Bank expert warns: leaked personal data can become a tool for fraudsters
A Luminor bank fraud prevention expert explains how leaked personal data helps scammers build more convincing schemes, and what people can do to protect themselves.
Fraudsters are increasingly using stolen or leaked personal data to make their calls, emails and text messages more convincing, warns Marija Celma, fraud prevention expert at Luminor bank. If scammers obtain a person's name, personal identification number or home address, this information can be resold to other fraudsters and reused across multiple schemes.
How fraudsters operate
According to the expert, fraudsters often operate in an organized manner — sharing information, using shared databases and automated tools. Personal data obtained this way is cross-referenced with other data sets to build a detailed profile of a potential victim, including habits, property and vulnerabilities. While fraudsters previously relied on fragmented information from social media or public sources, they may now possess more accurate and interconnected data, making their attacks far more convincing.
A typical scheme begins with building trust — a fraudster may claim that a person's data has appeared in a leaked-data list and that they need to "confirm their identity" or "protect their account". People are often pressured into approving a Smart-ID login or taking action in online banking.
How to protect yourself
The expert advises that upon receiving an unexpected message about a data leak, people should first pause and assess the situation rather than act in haste. Suspicious links should not be clicked — online banking or government systems should only be accessed by manually typing the address into a browser. Authentication requests, such as Smart-ID, that a person did not initiate themselves should never be approved, and passwords, PIN codes or other access credentials should never be shared with anyone.
For added protection, the expert recommends enabling two-factor authentication wherever possible and using a unique, strong password for each account. If in doubt, it is best to end the conversation and contact the institution directly using the contacts listed on its official website. Any suspicion of fraud or data compromise should be reported immediately to the bank and to the State Police, since leaked data can be used against a person even months or years later.
