Dates of birth leaked: what it means and what to do
Risk level: high. Can you change it: no. Found in 286 breaches in this directory.
What this data is
Your full birth date, day, month and year, collected at signup for age checks, identity verification, insurance quotes, birthday offers or government services.
The risk on its own
A date of birth never changes, so the exposure is permanent. On its own it cannot open an account, but it is one of the facts banks, telcos, doctors and government services use to confirm you are you. It is also a common ingredient in passwords and PINs.
The risk combined with other data
With your full name and address, a date of birth completes the basic identity set used for credit applications, account recovery and phone support checks. Add a phone number and it is what SIM swap fraudsters recite to carriers. Add an ID number and it is enough to attempt many identity checks in your name.
How criminals use it
A fraudster applies for a credit card or phone plan using your name, address and date of birth.
A caller passes your carrier's security questions with your birth date and moves your number to a new SIM.
An attacker guesses your PIN or password because it contains your birth year or the day and month.
A scammer claiming to be your bank recites your date of birth as proof, then asks for a one-time passcode.
What to do now
Place a credit freeze, called a ban period in Australia, with each credit bureau so new credit cannot be opened in your name.
Change any password or PIN built from your birth date, including phone unlock codes and card PINs.
Ask your bank and mobile carrier to add a verbal password or account PIN, so a date of birth alone does not pass their checks.
Hide your birthday on social profiles: on Facebook open your profile, About, Contact and basic info and set the birthday audience to Only me; on LinkedIn edit Contact info and limit who can see your birthday.
Never confirm your date of birth to someone who calls you, even if they say it first.
Check your credit reports every few months for accounts or enquiries you do not recognise.
Frequently asked questions
Can someone steal my identity with just my date of birth?
Not with the date alone. Combined with your name and address it covers what many basic checks ask for, which is why a credit freeze is worth doing.
Should I give websites a fake birthday?
For shopping, social and forum accounts a made-up date gives away less. Use your real date only where it is legally required, such as banking, insurance and government services.
Why do so many companies ask for it?
For age checks, identity verification and birthday marketing. Where the field is optional, leave it blank.
Breaches that exposed this data
Verifications.io: 2019-02-25, 763M accounts, Dates of birth, Email addresses, Employers, Genders, Geographic locations, IP addresses
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.