of birth often act as hidden data points for threat actors. Billings said even small details like a student’s new position at a university or a specific teacher’s name can be used in impersonation scams to gain trust or convince targets to purchase gift cards.
“It’s really putting together,” Billings said, “If you’ve ever seen those old crime movies, you know, it’s not necessarily like this detective with a fedora in a smoky room, you know, putting string and thread between pictures, now it’s kind of bad guys doing that virtually.”
Billings said the information shared on social media platforms remains on the internet indefinitely and can create vulnerabilities for children.
Billings said scammers use public information to establish “bona fides” and bypass traditional security challenges by sounding familiar to their targets. Billings said parents should also consider the risks of image exploitation, where backgrounds of photos can reveal geolocations, bus numbers, or house addresses.
“I would say definitely parents are putting too much information about their kids out there already,” Billings said. “And it extends way beyond even just putting information out there about kids, it’s a little bit too much personal information about ourselves.”
Billings said parents should review privacy settings regularly and use private browsers to see what information is visible to unauthenticated users. Billings said it is also important to recognize that children often use platforms like Roblox, Discord, and Minecraft, which function as communication hubs where scammers may hang out.
“We’re very comfortable societally having the sex talk, we’re comfortable having the drug talk, and now we need to be comfortable and be knowledgeable enough to have an online privacy talk as well,” Billings said. “And this needs to be for potential scammers and we need to talk about this too within the realm of what’s called extort or sextortion, which is the trade of not very nice pictures amongst teenagers and that sort of thing.”
Billings said parents should talk to relatives and friends about operational security, such as asking them to delay posting birthday photos or avoiding tagging specific names. Billings said if a parent discovers a child’s image has been stolen or manipulated, they should immediately contact local law enforcement and the platform provider.
“Immediately contact local law enforcement,” Billings said. “Cookeville Police Department and Putnam County Sheriff’s Department do a phenomenal job of taking these types of crimes very seriously, and they will be able to assist.”
Billings said parents can still celebrate milestones by restricting account access to known friends or by delaying posts until after an event or vacation has concluded.
